@authyon/server 0.2.0-beta.3 → 0.2.0-beta.4

package/dist/index.js

@@ -1,10 +1,22 @@
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+import {
+  AuthorizationError,
+  AuthyonAbility,
+  AuthyonAbilityBuilder,
+  JwksTokenVerifier,
+  TokenVerificationError,
+  __privateAdd,
+  __privateGet,
+  __privateSet,
+  authorizeRequest,
+  authorizeToken,
+  clientIpHeaders,
+  createAuthorizationErrorResponse,
+  createAuthyonAbility,
+  createAuthyonRules,
+  createExpressAuthorizationMiddleware,
+  hasPermission,
+  normalizeClientIp
+} from "./chunk-24IFDJ73.js";
 
 // src/client/credentialManagement.ts
 function segment(value) {
@@ -592,167 +604,6 @@ var JsonHttpClient = class {
   }
 };
 
-// ../../internal/core/http/clientIp.ts
-function clientIpHeaders(context) {
-  if (!context?.clientIp) return {};
-  return { "X-Forwarded-For": normalizeClientIp(context.clientIp) };
-}
-function normalizeClientIp(value) {
-  let ip = value.trim();
-  if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
-  if (!ip || ip.length > 45 || ip.includes(",") || /[\r\n\s]/.test(ip) || !/^[0-9a-f:.]+$/i.test(ip) || !ip.includes(".") && !ip.includes(":")) {
-    throw invalidClientIp();
-  }
-  try {
-    new URL(ip.includes(":") ? `http://[${ip}]` : `http://${ip}`);
-  } catch {
-    throw invalidClientIp();
-  }
-  return ip;
-}
-function invalidClientIp() {
-  return new Error("Authyon: `clientIp` must be a single valid IPv4 or IPv6 address");
-}
-
-// src/security/jwksTokenVerifier.ts
-import {
-  createLocalJWKSet,
-  createRemoteJWKSet,
-  jwtVerify
-} from "jose";
-var SAFE_ASYMMETRIC_ALGORITHMS = [
-  "RS256",
-  "PS256",
-  "ES256",
-  "EdDSA"
-];
-var TokenVerificationError = class extends Error {
-  constructor(code, options = {}) {
-    super(messageForCode(code));
-    this.code = code;
-    this.name = "TokenVerificationError";
-    if (options.cause !== void 0) Object.defineProperty(this, "cause", { value: options.cause });
-  }
-};
-var JwksTokenVerifier = class {
-  constructor(options) {
-    this.options = options;
-    validateOptions(options);
-    this.algorithms = [...options.algorithms ?? ["RS256"]];
-    this.acceptedTokenTypes = new Set(options.acceptedTokenTypes ?? ["JWT", "at+jwt"]);
-    this.verifyKey = options.jwks ? createLocalJWKSet(options.jwks) : createRemoteJWKSet(new URL(options.jwksUri), {
-      timeoutDuration: options.jwksTimeoutMs ?? 5e3,
-      cacheMaxAge: options.jwksCacheMs ?? 6e5,
-      cooldownDuration: options.jwksCooldownMs ?? 3e4
-    });
-  }
-  async verifyAccessToken(token) {
-    if (!token || token.length > 16384) {
-      throw new TokenVerificationError("token.invalid");
-    }
-    try {
-      const result = await jwtVerify(token, this.verifyKey, {
-        algorithms: this.algorithms,
-        issuer: this.options.issuer,
-        audience: this.options.audience,
-        clockTolerance: this.options.clockToleranceSeconds ?? 5,
-        maxTokenAge: this.options.maxTokenAgeSeconds ?? 3600,
-        requiredClaims: ["iss", "aud", "sub", "exp", "iat"]
-      });
-      validateTokenType(result, this.acceptedTokenTypes);
-      validateClaims(result.payload);
-      return { claims: result.payload, protectedHeader: result.protectedHeader };
-    } catch (cause) {
-      if (cause instanceof TokenVerificationError) throw cause;
-      throw new TokenVerificationError(errorCode(cause), { cause });
-    }
-  }
-};
-function validateTokenType(result, acceptedTokenTypes) {
-  const type = result.protectedHeader.typ;
-  if (!type || !acceptedTokenTypes.has(type)) {
-    throw new TokenVerificationError("token.invalid_claims");
-  }
-}
-function validateClaims(claims) {
-  if (typeof claims.sub !== "string" || !claims.sub) invalidClaims();
-  if (claims.permissions !== void 0 && !isStringArray(claims.permissions)) invalidClaims();
-  if (claims.roles !== void 0 && !isStringArray(claims.roles)) invalidClaims();
-  if (claims.scope !== void 0 && typeof claims.scope !== "string") invalidClaims();
-}
-function validateOptions(options) {
-  const issuer = secureUrl(options.issuer, "issuer");
-  if (Boolean(options.jwksUri) === Boolean(options.jwks)) {
-    throw new Error("Authyon: configure exactly one of `jwksUri` or `jwks`");
-  }
-  const jwks = options.jwksUri ? secureUrl(options.jwksUri, "jwksUri") : void 0;
-  if (!options.audience || Array.isArray(options.audience) && options.audience.length === 0) {
-    throw new Error("Authyon: JWT `audience` is required");
-  }
-  if (jwks && issuer.origin !== jwks.origin) {
-    throw new Error("Authyon: `issuer` and `jwksUri` must use the same trusted origin");
-  }
-  const algorithms = options.algorithms ?? ["RS256"];
-  if (algorithms.length === 0 || algorithms.some((algorithm) => !SAFE_ASYMMETRIC_ALGORITHMS.includes(algorithm))) {
-    throw new Error("Authyon: only approved asymmetric JWT algorithms are accepted");
-  }
-  if (options.acceptedTokenTypes?.length === 0 || options.acceptedTokenTypes?.some((type) => !type.trim())) {
-    throw new Error("Authyon: `acceptedTokenTypes` must contain non-empty values");
-  }
-  for (const [name, value] of [
-    ["clockToleranceSeconds", options.clockToleranceSeconds],
-    ["maxTokenAgeSeconds", options.maxTokenAgeSeconds],
-    ["jwksTimeoutMs", options.jwksTimeoutMs],
-    ["jwksCacheMs", options.jwksCacheMs],
-    ["jwksCooldownMs", options.jwksCooldownMs]
-  ]) {
-    if (value !== void 0 && (!Number.isFinite(value) || value < 0)) {
-      throw new Error(`Authyon: \`${name}\` must be a non-negative finite number`);
-    }
-  }
-}
-function secureUrl(value, name) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`Authyon: JWT \`${name}\` must be an absolute URL`);
-  }
-  if (url.protocol !== "https:" || url.username || url.password || url.hash) {
-    throw new Error(`Authyon: JWT \`${name}\` must be a credential-free HTTPS URL`);
-  }
-  return url;
-}
-function errorCode(error) {
-  const code = isRecord(error) && typeof error.code === "string" ? error.code : "";
-  if (code === "ERR_JWT_EXPIRED") return "token.expired";
-  if (code === "ERR_JWS_SIGNATURE_VERIFICATION_FAILED") return "token.invalid_signature";
-  if (code === "ERR_JWKS_TIMEOUT") {
-    return "token.key_unavailable";
-  }
-  if (code === "ERR_JWKS_NO_MATCHING_KEY") return "token.invalid_signature";
-  if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED") {
-    const claim = isRecord(error) && typeof error.claim === "string" ? error.claim : "";
-    return claim === "nbf" ? "token.not_active" : "token.invalid_claims";
-  }
-  return "token.invalid";
-}
-function messageForCode(code) {
-  if (code === "token.key_unavailable") return "Token verification key is unavailable";
-  if (code === "token.expired") return "Token has expired";
-  if (code === "token.not_active") return "Token is not active yet";
-  return "Token verification failed";
-}
-function invalidClaims() {
-  throw new TokenVerificationError("token.invalid_claims");
-}
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-
 // src/client/authyonServerClient.ts
 var _clientSecret;
 var AuthyonServerClient = class {
@@ -1293,308 +1144,6 @@ var AuthyonServerClientBuilder = class {
   }
 };
 _options = new WeakMap();
-
-// ../../internal/core/authorization/ability.ts
-var AuthyonAbility = class {
-  constructor(rules = [], detectSubjectType = defaultSubjectType) {
-    this.detectSubjectType = detectSubjectType;
-    this.listeners = /* @__PURE__ */ new Set();
-    this.currentRules = rules.map(cloneRule);
-  }
-  get rules() {
-    return this.currentRules;
-  }
-  can(action, subject, field) {
-    const subjectType = typeof subject === "string" ? subject : this.detectSubjectType(subject);
-    for (let index = this.currentRules.length - 1; index >= 0; index -= 1) {
-      const rule = this.currentRules[index];
-      if (!matchesToken(rule.action, action, "manage")) continue;
-      if (!matchesToken(rule.subject, subjectType, "all")) continue;
-      if (field && rule.fields && !rule.fields.some((value) => matchesField(value, field)))
-        continue;
-      if (rule.conditions) {
-        if (typeof subject === "string" || !matchesConditions(subject, rule.conditions)) continue;
-      }
-      return !rule.inverted;
-    }
-    return false;
-  }
-  cannot(action, subject, field) {
-    return !this.can(action, subject, field);
-  }
-  rulesFor(action, subject) {
-    return this.currentRules.filter(
-      (rule) => matchesToken(rule.action, action, "manage") && matchesToken(rule.subject, subject, "all")
-    );
-  }
-  update(rules) {
-    this.currentRules = rules.map(cloneRule);
-    for (const listener of this.listeners) listener(this.rules);
-  }
-  on(event, listener) {
-    if (event !== "updated") return () => void 0;
-    this.listeners.add(listener);
-    return () => this.listeners.delete(listener);
-  }
-};
-var AuthyonAbilityBuilder = class {
-  constructor() {
-    this.rules = [];
-  }
-  can(action, subject, conditions, fields) {
-    this.rules.push({ action, subject, conditions, fields });
-    return this;
-  }
-  cannot(action, subject, conditions, fields, reason) {
-    this.rules.push({ action, subject, conditions, fields, reason, inverted: true });
-    return this;
-  }
-  build(options = {}) {
-    return new AuthyonAbility(this.rules, options.detectSubjectType);
-  }
-};
-function createAuthyonAbility(source = {}, options = {}) {
-  return new AuthyonAbility(createAuthyonRules(source, options), options.detectSubjectType);
-}
-function hasPermission(source, requiredPermission) {
-  const requirement = permissionToRule(requiredPermission);
-  if (!requirement || typeof requirement.action !== "string" || typeof requirement.subject !== "string") {
-    return false;
-  }
-  const permissionSource = isPermissionList(source) ? { permissions: source } : source;
-  return createAuthyonAbility(permissionSource).can(requirement.action, requirement.subject);
-}
-function isPermissionList(source) {
-  return Array.isArray(source);
-}
-function createAuthyonRules(source = {}, options = {}) {
-  const permissions = /* @__PURE__ */ new Set([
-    ...source.permissions ?? [],
-    ...source.scope?.split(/\s+/).filter(Boolean) ?? []
-  ]);
-  const rules = [...permissions].map(permissionToRule).filter(isAbilityRule);
-  for (const role of /* @__PURE__ */ new Set([...source.roles ?? [], ...options.roles ?? []])) {
-    rules.push(...(options.roleRules?.[role] ?? []).map(cloneRule));
-  }
-  rules.push(...(options.rules ?? []).map(cloneRule));
-  return rules;
-}
-function permissionToRule(permission) {
-  const normalized = permission.trim();
-  if (!normalized) return null;
-  if (normalized === "*" || normalized === "*:*" || normalized === "all:manage") {
-    return { action: "manage", subject: "all" };
-  }
-  const separator = normalized.lastIndexOf(":");
-  if (separator <= 0 || separator === normalized.length - 1) return null;
-  const subject = normalized.slice(0, separator);
-  const action = normalized.slice(separator + 1);
-  return {
-    action: action === "*" ? "manage" : action,
-    subject: subject === "*" ? "all" : subject
-  };
-}
-function matchesToken(value, expected, wildcard) {
-  return (Array.isArray(value) ? value : [value]).some(
-    (candidate) => candidate === expected || candidate === wildcard || candidate === "*" || matchesSegments(candidate, expected)
-  );
-}
-function matchesSegments(pattern, value) {
-  const patternSegments = pattern.split(":");
-  const valueSegments = value.split(":");
-  return patternSegments.length === valueSegments.length && patternSegments.every((segment2, index) => segment2 === "*" || segment2 === valueSegments[index]);
-}
-function matchesField(pattern, field) {
-  if (pattern === "*" || pattern === field) return true;
-  return pattern.endsWith(".*") && field.startsWith(pattern.slice(0, -1));
-}
-function matchesConditions(subject, conditions) {
-  return Object.entries(conditions).every(([path, expected]) => {
-    if (path === "$and" && Array.isArray(expected)) {
-      return expected.every(
-        (condition) => matchesConditions(subject, condition)
-      );
-    }
-    if (path === "$or" && Array.isArray(expected)) {
-      return expected.some(
-        (condition) => matchesConditions(subject, condition)
-      );
-    }
-    return matchesValue(readPath(subject, path), expected);
-  });
-}
-function matchesValue(actual, expected) {
-  if (!isRecord2(expected) || !Object.keys(expected).some((key) => key.startsWith("$"))) {
-    return isRecord2(expected) && isRecord2(actual) ? matchesConditions(actual, expected) : Object.is(actual, expected);
-  }
-  return Object.entries(expected).every(([operator, operand]) => {
-    switch (operator) {
-      case "$eq":
-        return Object.is(actual, operand);
-      case "$ne":
-        return !Object.is(actual, operand);
-      case "$in":
-        return Array.isArray(operand) && operand.some((value) => Object.is(actual, value));
-      case "$nin":
-        return Array.isArray(operand) && !operand.some((value) => Object.is(actual, value));
-      case "$gt":
-        return typeof actual === "number" && typeof operand === "number" && actual > operand;
-      case "$gte":
-        return typeof actual === "number" && typeof operand === "number" && actual >= operand;
-      case "$lt":
-        return typeof actual === "number" && typeof operand === "number" && actual < operand;
-      case "$lte":
-        return typeof actual === "number" && typeof operand === "number" && actual <= operand;
-      case "$exists":
-        return operand ? actual !== void 0 : actual === void 0;
-      default:
-        return false;
-    }
-  });
-}
-function readPath(value, path) {
-  return path.split(".").reduce((current, part) => isRecord2(current) ? current[part] : void 0, value);
-}
-function defaultSubjectType(subject) {
-  const explicit = subject.__type ?? subject.type ?? subject.kind;
-  if (typeof explicit === "string") return explicit;
-  const constructorName = subject.constructor?.name;
-  return typeof constructorName === "string" ? constructorName : "Object";
-}
-function cloneRule(rule) {
-  return {
-    ...rule,
-    action: Array.isArray(rule.action) ? [...rule.action] : rule.action,
-    subject: Array.isArray(rule.subject) ? [...rule.subject] : rule.subject,
-    fields: rule.fields ? [...rule.fields] : void 0
-  };
-}
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isAbilityRule(value) {
-  return value !== null;
-}
-
-// src/integrations/authorization.ts
-var AuthorizationError = class extends Error {
-  constructor(status, code, message) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "AuthorizationError";
-  }
-};
-async function authorizeToken(client, token, options = {}) {
-  if (!token) throw unauthenticated();
-  let userId;
-  let permissions = [];
-  let roles = [];
-  let scope;
-  if (options.verification === "jwks") {
-    if (!options.jwksVerifier) {
-      throw new Error("Authyon: `jwksVerifier` is required for JWKS verification");
-    }
-    let verified;
-    try {
-      verified = await options.jwksVerifier.verifyAccessToken(token);
-    } catch (error) {
-      if (!(error instanceof TokenVerificationError)) throw error;
-      if (error.code === "token.key_unavailable") {
-        throw new AuthorizationError(
-          503,
-          "authorization.unavailable",
-          "Token verification is temporarily unavailable"
-        );
-      }
-      throw unauthenticated();
-    }
-    const { claims } = verified;
-    userId = claims.sub;
-    permissions = claims.permissions ?? [];
-    roles = claims.roles ?? [];
-    scope = claims.scope;
-  } else if (options.verification === "introspect") {
-    const identity = await client.introspect(token, { clientIp: options.clientIp });
-    if (!identity.active) throw unauthenticated();
-    userId = identity.sub;
-    permissions = identity.permissions ?? [];
-    roles = identity.roles ?? [];
-    scope = identity.scope;
-  } else {
-    const identity = await client.validate(token, { clientIp: options.clientIp });
-    if (!identity.valid || !identity.user) throw unauthenticated();
-    userId = identity.user.id;
-    permissions = identity.user.permissions ?? [];
-  }
-  const ability = createAuthyonAbility(
-    { permissions, roles, scope },
-    {
-      rules: options.rules,
-      roleRules: options.roleRules,
-      roles: options.roles,
-      detectSubjectType: options.detectSubjectType
-    }
-  );
-  if (options.requirement && !canAccess(ability, options.requirement)) {
-    throw new AuthorizationError(403, "authorization.forbidden", "Permission denied");
-  }
-  return { token, userId, ability, permissions, roles };
-}
-function authorizeRequest(client, request, options = {}) {
-  const clientIp = options.resolveClientIp?.(request) ?? options.clientIp;
-  return authorizeToken(client, bearerToken(request.headers.get("authorization")), {
-    ...options,
-    clientIp
-  });
-}
-function createExpressAuthorizationMiddleware(client, options = {}) {
-  return async (request, response, next) => {
-    try {
-      const header = request.headers.authorization;
-      const clientIp = resolveExpressClientIp(request, options);
-      const context = await authorizeToken(
-        client,
-        bearerToken(Array.isArray(header) ? header[0] : header),
-        { ...options, clientIp }
-      );
-      request[options.requestProperty ?? "authyon"] = context;
-      next();
-    } catch (error) {
-      if (options.passErrorsToNext || !(error instanceof AuthorizationError)) {
-        next(error);
-        return;
-      }
-      response.status(error.status).json({ code: error.code, message: error.message });
-    }
-  };
-}
-function resolveExpressClientIp(request, options) {
-  const resolved = options.resolveClientIp?.(request) ?? (options.trustProxy ? request.ip : request.socket?.remoteAddress);
-  return resolved ? normalizeClientIp(stripIpv4Prefix(resolved)) : void 0;
-}
-function stripIpv4Prefix(value) {
-  return value.startsWith("::ffff:") ? value.slice(7) : value;
-}
-function createAuthorizationErrorResponse(error) {
-  if (!(error instanceof AuthorizationError)) throw error;
-  return Response.json({ code: error.code, message: error.message }, { status: error.status });
-}
-function canAccess(ability, requirement) {
-  return ability.can(requirement.action, requirement.subject, requirement.field);
-}
-function bearerToken(header) {
-  const match = header?.match(/^Bearer\s+(.+)$/i);
-  if (!match?.[1]) throw unauthenticated();
-  return match[1].trim();
-}
-function unauthenticated() {
-  return new AuthorizationError(
-    401,
-    "authorization.unauthenticated",
-    "A valid bearer token is required"
-  );
-}
 export {
   AuthorizationError,
   AuthyonAbility,