@authyon/server 0.2.0-beta.5 → 0.2.0-beta.8

package/dist/index.js

@@ -1,12 +1,19 @@
+import {
+  AuthyonError,
+  DEFAULT_BASE_URL,
+  DEFAULT_EXPIRY_SKEW_MS,
+  ErrorCodes,
+  FetchHttpAdapter,
+  JsonHttpClient,
+  LoggingHttpAdapter,
+  createSharedTransport
+} from "./chunk-56H66KLG.js";
 import {
   AuthorizationError,
   AuthyonAbility,
   AuthyonAbilityBuilder,
   JwksTokenVerifier,
   TokenVerificationError,
-  __privateAdd,
-  __privateGet,
-  __privateSet,
   authorizeRequest,
   authorizeToken,
   clientIpHeaders,
@@ -15,8 +22,14 @@ import {
   createAuthyonRules,
   createExpressAuthorizationMiddleware,
   hasPermission,
+  hasPermissionGroup,
   normalizeClientIp
-} from "./chunk-24IFDJ73.js";
+} from "./chunk-NKWQMYB3.js";
+import {
+  __privateAdd,
+  __privateGet,
+  __privateSet
+} from "./chunk-77J4NURK.js";
 
 // src/client/credentialManagement.ts
 function segment(value) {
@@ -262,10 +275,6 @@ var WorkspaceInvitesClient = class {
 };
 _request3 = new WeakMap();
 
-// ../../internal/core/config/defaults.ts
-var DEFAULT_BASE_URL = "https://api.authyon.com";
-var DEFAULT_EXPIRY_SKEW_MS = 3e4;
-
 // ../../internal/core/auth/expiringTokenProvider.ts
 var _token, _inFlight;
 var ExpiringTokenProvider = class {
@@ -295,315 +304,6 @@ var ExpiringTokenProvider = class {
 _token = new WeakMap();
 _inFlight = new WeakMap();
 
-// ../../internal/core/errors/authyonError.ts
-var ErrorCodes = {
-  Unknown: "unknown",
-  NetworkError: "request.network_error",
-  Timeout: "request.timeout",
-  SessionMalformed: "session.malformed",
-  NotAuthenticated: "auth.not_authenticated",
-  InvalidToken: "auth.invalid_token",
-  MissingToken: "auth.missing_token",
-  EmailTaken: "user.email_taken",
-  PasswordWeak: "user.password_weak",
-  PasswordPwned: "user.password_pwned",
-  RateLimited: "rate_limited"
-};
-var AuthyonError = class extends Error {
-  constructor(status, body, options = {}) {
-    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
-    this.name = "AuthyonError";
-    this.status = status;
-    this.code = body.code ?? "unknown";
-    this.title = body.title ?? "Error";
-    this.detail = body.detail;
-    this.requestId = options.requestId;
-    this.retryAfter = options.retryAfter;
-    this.cause = options.cause;
-  }
-  is(code) {
-    return this.code === code;
-  }
-  isAny(...codes) {
-    return codes.includes(this.code);
-  }
-  hasPrefix(prefix) {
-    return this.code.startsWith(prefix);
-  }
-  isStatus(...statuses) {
-    return statuses.includes(this.status);
-  }
-  /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
-  interpret() {
-    const category = classifyError(this.status, this.code);
-    return {
-      category,
-      action: actionFor(category),
-      retryable: isRetryable(category),
-      ...this.retryAfter !== void 0 ? { retryAfter: this.retryAfter } : {},
-      ...this.requestId !== void 0 ? { requestId: this.requestId } : {}
-    };
-  }
-  get category() {
-    return this.interpret().category;
-  }
-  get retryable() {
-    return this.interpret().retryable;
-  }
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      status: this.status,
-      code: this.code,
-      title: this.title,
-      detail: this.detail,
-      requestId: this.requestId,
-      retryAfter: this.retryAfter,
-      ...this.interpret()
-    };
-  }
-};
-function classifyError(status, code) {
-  if (code === ErrorCodes.NetworkError) return "network";
-  if (code === ErrorCodes.Timeout || status === 408) return "timeout";
-  if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
-  if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
-  if (code === ErrorCodes.PasswordWeak || code === ErrorCodes.PasswordPwned) return "validation";
-  if (code === ErrorCodes.SessionMalformed) return "server";
-  if (code.startsWith("auth.") || status === 401) return "authentication";
-  if (status === 403) return "authorization";
-  if (status === 404) return "not_found";
-  if (status === 400 || status === 422) return "validation";
-  if (status >= 500) return "server";
-  return "unknown";
-}
-function actionFor(category) {
-  switch (category) {
-    case "network":
-    case "timeout":
-    case "rate_limit":
-    case "server":
-      return "retry";
-    case "authentication":
-      return "reauthenticate";
-    case "authorization":
-      return "request_access";
-    case "validation":
-      return "fix_input";
-    case "not_found":
-      return "not_found";
-    case "conflict":
-      return "resolve_conflict";
-    case "unknown":
-      return "contact_support";
-  }
-}
-function isRetryable(category) {
-  return category === "network" || category === "timeout" || category === "rate_limit" || category === "server";
-}
-
-// ../../internal/core/http/query.ts
-function appendQuery(path, params) {
-  if (!params) return path;
-  const query = new URLSearchParams();
-  for (const [key, value2] of Object.entries(params)) {
-    if (value2 !== void 0) query.set(key, String(value2));
-  }
-  const value = query.toString();
-  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
-}
-
-// ../../internal/core/http/httpAdapter.ts
-var FetchHttpAdapter = class {
-  constructor(fetchImpl = fetch.bind(globalThis)) {
-    this.fetchImpl = fetchImpl;
-  }
-  request(request) {
-    return this.fetchImpl(request.url, {
-      method: request.method,
-      headers: request.headers,
-      body: request.body,
-      signal: request.signal,
-      redirect: "error"
-    });
-  }
-};
-var LoggingHttpAdapter = class {
-  constructor(adapter, options) {
-    this.adapter = adapter;
-    this.options = options;
-  }
-  async request(request) {
-    const startedAt = Date.now();
-    const eventBase = {
-      method: request.method,
-      url: sanitizeUrl(request.url)
-    };
-    this.log({ type: "request", ...eventBase, timestamp: startedAt });
-    try {
-      const response = await this.adapter.request(request);
-      this.log({
-        type: "response",
-        ...eventBase,
-        status: response.status,
-        durationMs: Date.now() - startedAt,
-        requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
-        timestamp: Date.now()
-      });
-      return response;
-    } catch (error) {
-      this.log({
-        type: "error",
-        ...eventBase,
-        errorName: error instanceof Error ? error.name : "UnknownError",
-        durationMs: Date.now() - startedAt,
-        timestamp: Date.now()
-      });
-      throw error;
-    }
-  }
-  log(event) {
-    if (!this.options.enabled) return;
-    const logger = this.options.logger ?? defaultHttpLogger;
-    try {
-      logger(event);
-    } catch {
-    }
-  }
-};
-function defaultHttpLogger(event) {
-  console.debug("[Authyon HTTP]", event);
-}
-function sanitizeUrl(value) {
-  const url = new URL(value);
-  url.username = "";
-  url.password = "";
-  url.hash = "";
-  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
-  const queryKeys = /* @__PURE__ */ new Set();
-  url.searchParams.forEach((_value, key) => queryKeys.add(key));
-  url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
-  return url.toString();
-}
-
-// ../../internal/core/http/transport.ts
-var DEFAULT_TIMEOUT_MS = 15e3;
-var SharedTransportError = class extends Error {
-  constructor(code, cause) {
-    super(code === "request.timeout" ? "Request timed out" : "Network request failed");
-    this.name = "SharedTransportError";
-    this.code = code;
-    this.cause = cause;
-  }
-};
-function createSharedTransport(options) {
-  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp ?? false);
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
-    throw new Error("Authyon: `timeoutMs` must be a non-negative finite number");
-  }
-  if (options.httpAdapter && options.fetch) {
-    throw new Error("Authyon: use either `httpAdapter` or `fetch`, not both");
-  }
-  const baseAdapter = options.httpAdapter ?? new FetchHttpAdapter(options.fetch);
-  const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
-  return {
-    baseUrl,
-    async request(path, init) {
-      const controller = new AbortController();
-      const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
-      try {
-        return await httpAdapter.request({
-          url: `${baseUrl}${path}`,
-          method: init.method ?? "GET",
-          headers: normalizeHeaders(init.headers),
-          body: init.body,
-          signal: controller.signal
-        });
-      } catch (cause) {
-        throw new SharedTransportError(
-          controller.signal.aborted ? ErrorCodes.Timeout : ErrorCodes.NetworkError,
-          cause
-        );
-      } finally {
-        if (timeout !== void 0) clearTimeout(timeout);
-      }
-    }
-  };
-}
-function normalizeHeaders(headers) {
-  const normalized = {};
-  new Headers(headers).forEach((value, key) => {
-    normalized[key] = value;
-  });
-  return normalized;
-}
-function responseMetadata(response) {
-  const retryAfterHeader = response.headers.get("retry-after");
-  const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
-  return {
-    requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
-    retryAfter: Number.isFinite(retryAfter) ? retryAfter : void 0
-  };
-}
-function normalizeBaseUrl(value, allowInsecureHttp) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error("Authyon: `baseUrl` must be an absolute URL");
-  }
-  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
-    throw new Error(
-      "Authyon: `baseUrl` must use HTTPS (HTTP is allowed only for loopback or with `allowInsecureHttp`)"
-    );
-  }
-  if (url.username || url.password || url.search || url.hash) {
-    throw new Error(
-      "Authyon: `baseUrl` cannot contain credentials, query parameters, or fragments"
-    );
-  }
-  return url.toString().replace(/\/+$/, "");
-}
-
-// ../../internal/core/http/jsonHttpClient.ts
-var JsonHttpClient = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  async send(path, options = {}) {
-    const headers = { ...options.headers };
-    if (options.body !== void 0) headers["Content-Type"] = "application/json";
-    try {
-      return await this.transport.request(appendQuery(path, options.query), {
-        method: options.method ?? "GET",
-        headers,
-        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
-      });
-    } catch (cause) {
-      if (!(cause instanceof SharedTransportError)) throw cause;
-      throw new AuthyonError(0, { code: cause.code, title: cause.message }, { cause: cause.cause });
-    }
-  }
-  async parse(response) {
-    if (!response.ok) {
-      let body = {};
-      try {
-        body = await response.json();
-      } catch {
-      }
-      throw new AuthyonError(response.status, body, responseMetadata(response));
-    }
-    if (response.status === 204) return void 0;
-    return await response.json();
-  }
-  async request(path, options = {}) {
-    return this.parse(await this.send(path, options));
-  }
-};
-
 // src/client/authyonServerClient.ts
 var _clientSecret;
 var AuthyonServerClient = class {
@@ -642,6 +342,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -760,7 +468,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -791,7 +503,18 @@ var AuthyonServerClient = class {
           envBearer: true,
           body: input
         }),
-        /** DELETE /env/tenants/{tenantId} — delete a tenant. */
+        /** PUT /env/tenants/{tenantId}/metadata - replace public and private metadata. */
+        updateMetadata: (tenantId, input) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/metadata`, {
+          method: "PUT",
+          envBearer: true,
+          body: input
+        }),
+        /** POST /env/tenants/{tenantId}/disable — disable without removing tenant data. */
+        disable: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}/disable`, {
+          method: "POST",
+          envBearer: true
+        }),
+        /** DELETE /env/tenants/{tenantId} — logically delete (disable) a tenant. */
         delete: (tenantId) => this.request(`/env/tenants/${encodeURIComponent(tenantId)}`, {
           method: "DELETE",
           envBearer: true
@@ -926,6 +649,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -952,7 +676,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1103,8 +830,8 @@ var TenantScopedClient = class {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-  validate() {
-    return this.request("/tenant/auth/validate", { method: "POST" });
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
   }
 };
 function createClient(options = {}) {
@@ -1126,6 +853,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;
@@ -1172,5 +903,6 @@ export {
   createClient,
   createExpressAuthorizationMiddleware,
   hasPermission,
+  hasPermissionGroup,
   normalizeClientIp
 };

package/dist/next.d.cts

@@ -1,5 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-NQe6R3am.cjs';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-DPlRA9qM.cjs';
+import { A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,5 +1,6 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-NQe6R3am.js';
+import { R as RequestAuthorizationOptions, A as AbilitySubject, a as AuthorizationError } from './authorization-BZTzR6iu.js';
+import { A as AuthyonServerClient } from './authyonServerClient-D8r47VSq.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.js

@@ -2,7 +2,8 @@ import {
   AuthorizationError,
   authorizeRequest,
   authorizeToken
-} from "./chunk-24IFDJ73.js";
+} from "./chunk-NKWQMYB3.js";
+import "./chunk-77J4NURK.js";
 
 // src/next.ts
 async function PermissionGuard({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.8",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",
@@ -27,6 +27,13 @@
       "require": "./dist/index.cjs",
       "default": "./dist/index.js"
     },
+    "./bff": {
+      "types": "./dist/bff.d.ts",
+      "browser": "./dist/browser.js",
+      "import": "./dist/bff.js",
+      "require": "./dist/bff.cjs",
+      "default": "./dist/bff.js"
+    },
     "./next": {
       "types": "./dist/next.d.ts",
       "import": "./dist/next.js",
@@ -43,7 +50,7 @@
     "provenance": true
   },
   "scripts": {
-    "build": "tsup src/index.ts src/browser.ts src/next.ts --format esm,cjs --dts --clean",
+    "build": "tsup src/index.ts src/browser.ts src/next.ts src/bff.ts --format esm,cjs --dts --clean",
     "typecheck": "tsc --noEmit",
     "prepack": "npm run build"
   },
@@ -66,6 +73,7 @@
     }
   },
   "devDependencies": {
+    "@types/node": "^22.20.2",
     "@types/react": "^19.2.18",
     "tsup": "^8.0.0",
     "typescript": "^5.5.0"