@argos-js/auth 0.0.0-stage → 0.1.0

package/dist/hasher/password-manager.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultPasswordManager = exports.PasswordManager = void 0;
+exports.hashPassword = hashPassword;
+exports.verifyPassword = verifyPassword;
+exports.needsRehash = needsRehash;
+const scrypt_hasher_1 = require("./scrypt-hasher");
+const argon2_hasher_1 = require("./argon2-hasher");
+/**
+ * Unified Password Manager coordinating multi-algorithm hashing and verification.
+ * Automatically inspects stored hash prefixes ($argon2id$, $scrypt$, etc.) to verify
+ * without requiring the caller to specify which algorithm was used.
+ */
+class PasswordManager {
+    hashers = new Map();
+    defaultAlgorithm;
+    constructor(options = {}) {
+        const scrypt = new scrypt_hasher_1.ScryptHasher(options.scrypt);
+        const argon2 = new argon2_hasher_1.Argon2Hasher(options.argon2);
+        this.register('scrypt', scrypt);
+        this.register('argon2id', argon2);
+        this.register('argon2', argon2);
+        if (options.default) {
+            this.defaultAlgorithm = options.default;
+        }
+        else if (argon2.isAvailable()) {
+            this.defaultAlgorithm = 'argon2';
+        }
+        else {
+            this.defaultAlgorithm = 'scrypt';
+        }
+    }
+    /**
+     * Registers a custom hasher implementation.
+     */
+    register(name, hasher) {
+        this.hashers.set(name.toLowerCase(), hasher);
+        return this;
+    }
+    /**
+     * Hashes a password using the default or specified algorithm.
+     */
+    async hash(password, algorithm) {
+        const targetAlgo = (algorithm ?? this.defaultAlgorithm).toLowerCase();
+        const hasher = this.hashers.get(targetAlgo);
+        if (!hasher) {
+            throw new Error(`Password hasher for algorithm "${targetAlgo}" is not registered`);
+        }
+        return hasher.hash(password);
+    }
+    /**
+     * Verifies a password against any supported stored hash format.
+     */
+    async verify(password, hash) {
+        if (!password || !hash) {
+            return false;
+        }
+        const trimmed = hash.trim();
+        // Auto-detect algorithm based on PHC format prefix
+        if (trimmed.startsWith('$argon2')) {
+            const hasher = this.hashers.get('argon2') || this.hashers.get('argon2id');
+            if (hasher)
+                return hasher.verify(password, trimmed);
+        }
+        if (trimmed.startsWith('$scrypt$')) {
+            const hasher = this.hashers.get('scrypt');
+            if (hasher)
+                return hasher.verify(password, trimmed);
+        }
+        // Fallback: try default hasher
+        const defaultHasher = this.hashers.get(this.defaultAlgorithm);
+        if (defaultHasher) {
+            return defaultHasher.verify(password, trimmed);
+        }
+        return false;
+    }
+    /**
+     * Checks if the stored hash should be upgraded (e.g. algorithm migrated or cost increased).
+     */
+    needsRehash(hash) {
+        if (!hash)
+            return true;
+        const trimmed = hash.trim();
+        const defaultHasher = this.hashers.get(this.defaultAlgorithm);
+        if (!defaultHasher)
+            return true;
+        // Check if the hash matches the default algorithm
+        if (this.defaultAlgorithm === 'argon2' || this.defaultAlgorithm === 'argon2id') {
+            if (!trimmed.startsWith('$argon2'))
+                return true;
+        }
+        else if (this.defaultAlgorithm === 'scrypt') {
+            if (!trimmed.startsWith('$scrypt$'))
+                return true;
+        }
+        return defaultHasher.needsRehash(trimmed);
+    }
+    /**
+     * Returns the name of the current default algorithm.
+     */
+    getDefaultAlgorithm() {
+        return this.defaultAlgorithm;
+    }
+}
+exports.PasswordManager = PasswordManager;
+// Global default singleton
+exports.defaultPasswordManager = new PasswordManager();
+/**
+ * Convenience helper: Hashes password using the default enterprise hasher.
+ */
+function hashPassword(password, algorithm) {
+    return exports.defaultPasswordManager.hash(password, algorithm);
+}
+/**
+ * Convenience helper: Verifies password against stored hash.
+ */
+function verifyPassword(password, hash) {
+    return exports.defaultPasswordManager.verify(password, hash);
+}
+/**
+ * Convenience helper: Checks if hash needs re-hashing.
+ */
+function needsRehash(hash) {
+    return exports.defaultPasswordManager.needsRehash(hash);
+}
+//# sourceMappingURL=password-manager.js.map

package/dist/hasher/password-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-manager.js","sourceRoot":"","sources":["../../src/hasher/password-manager.ts"],"names":[],"mappings":";;;AA0HA,oCAEC;AAKD,wCAEC;AAKD,kCAEC;AAzID,mDAAyE;AACzE,mDAAyE;AAQzE;;;;GAIG;AACH,MAAa,eAAe;IAClB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,gBAAgB,CAAS;IAEjC,YAAY,UAAkC,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,4BAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;QAC1C,CAAC;aAAM,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,IAAY,EAAE,MAAc;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,SAAkB;QACpD,MAAM,UAAU,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,qBAAqB,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QAChD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,mDAAmD;QACnD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1E,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,+BAA+B;QAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,IAAY;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,kDAAkD;QAClD,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClD,CAAC;aAAM,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QACnD,CAAC;QAED,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,mBAAmB;QACxB,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAnGD,0CAmGC;AAED,2BAA2B;AACd,QAAA,sBAAsB,GAAG,IAAI,eAAe,EAAE,CAAC;AAE5D;;GAEG;AACH,SAAgB,YAAY,CAAC,QAAgB,EAAE,SAAkB;IAC/D,OAAO,8BAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC3D,OAAO,8BAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,IAAY;IACtC,OAAO,8BAAsB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/hasher/scrypt-hasher.d.ts

@@ -0,0 +1,30 @@
+import type { Hasher } from './hasher.interface';
+export interface ScryptHasherOptions {
+    cost?: number;
+    blockSize?: number;
+    parallelization?: number;
+    parallel?: number;
+    keyLength?: number;
+    saltLength?: number;
+    maxmem?: number;
+}
+/**
+ * Enterprise-grade Scrypt password hasher backed natively by node:crypto.
+ * Generates standard PHC formatted strings:
+ * `$scrypt$ln=<N_log2>,r=<r>,p=<p>$<salt_b64url>$<hash_b64url>`
+ */
+export declare class ScryptHasher implements Hasher {
+    readonly algorithm = "scrypt";
+    private readonly cost;
+    private readonly blockSize;
+    private readonly parallelization;
+    private readonly keyLength;
+    private readonly saltLength;
+    private readonly maxmem;
+    constructor(options?: ScryptHasherOptions);
+    hash(password: string, customOptions?: ScryptHasherOptions): Promise<string>;
+    verify(password: string, hash: string): Promise<boolean>;
+    needsRehash(hash: string, customOptions?: ScryptHasherOptions): boolean;
+    private deriveKey;
+}
+//# sourceMappingURL=scrypt-hasher.d.ts.map

package/dist/hasher/scrypt-hasher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrypt-hasher.d.ts","sourceRoot":"","sources":["../../src/hasher/scrypt-hasher.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,qBAAa,YAAa,YAAW,MAAM;IACzC,SAAgB,SAAS,YAAY;IAErC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,GAAE,mBAAwB;IAShC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBhF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuD9D,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,GAAE,mBAAwB,GAAG,OAAO;IA4BlF,OAAO,CAAC,SAAS;CA2BlB"}

package/dist/hasher/scrypt-hasher.js

@@ -0,0 +1,158 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScryptHasher = void 0;
+const crypto = __importStar(require("node:crypto"));
+/**
+ * Enterprise-grade Scrypt password hasher backed natively by node:crypto.
+ * Generates standard PHC formatted strings:
+ * `$scrypt$ln=<N_log2>,r=<r>,p=<p>$<salt_b64url>$<hash_b64url>`
+ */
+class ScryptHasher {
+    algorithm = 'scrypt';
+    cost;
+    blockSize;
+    parallelization;
+    keyLength;
+    saltLength;
+    maxmem;
+    constructor(options = {}) {
+        this.cost = options.cost ?? 16384;
+        this.blockSize = options.blockSize ?? 8;
+        this.parallelization = options.parallelization ?? options.parallel ?? 1;
+        this.keyLength = options.keyLength ?? 32;
+        this.saltLength = options.saltLength ?? 16;
+        this.maxmem = options.maxmem ?? 32 * 1024 * 1024;
+    }
+    async hash(password, customOptions = {}) {
+        const cost = customOptions.cost ?? this.cost;
+        const blockSize = customOptions.blockSize ?? this.blockSize;
+        const parallelization = customOptions.parallelization ?? this.parallelization;
+        const keyLength = customOptions.keyLength ?? this.keyLength;
+        const saltLength = customOptions.saltLength ?? this.saltLength;
+        const maxmem = customOptions.maxmem ?? this.maxmem;
+        const salt = crypto.randomBytes(saltLength);
+        const derivedKey = await this.deriveKey(password, salt, cost, blockSize, parallelization, keyLength, maxmem);
+        const log2Cost = Math.round(Math.log2(cost));
+        const saltB64 = salt.toString('base64url');
+        const hashB64 = derivedKey.toString('base64url');
+        return `$scrypt$ln=${log2Cost},r=${blockSize},p=${parallelization}$${saltB64}$${hashB64}`;
+    }
+    async verify(password, hash) {
+        if (!hash || !hash.startsWith('$scrypt$')) {
+            return false;
+        }
+        const parts = hash.split('$');
+        // parts[0] === ''
+        // parts[1] === 'scrypt'
+        // parts[2] === params (ln=14,r=8,p=1)
+        // parts[3] === saltB64
+        // parts[4] === hashB64
+        if (parts.length !== 5) {
+            return false;
+        }
+        const paramsStr = parts[2];
+        const saltB64 = parts[3];
+        const hashB64 = parts[4];
+        let ln = 14;
+        let r = 8;
+        let p = 1;
+        for (const param of paramsStr.split(',')) {
+            const [key, val] = param.split('=');
+            if (key === 'ln')
+                ln = parseInt(val, 10);
+            else if (key === 'r')
+                r = parseInt(val, 10);
+            else if (key === 'p')
+                p = parseInt(val, 10);
+        }
+        const cost = Math.pow(2, ln);
+        const salt = Buffer.from(saltB64, 'base64url');
+        const expectedHash = Buffer.from(hashB64, 'base64url');
+        try {
+            const derivedKey = await this.deriveKey(password, salt, cost, r, p, expectedHash.length, this.maxmem);
+            if (derivedKey.length !== expectedHash.length) {
+                return false;
+            }
+            return crypto.timingSafeEqual(derivedKey, expectedHash);
+        }
+        catch {
+            return false;
+        }
+    }
+    needsRehash(hash, customOptions = {}) {
+        if (!hash || !hash.startsWith('$scrypt$')) {
+            return true;
+        }
+        const targetCost = customOptions.cost ?? this.cost;
+        const targetBlockSize = customOptions.blockSize ?? this.blockSize;
+        const targetParallelization = customOptions.parallelization ?? this.parallelization;
+        const targetLog2Cost = Math.round(Math.log2(targetCost));
+        const parts = hash.split('$');
+        if (parts.length !== 5)
+            return true;
+        const paramsStr = parts[2];
+        let ln = 0;
+        let r = 0;
+        let p = 0;
+        for (const param of paramsStr.split(',')) {
+            const [key, val] = param.split('=');
+            if (key === 'ln')
+                ln = parseInt(val, 10);
+            else if (key === 'r')
+                r = parseInt(val, 10);
+            else if (key === 'p')
+                p = parseInt(val, 10);
+        }
+        return ln < targetLog2Cost || r < targetBlockSize || p < targetParallelization;
+    }
+    deriveKey(password, salt, cost, blockSize, parallelization, keyLength, maxmem) {
+        return new Promise((resolve, reject) => {
+            crypto.scrypt(password, salt, keyLength, {
+                N: cost,
+                r: blockSize,
+                p: parallelization,
+                maxmem,
+            }, (err, derivedKey) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(derivedKey);
+            });
+        });
+    }
+}
+exports.ScryptHasher = ScryptHasher;
+//# sourceMappingURL=scrypt-hasher.js.map

package/dist/hasher/scrypt-hasher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrypt-hasher.js","sourceRoot":"","sources":["../../src/hasher/scrypt-hasher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AAatC;;;;GAIG;AACH,MAAa,YAAY;IACP,SAAS,GAAG,QAAQ,CAAC;IAEpB,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,eAAe,CAAS;IACxB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,MAAM,CAAS;IAEhC,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,gBAAqC,EAAE;QACzE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAC5D,MAAM,eAAe,GAAG,aAAa,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC;QAC9E,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAC5D,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC;QAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE7G,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAEjD,OAAO,cAAc,QAAQ,MAAM,SAAS,MAAM,eAAe,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;IAC5F,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QAChD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,kBAAkB;QAClB,wBAAwB;QACxB,sCAAsC;QACtC,uBAAuB;QACvB,uBAAuB;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzB,IAAI,EAAE,GAAG,EAAE,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,CAAC,GAAG,CAAC,CAAC;QAEV,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,IAAI;gBAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;iBACpC,IAAI,GAAG,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;iBACvC,IAAI,GAAG,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CACrC,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,CAAC,EACD,CAAC,EACD,YAAY,CAAC,MAAM,EACnB,IAAI,CAAC,MAAM,CACZ,CAAC;YAEF,IAAI,UAAU,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;gBAC9C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,IAAY,EAAE,gBAAqC,EAAE;QACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;QACnD,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAClE,MAAM,qBAAqB,GAAG,aAAa,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC;QACpF,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,CAAC,GAAG,CAAC,CAAC;QAEV,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,IAAI;gBAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;iBACpC,IAAI,GAAG,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;iBACvC,IAAI,GAAG,KAAK,GAAG;gBAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,EAAE,GAAG,cAAc,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,qBAAqB,CAAC;IACjF,CAAC;IAEO,SAAS,CACf,QAAgB,EAChB,IAAY,EACZ,IAAY,EACZ,SAAiB,EACjB,eAAuB,EACvB,SAAiB,EACjB,MAAc;QAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,MAAM,CACX,QAAQ,EACR,IAAI,EACJ,SAAS,EACT;gBACE,CAAC,EAAE,IAAI;gBACP,CAAC,EAAE,SAAS;gBACZ,CAAC,EAAE,eAAe;gBAClB,MAAM;aACP,EACD,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;gBAClB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,UAAU,CAAC,CAAC;YAC3B,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAnJD,oCAmJC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from './config.js';
+export * from './hasher/index.js';
+export * from './tokens/index.js';
+export * from './certificates/index.js';
+export * from './oauth/index.js';
+export * from './oauth2/index.js';
+export * from './guards/index.js';
+export * from './middleware/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAC;AAG5B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Config
+__exportStar(require("./config.js"), exports);
+// Hasher
+__exportStar(require("./hasher/index.js"), exports);
+// Tokens
+__exportStar(require("./tokens/index.js"), exports);
+// Certificates & mTLS / JWKS
+__exportStar(require("./certificates/index.js"), exports);
+// OAuth 2.1 / OIDC & PKCE
+__exportStar(require("./oauth/index.js"), exports);
+__exportStar(require("./oauth2/index.js"), exports);
+// Guards
+__exportStar(require("./guards/index.js"), exports);
+// Middleware
+__exportStar(require("./middleware/index.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS;AACT,8CAA4B;AAE5B,SAAS;AACT,oDAAkC;AAElC,SAAS;AACT,oDAAkC;AAElC,6BAA6B;AAC7B,0DAAwC;AAExC,0BAA0B;AAC1B,mDAAiC;AACjC,oDAAkC;AAElC,SAAS;AACT,oDAAkC;AAElC,aAAa;AACb,wDAAsC"}

package/dist/middleware/auth.middleware.d.ts

@@ -0,0 +1,42 @@
+import type { ArgosContext } from '@argos-js/net';
+import type { AuthGuard, AuthUser } from '../guards/guard.interface.js';
+declare module '@argos-js/net' {
+    interface ArgosContext {
+        user?: AuthUser;
+        auth?: {
+            user: AuthUser;
+            guard: string;
+        };
+    }
+}
+export interface AuthMiddlewareOptions {
+    /**
+     * Scopes required to access this endpoint.
+     * If provided, returns 403 Forbidden if user does not possess all required scopes.
+     */
+    scopes?: string[];
+    /**
+     * Roles required to access this endpoint.
+     * If provided, returns 403 Forbidden if user does not possess at least one required role.
+     */
+    roles?: string[];
+    /**
+     * If true, allows unauthenticated requests to pass through with ctx.user = undefined.
+     */
+    optional?: boolean;
+}
+export declare function registerGuard(guard: AuthGuard): void;
+export declare function getGuard(name: string): AuthGuard | undefined;
+export declare function clearGuards(): void;
+export type GuardInput = string | AuthGuard;
+/**
+ * Creates an Argos authentication middleware supporting single or multiple guards.
+ *
+ * Example:
+ * ```ts
+ * router.get('/profile', auth('jwt'), (ctx) => ctx.json(ctx.user));
+ * router.get('/api/data', auth(['jwt', 'api-key'], { scopes: ['read:data'] }), handler);
+ * ```
+ */
+export declare function auth(guards: GuardInput | GuardInput[], options?: AuthMiddlewareOptions): (ctx: ArgosContext, next: () => Promise<any>) => Promise<any>;
+//# sourceMappingURL=auth.middleware.d.ts.map

package/dist/middleware/auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAGxE,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,YAAY;QACpB,IAAI,CAAC,EAAE,QAAQ,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,EAAE,QAAQ,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC;KACH;CACF;AAED,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAKD,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAEpD;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAE5D;AAED,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAClB,MAAM,EAAE,UAAU,GAAG,UAAU,EAAE,EACjC,OAAO,GAAE,qBAA0B,IAIE,KAAK,YAAY,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,CAAC,KAAG,OAAO,CAAC,GAAG,CAAC,CA+HhG"}

package/dist/middleware/auth.middleware.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerGuard = registerGuard;
+exports.getGuard = getGuard;
+exports.clearGuards = clearGuards;
+exports.auth = auth;
+// Global guard registry
+const guardRegistry = new Map();
+function registerGuard(guard) {
+    guardRegistry.set(guard.name, guard);
+}
+function getGuard(name) {
+    return guardRegistry.get(name);
+}
+function clearGuards() {
+    guardRegistry.clear();
+}
+/**
+ * Creates an Argos authentication middleware supporting single or multiple guards.
+ *
+ * Example:
+ * ```ts
+ * router.get('/profile', auth('jwt'), (ctx) => ctx.json(ctx.user));
+ * router.get('/api/data', auth(['jwt', 'api-key'], { scopes: ['read:data'] }), handler);
+ * ```
+ */
+function auth(guards, options = {}) {
+    const guardList = Array.isArray(guards) ? guards : [guards];
+    return async function authMiddleware(ctx, next) {
+        let authenticatedUser;
+        let matchedGuardName;
+        let lastErrorMessage;
+        for (const item of guardList) {
+            let guard;
+            if (typeof item === 'string') {
+                guard = guardRegistry.get(item);
+                if (!guard) {
+                    throw new Error(`Auth guard "${item}" is not registered. Register it with registerGuard() first.`);
+                }
+            }
+            else {
+                guard = item;
+            }
+            try {
+                const result = await guard.authenticate(ctx);
+                if (result.authenticated && result.user) {
+                    authenticatedUser = result.user;
+                    matchedGuardName = result.guard || guard.name;
+                    break;
+                }
+                else if (result.error) {
+                    lastErrorMessage = result.error;
+                }
+            }
+            catch (err) {
+                lastErrorMessage = err.message || 'Authentication error';
+            }
+        }
+        if (!authenticatedUser) {
+            if (options.optional) {
+                return next();
+            }
+            const status = 401;
+            const errorResponse = {
+                statusCode: status,
+                error: 'Unauthorized',
+                message: lastErrorMessage || 'Authentication required',
+            };
+            if (typeof ctx.json === 'function') {
+                return ctx.json(errorResponse, status);
+            }
+            return {
+                statusCode: status,
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(errorResponse),
+            };
+        }
+        // Check scopes if specified
+        if (options.scopes && options.scopes.length > 0) {
+            const userScopes = new Set([
+                ...(authenticatedUser.scopes ?? []),
+                ...(authenticatedUser.permissions ?? []),
+            ]);
+            const missingScopes = options.scopes.filter((scope) => !userScopes.has(scope));
+            if (missingScopes.length > 0) {
+                const status = 403;
+                const errorResponse = {
+                    statusCode: status,
+                    error: 'Forbidden',
+                    message: `Insufficient scopes. Missing: ${missingScopes.join(', ')}`,
+                    requiredScopes: options.scopes,
+                };
+                if (typeof ctx.json === 'function') {
+                    return ctx.json(errorResponse, status);
+                }
+                return {
+                    statusCode: status,
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify(errorResponse),
+                };
+            }
+        }
+        // Check roles if specified
+        if (options.roles && options.roles.length > 0) {
+            const userRoles = new Set(authenticatedUser.roles ?? []);
+            const hasAnyRole = options.roles.some((role) => userRoles.has(role));
+            if (!hasAnyRole) {
+                const status = 403;
+                const errorResponse = {
+                    statusCode: status,
+                    error: 'Forbidden',
+                    message: `Forbidden: user lacks required roles (${options.roles.join(', ')})`,
+                    requiredRoles: options.roles,
+                };
+                if (typeof ctx.json === 'function') {
+                    return ctx.json(errorResponse, status);
+                }
+                return {
+                    statusCode: status,
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify(errorResponse),
+                };
+            }
+        }
+        // Attach user to context
+        ctx.user = authenticatedUser;
+        ctx.auth = {
+            user: authenticatedUser,
+            guard: matchedGuardName || 'unknown',
+        };
+        if (typeof ctx.set === 'function') {
+            ctx.set('user', authenticatedUser);
+            ctx.set('auth', ctx.auth);
+        }
+        const anyCtx = ctx;
+        if (anyCtx.req) {
+            anyCtx.req.user = authenticatedUser;
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=auth.middleware.js.map

package/dist/middleware/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/middleware/auth.middleware.ts"],"names":[],"mappings":";;AAkCA,sCAEC;AAED,4BAEC;AAED,kCAEC;AAaD,oBAqIC;AA/JD,wBAAwB;AACxB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAqB,CAAC;AAEnD,SAAgB,aAAa,CAAC,KAAgB;IAC5C,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAgB,WAAW;IACzB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAID;;;;;;;;GAQG;AACH,SAAgB,IAAI,CAClB,MAAiC,EACjC,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAiB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE1E,OAAO,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAwB;QAC9E,IAAI,iBAAuC,CAAC;QAC5C,IAAI,gBAAoC,CAAC;QACzC,IAAI,gBAAoC,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,KAA4B,CAAC;YAEjC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,8DAA8D,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACxC,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC;oBAChC,gBAAgB,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC;oBAC9C,MAAM;gBACR,CAAC;qBAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACxB,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC;gBAClC,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,gBAAgB,GAAG,GAAG,CAAC,OAAO,IAAI,sBAAsB,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC;YACnB,MAAM,aAAa,GAAG;gBACpB,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,gBAAgB,IAAI,yBAAyB;aACvD,CAAC;YAEF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACnC,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,MAAM;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;aACpC,CAAC;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS;gBACjC,GAAG,CAAC,iBAAiB,CAAC,MAAM,IAAI,EAAE,CAAC;gBACnC,GAAG,CAAC,iBAAiB,CAAC,WAAW,IAAI,EAAE,CAAC;aACzC,CAAC,CAAC;YAEH,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,GAAG,CAAC;gBACnB,MAAM,aAAa,GAAG;oBACpB,UAAU,EAAE,MAAM;oBAClB,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,iCAAiC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACpE,cAAc,EAAE,OAAO,CAAC,MAAM;iBAC/B,CAAC;gBAEF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;gBAED,OAAO;oBACL,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,GAAG,CAAC;gBACnB,MAAM,aAAa,GAAG;oBACpB,UAAU,EAAE,MAAM;oBAClB,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,yCAAyC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC7E,aAAa,EAAE,OAAO,CAAC,KAAK;iBAC7B,CAAC;gBAEF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACnC,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;gBAED,OAAO;oBACL,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;iBACpC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC7B,GAAG,CAAC,IAAI,GAAG;YACT,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,gBAAgB,IAAI,SAAS;SACrC,CAAC;QAEF,IAAI,OAAQ,GAAW,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC1C,GAAW,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAC3C,GAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,GAAU,CAAC;QAC1B,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,iBAAiB,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,2 @@
+export * from './auth.middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.middleware.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC"}

package/dist/oauth/base.provider.d.ts

@@ -0,0 +1,27 @@
+import type { AuthorizationUrlResult, BaseOAuthProviderOptions, CreateAuthorizationUrlOptions, GetUserOptions, OAuthTokens, OAuthUser } from './oauth.types.js';
+export declare abstract class BaseOAuthProvider {
+    protected options: BaseOAuthProviderOptions;
+    constructor(options: BaseOAuthProviderOptions);
+    get name(): string;
+    /**
+     * Generates the authorization URL with PKCE (S256) and CSRF protection.
+     */
+    createAuthorizationUrl(options?: CreateAuthorizationUrlOptions): AuthorizationUrlResult;
+    /**
+     * Exchanges an authorization code for access and refresh tokens.
+     */
+    exchangeCodeForTokens(code: string, codeVerifier?: string): Promise<OAuthTokens>;
+    /**
+     * Fetches the raw user profile from userinfo endpoint.
+     */
+    fetchUserInfo(accessToken: string): Promise<Record<string, unknown>>;
+    /**
+     * Maps provider-specific raw JSON profile into standard OAuthUser format.
+     */
+    abstract mapUser(rawProfile: Record<string, unknown>, tokens: OAuthTokens): Promise<OAuthUser> | OAuthUser;
+    /**
+     * High-level flow: validates CSRF state, exchanges code for tokens, and returns mapped user.
+     */
+    getUser(options: GetUserOptions): Promise<OAuthUser>;
+}
+//# sourceMappingURL=base.provider.d.ts.map

package/dist/oauth/base.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.provider.d.ts","sourceRoot":"","sources":["../../src/oauth/base.provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,cAAc,EACd,WAAW,EACX,SAAS,EACV,MAAM,kBAAkB,CAAC;AAG1B,8BAAsB,iBAAiB;IACrC,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC;gBAEhC,OAAO,EAAE,wBAAwB;IAI7C,IAAW,IAAI,IAAI,MAAM,CAExB;IAED;;OAEG;IACI,sBAAsB,CAAC,OAAO,GAAE,6BAAkC,GAAG,sBAAsB;IAgDlG;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAqD7F;;OAEG;IACU,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoBjF;;OAEG;aACa,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS;IAEjH;;OAEG;IACU,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;CAalE"}