@authyon/server 0.2.0-beta.0 → 0.2.0-beta.11

package/dist/next.cjs

@@ -0,0 +1,328 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/next.ts
+var next_exports = {};
+__export(next_exports, {
+  PermissionGuard: () => PermissionGuard
+});
+module.exports = __toCommonJS(next_exports);
+
+// ../../internal/core/authorization/ability.ts
+var AuthyonAbility = class {
+  constructor(rules = [], detectSubjectType = defaultSubjectType) {
+    this.detectSubjectType = detectSubjectType;
+    this.listeners = /* @__PURE__ */ new Set();
+    this.currentRules = rules.map(cloneRule);
+  }
+  get rules() {
+    return this.currentRules;
+  }
+  can(action, subject, field) {
+    const subjectType = typeof subject === "string" ? subject : this.detectSubjectType(subject);
+    for (let index = this.currentRules.length - 1; index >= 0; index -= 1) {
+      const rule = this.currentRules[index];
+      if (!matchesToken(rule.action, action, "manage")) continue;
+      if (!matchesToken(rule.subject, subjectType, "all")) continue;
+      if (field && rule.fields && !rule.fields.some((value) => matchesField(value, field)))
+        continue;
+      if (rule.conditions) {
+        if (typeof subject === "string" || !matchesConditions(subject, rule.conditions)) continue;
+      }
+      return !rule.inverted;
+    }
+    return false;
+  }
+  cannot(action, subject, field) {
+    return !this.can(action, subject, field);
+  }
+  rulesFor(action, subject) {
+    return this.currentRules.filter(
+      (rule) => matchesToken(rule.action, action, "manage") && matchesToken(rule.subject, subject, "all")
+    );
+  }
+  update(rules) {
+    this.currentRules = rules.map(cloneRule);
+    for (const listener of this.listeners) listener(this.rules);
+  }
+  on(event, listener) {
+    if (event !== "updated") return () => void 0;
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+};
+function createAuthyonAbility(source = {}, options = {}) {
+  return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
+}
+function createAuthyonRules(source = {}, options = {}) {
+  const permissions = /* @__PURE__ */ new Set([
+    ...source.permissions ?? [],
+    ...source.scope?.split(/\s+/).filter(Boolean) ?? []
+  ]);
+  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
+  for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
+    rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
+  }
+  rules.push(...(options.rules ?? []).map(cloneRule));
+  return rules;
+}
+function permissionToRule(permission) {
+  const normalized = permission.trim();
+  if (!normalized) return null;
+  if (normalized === "*" || normalized === "*:*" || normalized === "all:manage") {
+    return { action: "manage", subject: "all" };
+  }
+  const separator = normalized.lastIndexOf(":");
+  if (separator <= 0 || separator === normalized.length - 1) return null;
+  const subject = normalized.slice(0, separator);
+  const action = normalized.slice(separator + 1);
+  return {
+    action: action === "*" ? "manage" : action,
+    subject: subject === "*" ? "all" : subject
+  };
+}
+function matchesToken(value, expected, wildcard) {
+  return (Array.isArray(value) ? value : [value]).some(
+    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
+  );
+}
+function matchesSegments(pattern, value) {
+  const patternSegments = pattern.split(":");
+  const valueSegments = value.split(":");
+  return patternSegments.length === valueSegments.length && patternSegments.every((segment, index) => segment === "*" || segment === valueSegments[index]);
+}
+function matchesField(pattern, field) {
+  if (pattern === "*" || pattern === field) return true;
+  return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
+}
+function matchesConditions(subject, conditions) {
+  return Object.entries(conditions).every(([path, expected]) => {
+    if (path === "$and" && Array.isArray(expected)) {
+      return expected.every(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    if (path === "$or" && Array.isArray(expected)) {
+      return expected.some(
+        (condition) => matchesConditions(subject, condition)
+      );
+    }
+    return matchesValue(readPath(subject, path), expected);
+  });
+}
+function matchesValue(actual, expected) {
+  if (!isRecord(expected) || !Object.keys(expected).some((key) => key.startsWith("$"))) {
+    return isRecord(expected) && isRecord(actual) ? matchesConditions(actual, expected) : Object.is(actual, expected);
+  }
+  return Object.entries(expected).every(([operator, operand]) => {
+    switch (operator) {
+      case "$eq":
+        return Object.is(actual, operand);
+      case "$ne":
+        return !Object.is(actual, operand);
+      case "$in":
+        return Array.isArray(operand) && operand.some((value) => Object.is(actual, value));
+      case "$nin":
+        return Array.isArray(operand) && !operand.some((value) => Object.is(actual, value));
+      case "$gt":
+        return typeof actual === "number" && typeof operand === "number" && actual > operand;
+      case "$gte":
+        return typeof actual === "number" && typeof operand === "number" && actual >= operand;
+      case "$lt":
+        return typeof actual === "number" && typeof operand === "number" && actual < operand;
+      case "$lte":
+        return typeof actual === "number" && typeof operand === "number" && actual <= operand;
+      case "$exists":
+        return operand ? actual !== void 0 : actual === void 0;
+      default:
+        return false;
+    }
+  });
+}
+function readPath(value, path) {
+  return path.split(".").reduce((current, part) => isRecord(current) ? current[part] : void 0, value);
+}
+function defaultSubjectType(subject) {
+  const explicit = subject.__type ?? subject.type ?? subject.kind;
+  if (typeof explicit === "string") return explicit;
+  const constructorName = subject.constructor?.name;
+  return typeof constructorName === "string" ? constructorName : "Object";
+}
+function cloneRule(rule) {
+  return {
+    ...rule,
+    action: Array.isArray(rule.action) ? [...rule.action] : rule.action,
+    subject: Array.isArray(rule.subject) ? [...rule.subject] : rule.subject,
+    fields: rule.fields ? [...rule.fields] : void 0
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isAbilityRule(value) {
+  return value !== null;
+}
+
+// src/security/jwksTokenVerifier.ts
+var import_jose = require("jose");
+var TokenVerificationError = class extends Error {
+  constructor(code, options = {}) {
+    super(messageForCode(code));
+    this.code = code;
+    this.name = "TokenVerificationError";
+    if (options.cause !== void 0) Object.defineProperty(this, "cause", { value: options.cause });
+  }
+};
+function messageForCode(code) {
+  if (code === "token.key_unavailable") return "Token verification key is unavailable";
+  if (code === "token.expired") return "Token has expired";
+  if (code === "token.not_active") return "Token is not active yet";
+  return "Token verification failed";
+}
+
+// src/integrations/authorization.ts
+var AuthorizationError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.name = "AuthorizationError";
+  }
+};
+async function authorizeToken(client, token, options = {}) {
+  if (!token) throw unauthenticated();
+  let userId;
+  let permissions = [];
+  let roles = [];
+  let scope;
+  if (options.verification === "jwks") {
+    if (!options.jwksVerifier) {
+      throw new Error("Authyon: `jwksVerifier` is required for JWKS verification");
+    }
+    let verified;
+    try {
+      verified = await options.jwksVerifier.verifyAccessToken(token);
+    } catch (error) {
+      if (!(error instanceof TokenVerificationError)) throw error;
+      if (error.code === "token.key_unavailable") {
+        throw new AuthorizationError(
+          503,
+          "authorization.unavailable",
+          "Token verification is temporarily unavailable"
+        );
+      }
+      throw unauthenticated();
+    }
+    const { claims } = verified;
+    userId = claims.sub;
+    permissions = claims.permissions ?? [];
+    roles = claims.roles ?? [];
+    scope = claims.scope;
+  } else if (options.verification === "introspect") {
+    const identity = await client.introspect(token, { clientIp: options.clientIp });
+    if (!identity.active) throw unauthenticated();
+    userId = identity.sub;
+    permissions = identity.permissions ?? [];
+    roles = identity.roles ?? [];
+    scope = identity.scope;
+  } else {
+    const identity = await client.validate(token, { clientIp: options.clientIp });
+    if (!identity.valid || !identity.user) throw unauthenticated();
+    userId = identity.user.id;
+    permissions = identity.user.permissions ?? [];
+  }
+  const ability = createAuthyonAbility(
+    { permissions, roles, scope },
+    {
+      rules: options.rules,
+      roleRules: options.roleRules,
+      roles: options.roles,
+      detectSubjectType: options.detectSubjectType
+    }
+  );
+  if (options.requirement && !canAccess(ability, options.requirement)) {
+    throw new AuthorizationError(403, "authorization.forbidden", "Permission denied");
+  }
+  return { token, userId, ability, permissions, roles };
+}
+function authorizeRequest(client, request, options = {}) {
+  const clientIp = options.resolveClientIp?.(request) ?? options.clientIp;
+  return authorizeToken(client, bearerToken(request.headers.get("authorization")), {
+    ...options,
+    clientIp
+  });
+}
+function canAccess(ability, requirement) {
+  return ability.can(requirement.action, requirement.subject, requirement.field);
+}
+function bearerToken(header) {
+  const match = header?.match(/^Bearer\s+(.+)$/i);
+  if (!match?.[1]) throw unauthenticated();
+  return match[1].trim();
+}
+function unauthenticated() {
+  return new AuthorizationError(
+    401,
+    "authorization.unauthenticated",
+    "A valid bearer token is required"
+  );
+}
+
+// src/next.ts
+async function PermissionGuard({
+  client,
+  action,
+  subject,
+  field,
+  children,
+  token,
+  request,
+  unauthenticatedFallback = null,
+  forbiddenFallback = null,
+  unavailableFallback,
+  ...options
+}) {
+  try {
+    await authorizeGuardRequest(client, {
+      ...options,
+      request,
+      token,
+      requirement: { action, subject, field }
+    });
+    return children;
+  } catch (error) {
+    if (!(error instanceof AuthorizationError)) throw error;
+    if (error.status === 401) return renderFallback(unauthenticatedFallback, error);
+    if (error.status === 403) return renderFallback(forbiddenFallback, error);
+    if (unavailableFallback !== void 0) return renderFallback(unavailableFallback, error);
+    throw error;
+  }
+}
+function authorizeGuardRequest(client, options) {
+  const { request, token, ...authorizationOptions } = options;
+  if (request) return authorizeRequest(client, request, authorizationOptions);
+  return authorizeToken(client, token ?? "", authorizationOptions);
+}
+function renderFallback(fallback, error) {
+  return typeof fallback === "function" ? fallback({ error }) : fallback;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PermissionGuard
+});

package/dist/next.d.cts

@@ -0,0 +1,27 @@
+import { ReactNode } from 'react';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-CeP_GqT7.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.cjs';
+import 'jose';
+
+interface ServerPermissionGuardFallbackContext {
+    error: AuthorizationError;
+}
+type ServerPermissionGuardFallback = ReactNode | ((context: ServerPermissionGuardFallbackContext) => ReactNode | Promise<ReactNode>);
+interface ServerPermissionGuardProps extends Omit<RequestAuthorizationOptions, "requirement"> {
+    client: AuthyonServerClient;
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+    children: ReactNode;
+    /** Bearer token already extracted from cookies, headers or session state. */
+    token?: string | null;
+    /** Web Request available in Route Handlers and other Fetch runtimes. */
+    request?: Pick<Request, "headers">;
+    unauthenticatedFallback?: ServerPermissionGuardFallback;
+    forbiddenFallback?: ServerPermissionGuardFallback;
+    unavailableFallback?: ServerPermissionGuardFallback;
+}
+/** Server Component guard for Next.js layouts and pages. */
+declare function PermissionGuard({ client, action, subject, field, children, token, request, unauthenticatedFallback, forbiddenFallback, unavailableFallback, ...options }: ServerPermissionGuardProps): Promise<ReactNode>;
+
+export { PermissionGuard, type ServerPermissionGuardFallback, type ServerPermissionGuardFallbackContext, type ServerPermissionGuardProps };

package/dist/next.d.ts

@@ -0,0 +1,27 @@
+import { ReactNode } from 'react';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-D_A6L9Ie.js';
+import { A as AuthyonServerClient } from './authyonServerClient-D-DxoL30.js';
+import 'jose';
+
+interface ServerPermissionGuardFallbackContext {
+    error: AuthorizationError;
+}
+type ServerPermissionGuardFallback = ReactNode | ((context: ServerPermissionGuardFallbackContext) => ReactNode | Promise<ReactNode>);
+interface ServerPermissionGuardProps extends Omit<RequestAuthorizationOptions, "requirement"> {
+    client: AuthyonServerClient;
+    action: string;
+    subject: AbilitySubject;
+    field?: string;
+    children: ReactNode;
+    /** Bearer token already extracted from cookies, headers or session state. */
+    token?: string | null;
+    /** Web Request available in Route Handlers and other Fetch runtimes. */
+    request?: Pick<Request, "headers">;
+    unauthenticatedFallback?: ServerPermissionGuardFallback;
+    forbiddenFallback?: ServerPermissionGuardFallback;
+    unavailableFallback?: ServerPermissionGuardFallback;
+}
+/** Server Component guard for Next.js layouts and pages. */
+declare function PermissionGuard({ client, action, subject, field, children, token, request, unauthenticatedFallback, forbiddenFallback, unavailableFallback, ...options }: ServerPermissionGuardProps): Promise<ReactNode>;
+
+export { PermissionGuard, type ServerPermissionGuardFallback, type ServerPermissionGuardFallbackContext, type ServerPermissionGuardProps };

package/dist/next.js

@@ -0,0 +1,48 @@
+import {
+  AuthorizationError,
+  authorizeRequest,
+  authorizeToken
+} from "./chunk-NKWQMYB3.js";
+import "./chunk-77J4NURK.js";
+
+// src/next.ts
+async function PermissionGuard({
+  client,
+  action,
+  subject,
+  field,
+  children,
+  token,
+  request,
+  unauthenticatedFallback = null,
+  forbiddenFallback = null,
+  unavailableFallback,
+  ...options
+}) {
+  try {
+    await authorizeGuardRequest(client, {
+      ...options,
+      request,
+      token,
+      requirement: { action, subject, field }
+    });
+    return children;
+  } catch (error) {
+    if (!(error instanceof AuthorizationError)) throw error;
+    if (error.status === 401) return renderFallback(unauthenticatedFallback, error);
+    if (error.status === 403) return renderFallback(forbiddenFallback, error);
+    if (unavailableFallback !== void 0) return renderFallback(unavailableFallback, error);
+    throw error;
+  }
+}
+function authorizeGuardRequest(client, options) {
+  const { request, token, ...authorizationOptions } = options;
+  if (request) return authorizeRequest(client, request, authorizationOptions);
+  return authorizeToken(client, token ?? "", authorizationOptions);
+}
+function renderFallback(fallback, error) {
+  return typeof fallback === "function" ? fallback({ error }) : fallback;
+}
+export {
+  PermissionGuard
+};

package/package.json

@@ -1,36 +1,81 @@
-{
-  "name": "@authyon/server",
-  "version": "0.2.0-beta.0",
-  "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
-  "license": "MIT",
-  "type": "module",
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs"
-    }
-  },
-  "files": [
-    "dist"
-  ],
-  "sideEffects": false,
-  "scripts": {
-    "build": "tsup src/index.ts --format esm,cjs --dts --clean",
-    "typecheck": "tsc --noEmit"
-  },
-  "keywords": [
-    "authyon",
-    "auth",
-    "server-to-server",
-    "management-api",
-    "token-verification"
-  ],
-  "devDependencies": {
-    "tsup": "^8.0.0",
-    "typescript": "^5.5.0"
-  }
-}
+{
+  "name": "@authyon/server",
+  "version": "0.2.0-beta.11",
+  "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Synkestra/package-authyon.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://authyon.com/docs",
+  "bugs": {
+    "url": "https://github.com/Synkestra/package-authyon/issues"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    },
+    "./bff": {
+      "types": "./dist/bff.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/bff.js",
+      "require": "./dist/bff.cjs",
+      "default": "./dist/bff.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js",
+      "require": "./dist/next.cjs",
+      "default": "./dist/next.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/browser.ts src/next.ts src/bff.ts --format esm,cjs --dts --clean",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build"
+  },
+  "keywords": [
+    "authyon",
+    "auth",
+    "server-to-server",
+    "management-api",
+    "tokenVerification"
+  ],
+  "dependencies": {
+    "jose": "^6.2.10"
+  },
+  "peerDependencies": {
+    "react": ">=18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.2",
+    "@types/react": "^19.2.18",
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  }
+}