@argos-js/auth 0.0.0-stage → 0.1.0

package/dist/certificates/mtls.guard.d.ts

@@ -0,0 +1,10 @@
+import type { ArgosContext } from '@argos-js/net';
+import type { AuthGuard, GuardResult } from '../guards/guard.interface.js';
+import type { MtlsGuardOptions } from './cert.types.js';
+export declare class MtlsGuard implements AuthGuard {
+    readonly name = "mtls";
+    private options;
+    constructor(options?: MtlsGuardOptions);
+    authenticate(ctx: ArgosContext): Promise<GuardResult>;
+}
+//# sourceMappingURL=mtls.guard.d.ts.map

package/dist/certificates/mtls.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.guard.d.ts","sourceRoot":"","sources":["../../src/certificates/mtls.guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAY,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,gBAAgB,EAAqB,MAAM,iBAAiB,CAAC;AAG3E,qBAAa,SAAU,YAAW,SAAS;IACzC,QAAQ,CAAC,IAAI,UAAU;IACvB,OAAO,CAAC,OAAO,CAAmB;gBAEtB,OAAO,GAAE,gBAAqB;IASpC,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CAuJ5D"}

package/dist/certificates/mtls.guard.js

@@ -0,0 +1,156 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MtlsGuard = void 0;
+const cert_parser_js_1 = require("./cert-parser.js");
+class MtlsGuard {
+    name = 'mtls';
+    options;
+    constructor(options = {}) {
+        this.options = {
+            allowExpired: false,
+            allowSelfSigned: false,
+            trustedProxies: true,
+            ...options,
+        };
+    }
+    async authenticate(ctx) {
+        let cert = null;
+        const anyCtx = ctx;
+        // 1. Direct Socket Peer Certificate
+        const socket = anyCtx.req?.socket || anyCtx.socket;
+        if (socket && typeof socket.getPeerCertificate === 'function') {
+            try {
+                const peer = socket.getPeerCertificate(true);
+                if (peer && Object.keys(peer).length > 0 && (peer.raw || peer.subject)) {
+                    cert = (0, cert_parser_js_1.parsePeerCertificate)(peer);
+                }
+            }
+            catch {
+                // Socket certificate extraction error
+            }
+        }
+        // 2. Reverse Proxy Headers (if enabled and no direct socket cert found)
+        if (!cert && this.options.trustedProxies) {
+            const getH = (name) => {
+                const lower = name.toLowerCase();
+                return typeof ctx.getHeader === 'function'
+                    ? ctx.getHeader(lower)
+                    : ctx.headers?.[lower];
+            };
+            const certHeaderName = this.options.headerNames?.cert || 'x-forwarded-client-cert';
+            const rawCertHeader = getH(certHeaderName) || getH('ssl-client-cert') || getH('x-ssl-cert');
+            if (rawCertHeader) {
+                cert = (0, cert_parser_js_1.parseProxyClientCertHeader)(rawCertHeader);
+            }
+            // Check verify status header if present (e.g. Nginx $ssl_client_verify)
+            const verifyHeaderName = this.options.headerNames?.verify || 'ssl-client-verify';
+            const verifyStatus = getH(verifyHeaderName) || getH('x-ssl-client-verify');
+            if (verifyStatus && verifyStatus.toUpperCase() !== 'SUCCESS' && verifyStatus.toUpperCase() !== 'OK') {
+                return {
+                    authenticated: false,
+                    error: `Client certificate verification failed by upstream proxy (status: ${verifyStatus})`,
+                    guard: this.name,
+                };
+            }
+            // Fallback: If only Subject DN was forwarded by proxy
+            if (!cert) {
+                const dnHeaderName = this.options.headerNames?.dn || 'ssl-client-s-dn';
+                const rawDn = getH(dnHeaderName) || getH('x-ssl-client-s-dn');
+                if (rawDn) {
+                    const subject = (0, cert_parser_js_1.parseDn)(rawDn);
+                    cert = {
+                        subject,
+                        issuer: {},
+                        rawSubject: rawDn,
+                        rawIssuer: '',
+                        commonName: subject.CN,
+                        serialNumber: getH('ssl-client-serial') || '',
+                        fingerprint256: getH('ssl-client-fingerprint') || '',
+                        validFrom: new Date(0),
+                        validTo: new Date(Date.now() + 86400000), // assumed valid if proxy forwarded
+                        isExpired: false,
+                        isSelfSigned: false,
+                    };
+                }
+            }
+        }
+        if (!cert) {
+            return {
+                authenticated: false,
+                error: 'No client TLS certificate presented',
+                guard: this.name,
+            };
+        }
+        // Validation: Expiration
+        if (cert.isExpired && !this.options.allowExpired) {
+            return {
+                authenticated: false,
+                error: 'Client certificate has expired',
+                guard: this.name,
+            };
+        }
+        // Validation: Self-signed
+        if (cert.isSelfSigned && !this.options.allowSelfSigned) {
+            return {
+                authenticated: false,
+                error: 'Self-signed client certificates are not permitted',
+                guard: this.name,
+            };
+        }
+        // Validation: Allowed Common Names
+        if (this.options.allowedCommonNames && this.options.allowedCommonNames.length > 0) {
+            if (!cert.commonName || !this.options.allowedCommonNames.includes(cert.commonName)) {
+                return {
+                    authenticated: false,
+                    error: `Client certificate Common Name "${cert.commonName || 'unknown'}" is not authorized`,
+                    guard: this.name,
+                };
+            }
+        }
+        // Validation: Allowed Issuers
+        if (this.options.allowedIssuers && this.options.allowedIssuers.length > 0) {
+            const issuerCn = cert.issuer.CN;
+            const issuerMatch = this.options.allowedIssuers.some((allowed) => allowed === issuerCn || allowed === cert.rawIssuer);
+            if (!issuerMatch) {
+                return {
+                    authenticated: false,
+                    error: `Client certificate Issuer "${issuerCn || cert.rawIssuer || 'unknown'}" is not authorized`,
+                    guard: this.name,
+                };
+            }
+        }
+        // Resolve AuthUser
+        let user;
+        if (this.options.userResolver) {
+            const resolved = await this.options.userResolver(cert);
+            if (!resolved) {
+                return {
+                    authenticated: false,
+                    error: 'Certificate user not authorized or not found',
+                    guard: this.name,
+                };
+            }
+            user = resolved;
+        }
+        else {
+            user = {
+                id: cert.fingerprint256 || cert.serialNumber || cert.commonName || 'certificate-client',
+                type: 'certificate',
+                commonName: cert.commonName,
+                fingerprint: cert.fingerprint256,
+                serialNumber: cert.serialNumber,
+                subject: cert.subject,
+                issuer: cert.issuer,
+                roles: ['certificate-client'],
+                scopes: ['cert:authenticated'],
+            };
+        }
+        return {
+            authenticated: true,
+            user,
+            guard: this.name,
+        };
+    }
+}
+exports.MtlsGuard = MtlsGuard;
+//# sourceMappingURL=mtls.guard.js.map

package/dist/certificates/mtls.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mtls.guard.js","sourceRoot":"","sources":["../../src/certificates/mtls.guard.ts"],"names":[],"mappings":";;;AAGA,qDAA6F;AAE7F,MAAa,SAAS;IACX,IAAI,GAAG,MAAM,CAAC;IACf,OAAO,CAAmB;IAElC,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,OAAO,GAAG;YACb,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAiB;QAClC,IAAI,IAAI,GAA6B,IAAI,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAU,CAAC;QAE1B,oCAAoC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QACnD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvE,IAAI,GAAG,IAAA,qCAAoB,EAAC,IAAI,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;gBAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,OAAO,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;oBACxC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oBACtB,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,KAAK,CAAC,CAAC;YACnE,CAAC,CAAC;YAEF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,IAAI,yBAAyB,CAAC;YACnF,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;YAE5F,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,GAAG,IAAA,2CAA0B,EAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YAED,wEAAwE;YACxE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,IAAI,mBAAmB,CAAC;YACjF,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC3E,IAAI,YAAY,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpG,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,qEAAqE,YAAY,GAAG;oBAC3F,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,sDAAsD;YACtD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,iBAAiB,CAAC;gBACvE,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAC9D,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,OAAO,GAAG,IAAA,wBAAO,EAAC,KAAK,CAAC,CAAC;oBAC/B,IAAI,GAAG;wBACL,OAAO;wBACP,MAAM,EAAE,EAAE;wBACV,UAAU,EAAE,KAAK;wBACjB,SAAS,EAAE,EAAE;wBACb,UAAU,EAAE,OAAO,CAAC,EAAE;wBACtB,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE;wBAC7C,cAAc,EAAE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE;wBACpD,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;wBACtB,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,EAAE,mCAAmC;wBAC7E,SAAS,EAAE,KAAK;wBAChB,YAAY,EAAE,KAAK;qBACpB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,qCAAqC;gBAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACjD,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,gCAAgC;gBACvC,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACvD,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,mDAAmD;gBAC1D,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnF,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,mCAAmC,IAAI,CAAC,UAAU,IAAI,SAAS,qBAAqB;oBAC3F,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAClD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAK,CAAC,SAAS,CACjE,CAAC;YACF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,8BAA8B,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,SAAS,qBAAqB;oBACjG,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAc,CAAC;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,8CAA8C;oBACrD,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,QAAQ,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG;gBACL,EAAE,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,IAAI,oBAAoB;gBACvF,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,WAAW,EAAE,IAAI,CAAC,cAAc;gBAChC,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,CAAC,oBAAoB,CAAC;aAC/B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,aAAa,EAAE,IAAI;YACnB,IAAI;YACJ,KAAK,EAAE,IAAI,CAAC,IAAI;SACjB,CAAC;IACJ,CAAC;CACF;AApKD,8BAoKC"}

package/dist/config.d.ts

@@ -0,0 +1,33 @@
+export interface AuthTablesConfig {
+    users?: string;
+    apiKeys?: string;
+    oauthIdentities?: string;
+}
+export interface AuthJwtConfig {
+    secret?: string;
+    expiresIn?: string | number;
+    refreshExpiresIn?: string | number;
+    issuer?: string;
+    audience?: string | string[];
+    algorithms?: Array<'HS256' | 'RS256' | 'EdDSA' | string>;
+}
+export interface AuthApiKeyConfig {
+    prefix?: string;
+    bytes?: number;
+    header?: string;
+}
+export interface AuthConfig {
+    tablePrefix?: string;
+    tables?: AuthTablesConfig;
+    defaultGuard?: 'jwt' | 'api-key' | 'basic' | 'hmac' | 'mtls' | string;
+    jwt?: AuthJwtConfig;
+    apiKey?: AuthApiKeyConfig;
+    hasher?: 'argon2' | 'scrypt';
+    oauth?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/**
+ * Type-safe configuration helper for Argos authentication.
+ */
+export declare function defineConfig(config: AuthConfig): AuthConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,YAAY,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACtE,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAE3D"}

package/dist/config.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineConfig = defineConfig;
+/**
+ * Type-safe configuration helper for Argos authentication.
+ */
+function defineConfig(config) {
+    return config;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;AAmCA,oCAEC;AALD;;GAEG;AACH,SAAgB,YAAY,CAAC,MAAkB;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/guards/api-key.guard.d.ts

@@ -0,0 +1,21 @@
+import type { AuthGuard, AuthUser, GuardResult } from './guard.interface.js';
+import type { ArgosContext } from '@argos-js/net';
+export interface ApiKeyRecord {
+    keyHash: string;
+    user?: AuthUser;
+    scopes?: string[];
+    [key: string]: unknown;
+}
+export interface ApiKeyGuardOptions {
+    findKey: (hash: string) => Promise<ApiKeyRecord | null> | ApiKeyRecord | null;
+    header?: string;
+    allowBearer?: boolean;
+    userResolver?: (record: ApiKeyRecord) => Promise<AuthUser | null> | AuthUser | null;
+}
+export declare class ApiKeyGuard implements AuthGuard {
+    readonly name = "api-key";
+    private options;
+    constructor(options: ApiKeyGuardOptions);
+    authenticate(ctx: ArgosContext): Promise<GuardResult>;
+}
+//# sourceMappingURL=api-key.guard.d.ts.map

package/dist/guards/api-key.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.guard.d.ts","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC;CACrF;AAED,qBAAa,WAAY,YAAW,SAAS;IAC3C,QAAQ,CAAC,IAAI,aAAa;IAC1B,OAAO,CAAC,OAAO,CAAqB;gBAExB,OAAO,EAAE,kBAAkB;IAQjC,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CA+F5D"}

package/dist/guards/api-key.guard.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyGuard = void 0;
+const api_key_js_1 = require("../tokens/api-key.js");
+class ApiKeyGuard {
+    name = 'api-key';
+    options;
+    constructor(options) {
+        this.options = {
+            header: 'x-api-key',
+            allowBearer: true,
+            ...options,
+        };
+    }
+    async authenticate(ctx) {
+        let key;
+        // 1. Check primary header (e.g. x-api-key)
+        const headerName = this.options.header.toLowerCase();
+        const rawHeader = typeof ctx.getHeader === 'function'
+            ? ctx.getHeader(headerName)
+            : ctx.headers?.[headerName];
+        if (rawHeader) {
+            key = rawHeader.trim();
+        }
+        // 2. Check Authorization header if allowBearer is enabled
+        if (!key && this.options.allowBearer) {
+            const authHeader = typeof ctx.getHeader === 'function'
+                ? ctx.getHeader('authorization')
+                : ctx.headers?.[`authorization`];
+            if (authHeader) {
+                const trimmed = authHeader.trim();
+                if (trimmed.toLowerCase().startsWith('apikey ')) {
+                    key = trimmed.slice(7).trim();
+                }
+                else if (trimmed.toLowerCase().startsWith('bearer ') && trimmed.slice(7).trim().startsWith('argos_')) {
+                    key = trimmed.slice(7).trim();
+                }
+            }
+        }
+        if (!key) {
+            return {
+                authenticated: false,
+                error: 'Missing API key',
+                guard: this.name,
+            };
+        }
+        try {
+            const computedHash = (0, api_key_js_1.hashApiKey)(key);
+            const record = await this.options.findKey(computedHash);
+            if (!record || !record.keyHash) {
+                return {
+                    authenticated: false,
+                    error: 'Invalid API key',
+                    guard: this.name,
+                };
+            }
+            const isValid = (0, api_key_js_1.verifyApiKey)(key, record.keyHash);
+            if (!isValid) {
+                return {
+                    authenticated: false,
+                    error: 'Invalid API key',
+                    guard: this.name,
+                };
+            }
+            let user;
+            if (this.options.userResolver) {
+                const resolved = await this.options.userResolver(record);
+                if (!resolved) {
+                    return {
+                        authenticated: false,
+                        error: 'Associated API key user not found or deactivated',
+                        guard: this.name,
+                    };
+                }
+                user = resolved;
+            }
+            else if (record.user) {
+                user = {
+                    ...record.user,
+                    scopes: record.scopes ?? record.user.scopes,
+                };
+            }
+            else {
+                user = {
+                    id: record.id ?? 'api-key-client',
+                    scopes: record.scopes,
+                    ...record,
+                };
+            }
+            return {
+                authenticated: true,
+                user,
+                guard: this.name,
+            };
+        }
+        catch (err) {
+            return {
+                authenticated: false,
+                error: err.message || 'Error authenticating API key',
+                guard: this.name,
+            };
+        }
+    }
+}
+exports.ApiKeyGuard = ApiKeyGuard;
+//# sourceMappingURL=api-key.guard.js.map

package/dist/guards/api-key.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.guard.js","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":";;;AAAA,qDAAgE;AAkBhE,MAAa,WAAW;IACb,IAAI,GAAG,SAAS,CAAC;IAClB,OAAO,CAAqB;IAEpC,YAAY,OAA2B;QACrC,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI;YACjB,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAiB;QAClC,IAAI,GAAuB,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAO,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3B,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;gBACpD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC;gBAChC,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,eAAe,CAAC,CAAC;YAE3E,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChD,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAC;qBAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACvG,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,iBAAiB;gBACxB,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAA,uBAAU,EAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAExD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,iBAAiB;oBACxB,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,IAAA,yBAAY,EAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,iBAAiB;oBACxB,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,IAAI,IAAc,CAAC;YACnB,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,aAAa,EAAE,KAAK;wBACpB,KAAK,EAAE,kDAAkD;wBACzD,KAAK,EAAE,IAAI,CAAC,IAAI;qBACjB,CAAC;gBACJ,CAAC;gBACD,IAAI,GAAG,QAAQ,CAAC;YAClB,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG;oBACL,GAAG,MAAM,CAAC,IAAI;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM;iBAC5C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG;oBACL,EAAE,EAAG,MAAM,CAAC,EAAsB,IAAI,gBAAgB;oBACtD,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,GAAG,MAAM;iBACV,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI;gBACJ,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,8BAA8B;gBACpD,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA3GD,kCA2GC"}

package/dist/guards/basic.d.ts

@@ -0,0 +1,6 @@
+export interface BasicAuthOptions {
+    verify: (username: string, password: string) => Promise<boolean> | boolean;
+    realm?: string;
+}
+export declare function basicAuth(options: BasicAuthOptions): (ctx: any, next: () => Promise<any>) => Promise<any>;
+//# sourceMappingURL=basic.d.ts.map

package/dist/guards/basic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../src/guards/basic.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,IACnC,KAAK,GAAG,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,KAAG,OAAO,CAAC,GAAG,CAAC,CAkDhE"}

package/dist/guards/basic.guard.d.ts

@@ -0,0 +1,26 @@
+import type { AuthGuard, AuthUser, GuardResult } from './guard.interface.js';
+import type { ArgosContext } from '@argos-js/net';
+export interface BasicCredentials {
+    username: string;
+    password: string;
+}
+export interface BasicGuardOptions {
+    /**
+     * Static credentials for single-client Basic Auth.
+     * If provided, credentials will be validated using timingSafeEqual.
+     */
+    credentials?: BasicCredentials;
+    /**
+     * Dynamic validator callback (e.g. database lookup or password verification).
+     */
+    validate?: (credentials: BasicCredentials) => Promise<AuthUser | boolean | null> | AuthUser | boolean | null;
+    header?: string;
+    realm?: string;
+}
+export declare class BasicGuard implements AuthGuard {
+    readonly name = "basic";
+    private options;
+    constructor(options: BasicGuardOptions);
+    authenticate(ctx: ArgosContext): Promise<GuardResult>;
+}
+//# sourceMappingURL=basic.guard.d.ts.map

package/dist/guards/basic.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.guard.d.ts","sourceRoot":"","sources":["../../src/guards/basic.guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAaD,qBAAa,UAAW,YAAW,SAAS;IAC1C,QAAQ,CAAC,IAAI,WAAW;IACxB,OAAO,CAAC,OAAO,CAAoB;gBAEvB,OAAO,EAAE,iBAAiB;IAWhC,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;CAuG5D"}

package/dist/guards/basic.guard.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BasicGuard = void 0;
+const node_crypto_1 = require("node:crypto");
+function safeCompareStrings(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length) {
+        const dummy = Buffer.alloc(bufA.length);
+        (0, node_crypto_1.timingSafeEqual)(bufA, dummy);
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
+}
+class BasicGuard {
+    name = 'basic';
+    options;
+    constructor(options) {
+        if (!options.credentials && !options.validate) {
+            throw new Error('BasicGuard requires either "credentials" or a "validate" function.');
+        }
+        this.options = {
+            header: 'authorization',
+            realm: 'Argos',
+            ...options,
+        };
+    }
+    async authenticate(ctx) {
+        const headerName = this.options.header.toLowerCase();
+        const rawHeader = typeof ctx.getHeader === 'function'
+            ? ctx.getHeader(headerName)
+            : ctx.headers?.[headerName];
+        if (!rawHeader) {
+            return {
+                authenticated: false,
+                error: 'Missing Basic authorization header',
+                guard: this.name,
+            };
+        }
+        const trimmed = rawHeader.trim();
+        if (!trimmed.toLowerCase().startsWith('basic ')) {
+            return {
+                authenticated: false,
+                error: 'Invalid authorization scheme. Expected Basic',
+                guard: this.name,
+            };
+        }
+        const base64Part = trimmed.slice(6).trim();
+        let decoded;
+        try {
+            decoded = Buffer.from(base64Part, 'base64').toString('utf8');
+        }
+        catch {
+            return {
+                authenticated: false,
+                error: 'Malformed Basic authorization token',
+                guard: this.name,
+            };
+        }
+        const colonIndex = decoded.indexOf(':');
+        if (colonIndex === -1) {
+            return {
+                authenticated: false,
+                error: 'Malformed Basic credentials format. Expected username:password',
+                guard: this.name,
+            };
+        }
+        const username = decoded.slice(0, colonIndex);
+        const password = decoded.slice(colonIndex + 1);
+        // 1. Static credentials check with constant time comparison
+        if (this.options.credentials) {
+            const isUserMatch = safeCompareStrings(username, this.options.credentials.username);
+            const isPassMatch = safeCompareStrings(password, this.options.credentials.password);
+            if (!isUserMatch || !isPassMatch) {
+                return {
+                    authenticated: false,
+                    error: 'Invalid username or password',
+                    guard: this.name,
+                };
+            }
+            return {
+                authenticated: true,
+                user: { id: username, username },
+                guard: this.name,
+            };
+        }
+        // 2. Dynamic validator callback
+        if (this.options.validate) {
+            try {
+                const result = await this.options.validate({ username, password });
+                if (!result) {
+                    return {
+                        authenticated: false,
+                        error: 'Invalid username or password',
+                        guard: this.name,
+                    };
+                }
+                const user = typeof result === 'object'
+                    ? result
+                    : { id: username, username };
+                return {
+                    authenticated: true,
+                    user,
+                    guard: this.name,
+                };
+            }
+            catch (err) {
+                return {
+                    authenticated: false,
+                    error: err.message || 'Error validating Basic credentials',
+                    guard: this.name,
+                };
+            }
+        }
+        return {
+            authenticated: false,
+            error: 'No validation method configured for BasicGuard',
+            guard: this.name,
+        };
+    }
+}
+exports.BasicGuard = BasicGuard;
+//# sourceMappingURL=basic.guard.js.map

package/dist/guards/basic.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.guard.js","sourceRoot":"","sources":["../../src/guards/basic.guard.ts"],"names":[],"mappings":";;;AAAA,6CAA8C;AAuB9C,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAA,6BAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAa,UAAU;IACZ,IAAI,GAAG,OAAO,CAAC;IAChB,OAAO,CAAoB;IAEnC,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,OAAO;YACd,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAiB;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAO,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YACnD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAC3B,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CAAC,UAAU,CAAC,CAAC;QAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,oCAAoC;gBAC3C,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,8CAA8C;gBACrD,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,qCAAqC;gBAC5C,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,KAAK,EAAE,gEAAgE;gBACvE,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAE/C,4DAA4D;QAC5D,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAEpF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,8BAA8B;oBACrC,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAChC,KAAK,EAAE,IAAI,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;wBACL,aAAa,EAAE,KAAK;wBACpB,KAAK,EAAE,8BAA8B;wBACrC,KAAK,EAAE,IAAI,CAAC,IAAI;qBACjB,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAa,OAAO,MAAM,KAAK,QAAQ;oBAC/C,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;gBAE/B,OAAO;oBACL,aAAa,EAAE,IAAI;oBACnB,IAAI;oBACJ,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,GAAG,CAAC,OAAO,IAAI,oCAAoC;oBAC1D,KAAK,EAAE,IAAI,CAAC,IAAI;iBACjB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,aAAa,EAAE,KAAK;YACpB,KAAK,EAAE,gDAAgD;YACvD,KAAK,EAAE,IAAI,CAAC,IAAI;SACjB,CAAC;IACJ,CAAC;CACF;AAtHD,gCAsHC"}

package/dist/guards/basic.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basicAuth = basicAuth;
+function basicAuth(options) {
+    return async (ctx, next) => {
+        const authHeader = typeof ctx.getHeader === 'function'
+            ? ctx.getHeader('authorization')
+            : (ctx.headers && typeof ctx.headers.get === 'function'
+                ? ctx.headers.get('authorization')
+                : ctx.headers?.[Object.keys(ctx.headers || {}).find((k) => k.toLowerCase() === 'authorization') || '']);
+        if (!authHeader || !authHeader.startsWith('Basic ')) {
+            const realm = options.realm || 'Secure Area';
+            const wwwAuthenticate = `Basic realm="${realm}"`;
+            if (typeof ctx.setHeader === 'function') {
+                ctx.setHeader('WWW-Authenticate', wwwAuthenticate);
+            }
+            if (typeof ctx.header === 'function') {
+                ctx.header('WWW-Authenticate', wwwAuthenticate);
+            }
+            return ctx.json({ error: 'Unauthorized', message: 'Missing or invalid Basic authentication' }, 401, { 'WWW-Authenticate': wwwAuthenticate });
+        }
+        const base64Credentials = authHeader.slice(6).trim();
+        const credentials = Buffer.from(base64Credentials, 'base64').toString('utf-8');
+        const [username, ...rest] = credentials.split(':');
+        const password = rest.join(':');
+        const isValid = await options.verify(username, password);
+        if (!isValid) {
+            const realm = options.realm || 'Secure Area';
+            const wwwAuthenticate = `Basic realm="${realm}"`;
+            if (typeof ctx.setHeader === 'function') {
+                ctx.setHeader('WWW-Authenticate', wwwAuthenticate);
+            }
+            if (typeof ctx.header === 'function') {
+                ctx.header('WWW-Authenticate', wwwAuthenticate);
+            }
+            return ctx.json({ error: 'Unauthorized', message: 'Invalid credentials' }, 401, { 'WWW-Authenticate': wwwAuthenticate });
+        }
+        ctx.user = { username };
+        return next();
+    };
+}
+//# sourceMappingURL=basic.js.map

package/dist/guards/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../src/guards/basic.ts"],"names":[],"mappings":";;AAKA,8BAmDC;AAnDD,SAAgB,SAAS,CAAC,OAAyB;IACjD,OAAO,KAAK,EAAE,GAAQ,EAAE,IAAwB,EAAgB,EAAE;QAChE,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU;YACpD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU;gBACnD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBAClC,CAAC,CAAE,GAAG,CAAC,OAA8C,EAAE,CACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,IAAI,EAAE,CACtF,CAAC,CAAC;QAEX,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;YAC7C,MAAM,eAAe,GAAG,gBAAgB,KAAK,GAAG,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yCAAyC,EAAE,EAC7E,GAAG,EACH,EAAE,kBAAkB,EAAE,eAAe,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;YAC7C,MAAM,eAAe,GAAG,gBAAgB,KAAK,GAAG,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;gBACxC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,CACb,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,EACzD,GAAG,EACH,EAAE,kBAAkB,EAAE,eAAe,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/guards/guard.interface.d.ts

@@ -0,0 +1,21 @@
+import type { ArgosContext } from '@argos-js/net';
+export interface AuthUser {
+    id: string | number;
+    username?: string;
+    email?: string;
+    roles?: string[];
+    permissions?: string[];
+    scopes?: string[];
+    [key: string]: unknown;
+}
+export interface GuardResult {
+    authenticated: boolean;
+    user?: AuthUser;
+    error?: string;
+    guard?: string;
+}
+export interface AuthGuard {
+    readonly name: string;
+    authenticate(ctx: ArgosContext, options?: Record<string, unknown>): Promise<GuardResult> | GuardResult;
+}
+//# sourceMappingURL=guard.interface.d.ts.map

package/dist/guards/guard.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.interface.d.ts","sourceRoot":"","sources":["../../src/guards/guard.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAC;CACxG"}

package/dist/guards/guard.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=guard.interface.js.map

package/dist/guards/guard.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.interface.js","sourceRoot":"","sources":["../../src/guards/guard.interface.ts"],"names":[],"mappings":""}