@awesome-lang-auth/node 1.10.1

package/dist/interfaces/webhook-store.interface.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Configuration for a single outgoing webhook subscription.
+ */
+export interface WebhookConfig {
+    /** Unique identifier for this webhook registration. */
+    id: string;
+    /** The URL to POST events to. */
+    url: string;
+    /**
+     * Event name patterns this webhook subscribes to.
+     * Use `'*'` to receive all events, or specific names like
+     * `'identity.auth.login.success'`.
+     */
+    events: string[];
+    /** Optional HMAC secret for request signing (SHA-256). */
+    secret?: string;
+    /** Whether this webhook is currently active. Defaults to `true`. */
+    isActive?: boolean;
+    /**
+     * Tenant ID — when set, this webhook only fires for events belonging to
+     * that tenant.  Omit for global webhooks.
+     */
+    tenantId?: string;
+    /**
+     * Maximum number of delivery attempts before giving up.
+     * Defaults to 3.
+     */
+    maxRetries?: number;
+    /**
+     * Initial retry delay in milliseconds for exponential back-off.
+     * Defaults to 1000 ms.
+     */
+    retryDelayMs?: number;
+    /**
+     * Provider name for inbound webhooks (e.g. `'stripe'`, `'github'`).
+     * When set, this config is used by the tools router when it receives
+     * `POST /tools/webhook/:provider` with a matching `:provider` param.
+     * Outgoing-only configs should leave this unset.
+     */
+    provider?: string;
+    /**
+     * Action IDs permitted for this webhook's `vm` sandbox.
+     * Only actions that are **also** in `AuthSettings.enabledWebhookActions`
+     * will actually be injected (intersection rule).
+     *
+     * Managed via the Admin UI's Webhooks → edit drawer.
+     */
+    allowedActions?: string[];
+    /**
+     * JavaScript that runs inside the `vm` sandbox when this inbound webhook
+     * fires.  The sandbox exposes:
+     *   - `body`    — the raw request payload (`unknown`)
+     *   - `actions` — filtered action functions keyed by ID
+     *
+     * The script must assign `result` to instruct the router what event to
+     * emit, or leave `result` as `null` to silently ack.
+     *
+     * @example
+     * ```js
+     * // jsScript
+     * if (body.type === 'customer.subscription.deleted') {
+     *   await actions['billing.cancelSubscription'](body.data.object.id);
+     *   result = { event: 'identity.tenant.user.removed', data: body.data };
+     * }
+     * ```
+     */
+    jsScript?: string;
+}
+/**
+ * The JSON body sent to a webhook endpoint.
+ */
+export interface OutgoingWebhookEvent {
+    /** The standardised event name. */
+    event: string;
+    /** Semantic version of the event schema. */
+    version: string;
+    /** ISO 8601 timestamp. */
+    timestamp: string;
+    /** Arbitrary event data. */
+    data: unknown;
+    /** Optional metadata (tenantId, userId, correlationId, …). */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Store that holds webhook configurations.
+ *
+ * Implement this interface to persist webhook subscriptions in any database.
+ * When not provided, outgoing webhooks are disabled.
+ *
+ * @example
+ * ```typescript
+ * import { IWebhookStore, WebhookConfig } from '@awesome-lang-auth/node';
+ *
+ * export class MyWebhookStore implements IWebhookStore {
+ *   async findByEvent(event: string, tenantId?: string): Promise<WebhookConfig[]> {
+ *     return db('webhooks')
+ *       .where('isActive', true)
+ *       .where((q) => q.where('tenantId', tenantId ?? null).orWhereNull('tenantId'))
+ *       .where((q) => q.whereJsonContains('events', event).orWhereJsonContains('events', '*'));
+ *   }
+ * }
+ * ```
+ */
+export interface IWebhookStore {
+    /**
+     * Return all active webhook configurations that should receive `event`.
+     * Multi-tenant: when `tenantId` is provided, return both tenant-scoped
+     * and global (no `tenantId`) webhooks.
+     */
+    findByEvent(event: string, tenantId?: string): Promise<WebhookConfig[]>;
+    /**
+     * Return all webhook configurations (paginated).
+     * Optional — only needed for admin management screens.
+     */
+    listAll?(limit: number, offset: number): Promise<WebhookConfig[]>;
+    /**
+     * Persist a new webhook configuration and return it with an assigned `id`.
+     * Optional — only needed when webhooks can be managed through the admin UI.
+     */
+    add?(config: Omit<WebhookConfig, 'id'>): Promise<WebhookConfig>;
+    /**
+     * Permanently delete a webhook configuration.
+     * Optional — only needed for admin management screens.
+     */
+    remove?(id: string): Promise<void>;
+    /**
+     * Apply a partial update to an existing webhook configuration.
+     * Optional — only needed for admin management screens (e.g. toggling `isActive`).
+     */
+    update?(id: string, changes: Partial<Omit<WebhookConfig, 'id'>>): Promise<void>;
+    /**
+     * Find the inbound webhook configuration for the given provider name.
+     * Used by the tools router to look up the `jsScript` and `allowedActions`
+     * associated with `POST /tools/webhook/:provider`.
+     * Optional — only needed when dynamic script execution is required.
+     */
+    findByProvider?(provider: string): Promise<WebhookConfig | null>;
+}
+//# sourceMappingURL=webhook-store.interface.d.ts.map

package/dist/interfaces/webhook-store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-store.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/webhook-store.interface.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAItB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAExE;;;OAGG;IACH,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAElE;;;OAGG;IACH,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEhE;;;OAGG;IACH,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC;;;OAGG;IACH,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhF;;;;;OAKG;IACH,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;CAClE"}

package/dist/interfaces/webhook-store.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=webhook-store.interface.js.map

package/dist/interfaces/webhook-store.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-store.interface.js","sourceRoot":"","sources":["../../src/interfaces/webhook-store.interface.ts"],"names":[],"mappings":""}

package/dist/middleware/api-key.middleware.d.ts

@@ -0,0 +1,35 @@
+import { RequestHandler } from 'express';
+import { ApiKeyStrategyOptions } from '../strategies/api-key/api-key.strategy';
+import { IApiKeyStore } from '../interfaces/api-key-store.interface';
+import { ApiKeyContext } from '../models/api-key.model';
+declare global {
+    namespace Express {
+        interface Request {
+            /** Populated by `createApiKeyMiddleware` after successful API key authentication. */
+            apiKey?: ApiKeyContext;
+        }
+    }
+}
+/**
+ * Create an Express middleware that authenticates incoming requests using an
+ * API Key / Service Token.
+ *
+ * The middleware accepts the key via:
+ *  - `Authorization: ApiKey <key>` header
+ *  - `X-Api-Key: <key>` header
+ *
+ * On success, the validated `ApiKeyContext` is attached to `req.apiKey` and
+ * `next()` is called.  On failure a `401` or `403` JSON error is returned.
+ *
+ * @param store    Implementation of `IApiKeyStore` for persistence.
+ * @param options  Optional validation rules (scopes, IP allowlist, audit log).
+ *
+ * @example
+ * ```ts
+ * import { createApiKeyMiddleware } from '@awesome-lang-auth/node';
+ *
+ * app.use('/tools', createApiKeyMiddleware(myApiKeyStore, { requiredScopes: ['tools:read'] }));
+ * ```
+ */
+export declare function createApiKeyMiddleware(store: IApiKeyStore, options?: ApiKeyStrategyOptions): RequestHandler;
+//# sourceMappingURL=api-key.middleware.d.ts.map

package/dist/middleware/api-key.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/api-key.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAkB,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGxD,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,qFAAqF;YACrF,MAAM,CAAC,EAAE,aAAa,CAAC;SACxB;KACF;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAgBhB"}

package/dist/middleware/api-key.middleware.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiKeyMiddleware = createApiKeyMiddleware;
+const api_key_strategy_1 = require("../strategies/api-key/api-key.strategy");
+const errors_1 = require("../models/errors");
+/**
+ * Create an Express middleware that authenticates incoming requests using an
+ * API Key / Service Token.
+ *
+ * The middleware accepts the key via:
+ *  - `Authorization: ApiKey <key>` header
+ *  - `X-Api-Key: <key>` header
+ *
+ * On success, the validated `ApiKeyContext` is attached to `req.apiKey` and
+ * `next()` is called.  On failure a `401` or `403` JSON error is returned.
+ *
+ * @param store    Implementation of `IApiKeyStore` for persistence.
+ * @param options  Optional validation rules (scopes, IP allowlist, audit log).
+ *
+ * @example
+ * ```ts
+ * import { createApiKeyMiddleware } from '@awesome-lang-auth/node';
+ *
+ * app.use('/tools', createApiKeyMiddleware(myApiKeyStore, { requiredScopes: ['tools:read'] }));
+ * ```
+ */
+function createApiKeyMiddleware(store, options = {}) {
+    const strategy = new api_key_strategy_1.ApiKeyStrategy(store, options);
+    return async (req, res, next) => {
+        try {
+            const context = await strategy.authenticate(req.headers, req.ip);
+            req.apiKey = context;
+            next();
+        }
+        catch (err) {
+            if (err instanceof errors_1.AuthError) {
+                res.status(err.statusCode).json({ error: err.message, code: err.code });
+            }
+            else {
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        }
+    };
+}
+//# sourceMappingURL=api-key.middleware.js.map

package/dist/middleware/api-key.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.middleware.js","sourceRoot":"","sources":["../../src/middleware/api-key.middleware.ts"],"names":[],"mappings":";;AAoCA,wDAmBC;AAtDD,6EAA+F;AAG/F,6CAA6C;AAW7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,sBAAsB,CACpC,KAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,iCAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAwD,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAClH,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC;YACrB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/auth.middleware.d.ts

@@ -0,0 +1,13 @@
+import { RequestHandler } from 'express';
+import { AuthConfig } from '../models/auth-config.model';
+import { AccessTokenPayload } from '../models/token.model';
+import { ISessionStore } from '../interfaces/session-store.interface';
+declare global {
+    namespace Express {
+        interface Request {
+            user?: AccessTokenPayload;
+        }
+    }
+}
+export declare function createAuthMiddleware(config: AuthConfig, sessionStore?: ISessionStore): RequestHandler;
+//# sourceMappingURL=auth.middleware.d.ts.map

package/dist/middleware/auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEtE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,kBAAkB,CAAC;SAC3B;KACF;CACF;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,aAAa,GAAG,cAAc,CAiDrG"}

package/dist/middleware/auth.middleware.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthMiddleware = createAuthMiddleware;
+const token_service_1 = require("../services/token.service");
+const tokenService = new token_service_1.TokenService();
+function createAuthMiddleware(config, sessionStore) {
+    return async (req, res, next) => {
+        // Prefer Authorization: Bearer header (bearer strategy), fall back to cookie
+        const authHeader = req.headers['authorization'];
+        let token = null;
+        let usingBearer = false;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            token = authHeader.substring(7);
+            usingBearer = true;
+        }
+        else {
+            token = tokenService.extractTokenFromCookie(req, 'accessToken');
+        }
+        if (!token) {
+            res.status(403).json({ error: 'No access token provided' });
+            return;
+        }
+        // CSRF double-submit check only applies to cookie-based auth and state-changing methods
+        const safeMethods = ['GET', 'HEAD', 'OPTIONS'];
+        if (!usingBearer && config.csrf?.enabled && !safeMethods.includes(req.method)) {
+            const csrfCookie = tokenService.extractTokenFromCookie(req, 'csrf-token');
+            const csrfHeader = req.headers['x-csrf-token'];
+            if (!csrfCookie || !csrfHeader || csrfCookie !== csrfHeader) {
+                res.status(403).json({ error: 'CSRF token validation failed', code: 'CSRF_INVALID' });
+                return;
+            }
+        }
+        try {
+            const payload = tokenService.verifyAccessToken(token, config);
+            // Optional Real-time Session Validation
+            if (sessionStore && payload.sid && config.session?.checkOn === 'allcalls') {
+                const session = await sessionStore.getSession(payload.sid);
+                if (!session) {
+                    res.status(401).json({ error: 'Session has been revoked', code: 'SESSION_REVOKED' });
+                    return;
+                }
+            }
+            // Update activity timestamp if session management is active (even in 'refresh' or 'none' mode for visibility)
+            if (sessionStore && payload.sid) {
+                await sessionStore.updateSessionLastActive(payload.sid).catch(() => { });
+            }
+            req.user = payload;
+            next();
+        }
+        catch {
+            res.status(403).json({ error: 'Invalid or expired access token' });
+        }
+    };
+}
+//# sourceMappingURL=auth.middleware.js.map

package/dist/middleware/auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/middleware/auth.middleware.ts"],"names":[],"mappings":";;AAgBA,oDAiDC;AA9DD,6DAAyD;AAWzD,MAAM,YAAY,GAAG,IAAI,4BAAY,EAAE,CAAC;AAExC,SAAgB,oBAAoB,CAAC,MAAkB,EAAE,YAA4B;IACnF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,6EAA6E;QAC7E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;YACrE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAE9D,wCAAwC;YACxC,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC1E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;oBACrF,OAAO;gBACT,CAAC;YACH,CAAC;YAED,8GAA8G;YAC9G,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,YAAY,CAAC,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;YAED,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;YACnB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/jwks-auth.middleware.d.ts

@@ -0,0 +1,18 @@
+import { RequestHandler } from 'express';
+import { AuthConfig } from '../models/auth-config.model';
+/**
+ * Auth middleware for Resource Server mode.
+ *
+ * Validates incoming Bearer tokens against the remote JWKS endpoint configured
+ * in `config.resourceServer`. Cookie-based auth (using `accessTokenSecret` /
+ * HS256) is also supported as a fallback for SSR pages on the dashboard itself.
+ *
+ * Usage:
+ * ```ts
+ * app.use(createJwksAuthMiddleware(config));
+ * ```
+ */
+export declare function createJwksAuthMiddleware(config: AuthConfig): RequestHandler;
+/** Exported for testing: clear the module-level JWKS client cache. */
+export declare function _clearJwksClientCache(): void;
+//# sourceMappingURL=jwks-auth.middleware.d.ts.map

package/dist/middleware/jwks-auth.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-auth.middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/jwks-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAuBzD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CA2C3E;AAED,sEAAsE;AACtE,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C"}

package/dist/middleware/jwks-auth.middleware.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createJwksAuthMiddleware = createJwksAuthMiddleware;
+exports._clearJwksClientCache = _clearJwksClientCache;
+const token_service_1 = require("../services/token.service");
+const jwks_service_1 = require("../services/jwks.service");
+const tokenService = new token_service_1.TokenService();
+// Module-level cache: one JwksClient per JWKS URL so the key cache is shared
+// across requests even when `createJwksAuthMiddleware` is called multiple times.
+const clientCache = new Map();
+function getOrCreateClient(config) {
+    const rs = config.resourceServer;
+    const existing = clientCache.get(rs.jwksUrl);
+    if (existing)
+        return existing;
+    const client = jwks_service_1.JwksService.createRemoteClient(rs.jwksUrl, {
+        cacheTtl: rs.jwksCacheTtl,
+        fetchTimeout: rs.jwksFetchTimeout,
+    });
+    clientCache.set(rs.jwksUrl, client);
+    return client;
+}
+/**
+ * Auth middleware for Resource Server mode.
+ *
+ * Validates incoming Bearer tokens against the remote JWKS endpoint configured
+ * in `config.resourceServer`. Cookie-based auth (using `accessTokenSecret` /
+ * HS256) is also supported as a fallback for SSR pages on the dashboard itself.
+ *
+ * Usage:
+ * ```ts
+ * app.use(createJwksAuthMiddleware(config));
+ * ```
+ */
+function createJwksAuthMiddleware(config) {
+    if (!config.resourceServer?.enabled) {
+        throw new Error('createJwksAuthMiddleware requires config.resourceServer.enabled = true');
+    }
+    const jwksClient = getOrCreateClient(config);
+    return async (req, res, next) => {
+        const authHeader = req.headers['authorization'];
+        let token = null;
+        let usingBearer = false;
+        if (authHeader && authHeader.startsWith('Bearer ')) {
+            token = authHeader.substring(7);
+            usingBearer = true;
+        }
+        else {
+            token = tokenService.extractTokenFromCookie(req, 'accessToken');
+        }
+        if (!token) {
+            res.status(403).json({ error: 'No access token provided' });
+            return;
+        }
+        try {
+            if (usingBearer) {
+                // Bearer tokens are validated against the remote JWKS (RS256)
+                const payload = await tokenService.verifyWithJwks(token, jwksClient, config.resourceServer.issuer);
+                req.user = payload;
+            }
+            else {
+                // Cookie-based tokens use the local HS256 secret (SSR / dashboard session)
+                const payload = tokenService.verifyAccessToken(token, config);
+                req.user = payload;
+            }
+            next();
+        }
+        catch {
+            res.status(401).json({ error: 'Invalid or expired access token', code: 'INVALID_TOKEN' });
+        }
+    };
+}
+/** Exported for testing: clear the module-level JWKS client cache. */
+function _clearJwksClientCache() {
+    clientCache.clear();
+}
+//# sourceMappingURL=jwks-auth.middleware.js.map

package/dist/middleware/jwks-auth.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-auth.middleware.js","sourceRoot":"","sources":["../../src/middleware/jwks-auth.middleware.ts"],"names":[],"mappings":";;AAoCA,4DA2CC;AAGD,sDAEC;AAlFD,6DAAyD;AACzD,2DAAmE;AAEnE,MAAM,YAAY,GAAG,IAAI,4BAAY,EAAE,CAAC;AAExC,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;AAElD,SAAS,iBAAiB,CAAC,MAAkB;IAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,cAAe,CAAC;IAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,MAAM,GAAG,0BAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QACxD,QAAQ,EAAE,EAAE,CAAC,YAAY;QACzB,YAAY,EAAE,EAAE,CAAC,gBAAgB;KAClC,CAAC,CAAC;IACH,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,wBAAwB,CAAC,MAAkB;IACzD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE7C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,WAAW,GAAG,KAAK,CAAC;QAExB,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAChC,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,YAAY,CAAC,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,WAAW,EAAE,CAAC;gBAChB,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,cAAc,CAC/C,KAAK,EACL,UAAU,EACV,MAAM,CAAC,cAAe,CAAC,MAAM,CAC9B,CAAC;gBACF,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,2EAA2E;gBAC3E,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;YACrB,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAgB,qBAAqB;IACnC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/dist/models/api-key.model.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Domain model for an API Key / Service Token.
+ *
+ * The raw key value is **never** stored — only the bcrypt hash is persisted.
+ * The plaintext key is returned exactly once at creation time.
+ */
+export interface ApiKey {
+    /** Unique identifier for the key record (UUID or similar). */
+    id: string;
+    /**
+     * Human-readable label to identify the key (e.g. `'webhook-stripe'`).
+     * Shown in audit logs and the admin UI.
+     */
+    name: string;
+    /**
+     * Bcrypt hash of the raw key.  Never expose this to the caller.
+     */
+    keyHash: string;
+    /**
+     * Key prefix — the first 8 characters of the raw key, stored in plaintext
+     * so that keys can be identified in the UI without revealing the full secret.
+     * Format: `ak_<8 chars>…`
+     */
+    keyPrefix: string;
+    /**
+     * Optional service/machine identity this key is attached to.
+     * Can be a user ID, a tenant ID, a service name — whatever makes sense for
+     * the consuming application.
+     */
+    serviceId?: string | null;
+    /**
+     * Scope strings that restrict what this key can access.
+     * Interpreted by the consuming application; the library passes them through
+     * via `req.apiKey.scopes`.
+     *
+     * @example `['tools:read', 'tools:write', 'webhooks:receive']`
+     */
+    scopes?: string[];
+    /**
+     * Optional CIDR ranges or individual IPs that are allowed to use this key.
+     * When `null` or empty, no IP restriction is applied.
+     *
+     * @example `['10.0.0.0/8', '203.0.113.42']`
+     */
+    allowedIps?: string[] | null;
+    /** Whether the key is active. Set to `false` to revoke immediately. */
+    isActive: boolean;
+    /** Optional expiry date after which the key is no longer valid. */
+    expiresAt?: Date | null;
+    /** When this key record was created. */
+    createdAt: Date;
+    /** Timestamp of the most recent successful use of this key. */
+    lastUsedAt?: Date | null;
+}
+/**
+ * Context attached to `req.apiKey` after a successful API key authentication.
+ */
+export interface ApiKeyContext {
+    /** The API key record (without the hash). */
+    keyId: string;
+    keyPrefix: string;
+    name: string;
+    serviceId?: string | null;
+    scopes: string[];
+}
+//# sourceMappingURL=api-key.model.d.ts.map

package/dist/models/api-key.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.model.d.ts","sourceRoot":"","sources":["../../src/models/api-key.model.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,MAAM;IACrB,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IAEX;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAE7B,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAElB,mEAAmE;IACnE,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAExB,wCAAwC;IACxC,SAAS,EAAE,IAAI,CAAC;IAEhB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB"}

package/dist/models/api-key.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=api-key.model.js.map

package/dist/models/api-key.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.model.js","sourceRoot":"","sources":["../../src/models/api-key.model.ts"],"names":[],"mappings":""}