@babelpeak/babel-suite-server-sdk 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,137 @@
+import { type JWTPayload } from 'jose';
+export interface PermissionDefinition {
+    key: string;
+    description?: string;
+    /** Ruoli di sistema che ricevono il permesso di default; admin lo riceve sempre. */
+    defaultRoles?: ('admin' | 'user')[];
+}
+export interface SuiteClientOptions {
+    /** URL dell'issuer di Suite (es. https://suite.babelpeak.com). */
+    issuer: string;
+    /** Chiave del servizio: è l'`aud` atteso nei JWT. */
+    service: string;
+    /** Service key per le route /internal/* (llm-config, permessi, introspect). */
+    serviceKey?: string;
+    /** Base URL delle route interne, se Suite le serve su un listener separato. Default: issuer. */
+    internalUrl?: string;
+    /** Credenziali del client OIDC del servizio, per il token exchange fra servizi. */
+    clientId?: string;
+    clientSecret?: string;
+    /** TTL della cache della config LLM, in secondi (l'invalidazione arriva via webhook). */
+    llmConfigTtl?: number;
+    clockTolerance?: number;
+    fetch?: typeof fetch;
+}
+export interface SuiteAuth {
+    userId: string;
+    orgId: string;
+    permissions: string[];
+    token: string;
+    claims: JWTPayload;
+}
+export interface LlmConfig {
+    org_id: string;
+    service: string;
+    provider_keys: {
+        provider: string;
+        base_url: string | null;
+        api_key: string;
+        rotated_at: string;
+    }[];
+    enabled_models: {
+        provider: string;
+        model_id: string;
+    }[];
+    task_mapping: {
+        task_type: string;
+        model_id: string;
+        fallback_model_id: string | null;
+    }[];
+}
+export interface OrgMember {
+    user_id: string;
+    email: string;
+    name: string | null;
+    role: string;
+    permissions: string[];
+}
+export declare class SuiteError extends Error {
+    readonly status?: number | undefined;
+    readonly body?: unknown | undefined;
+    constructor(message: string, status?: number | undefined, body?: unknown | undefined);
+}
+export declare class TokenError extends Error {
+}
+interface Discovery {
+    issuer: string;
+    jwks_uri: string;
+    token_endpoint: string;
+}
+/**
+ * Client di Suite indipendente dal framework: validazione JWT con JWKS in cache,
+ * config LLM con cache e invalidazione, registrazione permessi e webhook, token exchange.
+ */
+export declare class SuiteClient {
+    private readonly opts;
+    readonly issuer: string;
+    readonly service: string;
+    private readonly internalUrl;
+    private readonly doFetch;
+    private discovery?;
+    private jwks?;
+    private readonly cache;
+    private readonly inflight;
+    private webhookSecret?;
+    constructor(opts: SuiteClientOptions);
+    /** Discovery da /.well-known, una volta sola (ritentata se fallisce). */
+    getDiscovery(): Promise<Discovery>;
+    private getJwks;
+    /** Valida firma, issuer, `aud` = servizio e `typ` at+jwt. Nessuna chiamata a Suite per richiesta. */
+    verifyToken(token: string): Promise<SuiteAuth>;
+    private internalHeaders;
+    private internal;
+    /** Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. */
+    registerPermissions(permissions: PermissionDefinition[]): Promise<{
+        registered: number;
+    }>;
+    /** Registra l'URL di invalidazione; il segreto HMAC resta in memoria. */
+    registerWebhook(url: string): Promise<{
+        secret: string;
+    }>;
+    /** Verifica firma e freschezza di una notifica di Suite. Ritorna l'org da invalidare. */
+    verifyWebhook(headers: Record<string, string | string[] | undefined>, rawBody: string): {
+        event: string;
+        org_id: string;
+        service: string;
+        reason: string;
+    };
+    /** Config LLM dell'organizzazione, con cache e deduplica delle richieste concorrenti. */
+    llmConfig(orgId: string): Promise<LlmConfig>;
+    /** Invalida la cache (di un'org o tutta). */
+    invalidate(orgId?: string): void;
+    /** Modello per un tipo di task, con fallback. */
+    modelFor(orgId: string, taskType: string): Promise<{
+        modelId: string;
+        fallbackModelId: string | null;
+    } | undefined>;
+    introspect(token: string): Promise<{
+        active: boolean;
+        sub?: string;
+        org_id?: string;
+        permissions?: string[];
+    }>;
+    members(orgId: string): Promise<OrgMember[]>;
+    /**
+     * Token exchange (RFC 8693) per chiamare un altro servizio per conto dell'utente:
+     * un JWT con aud di questo servizio diventa un JWT con aud del servizio di destinazione.
+     */
+    exchangeToken(input: {
+        subjectToken: string;
+        audience: string;
+        orgId?: string;
+    }): Promise<{
+        accessToken: string;
+        expiresIn: number;
+    }>;
+}
+export {};

package/dist/client.js

@@ -0,0 +1,213 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { createRemoteJWKSet, customFetch, jwtVerify } from 'jose';
+export class SuiteError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.status = status;
+        this.body = body;
+    }
+}
+export class TokenError extends Error {
+}
+const WEBHOOK_TOLERANCE_SEC = 300;
+/**
+ * Client di Suite indipendente dal framework: validazione JWT con JWKS in cache,
+ * config LLM con cache e invalidazione, registrazione permessi e webhook, token exchange.
+ */
+export class SuiteClient {
+    opts;
+    issuer;
+    service;
+    internalUrl;
+    doFetch;
+    discovery;
+    jwks;
+    cache = new Map();
+    inflight = new Map();
+    webhookSecret;
+    constructor(opts) {
+        this.opts = opts;
+        this.issuer = opts.issuer.replace(/\/$/, '');
+        this.service = opts.service;
+        this.internalUrl = (opts.internalUrl ?? this.issuer).replace(/\/$/, '');
+        this.doFetch = opts.fetch ?? fetch;
+    }
+    /** Discovery da /.well-known, una volta sola (ritentata se fallisce). */
+    getDiscovery() {
+        this.discovery ??= (async () => {
+            const res = await this.doFetch(`${this.issuer}/.well-known/openid-configuration`);
+            if (!res.ok)
+                throw new SuiteError('discovery fallita', res.status);
+            return (await res.json());
+        })().catch((err) => {
+            this.discovery = undefined;
+            throw err;
+        });
+        return this.discovery;
+    }
+    async getJwks() {
+        if (!this.jwks) {
+            const d = await this.getDiscovery();
+            // jose gestisce cache e rotazione: su un kid sconosciuto riscarica il JWKS.
+            this.jwks = createRemoteJWKSet(new URL(d.jwks_uri), {
+                cooldownDuration: 30_000,
+                cacheMaxAge: 10 * 60_000,
+                ...(this.opts.fetch ? { [customFetch]: this.opts.fetch } : {}),
+            });
+        }
+        return this.jwks;
+    }
+    /** Valida firma, issuer, `aud` = servizio e `typ` at+jwt. Nessuna chiamata a Suite per richiesta. */
+    async verifyToken(token) {
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, await this.getJwks(), {
+                issuer: this.issuer,
+                audience: this.service,
+                typ: 'at+jwt',
+                clockTolerance: this.opts.clockTolerance ?? 5,
+            }));
+        }
+        catch (err) {
+            throw new TokenError(`token non valido: ${err.message}`);
+        }
+        if (!payload.sub || typeof payload.org_id !== 'string') {
+            throw new TokenError('token senza subject o organizzazione');
+        }
+        const permissions = Array.isArray(payload.permissions)
+            ? payload.permissions.filter((p) => typeof p === 'string')
+            : [];
+        return { userId: payload.sub, orgId: payload.org_id, permissions, token, claims: payload };
+    }
+    internalHeaders() {
+        if (!this.opts.serviceKey)
+            throw new SuiteError('serviceKey non configurata');
+        return {
+            'x-suite-service': this.service,
+            'x-suite-service-key': this.opts.serviceKey,
+        };
+    }
+    async internal(method, path, body) {
+        const headers = this.internalHeaders();
+        if (body !== undefined)
+            headers['content-type'] = 'application/json';
+        const res = await this.doFetch(`${this.internalUrl}/internal${path}`, {
+            method,
+            headers,
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        const parsed = text ? JSON.parse(text) : undefined;
+        if (!res.ok)
+            throw new SuiteError(`Suite ${method} ${path}: HTTP ${res.status}`, res.status, parsed);
+        return parsed;
+    }
+    /** Upsert idempotente dei permessi del servizio: si chiama a ogni avvio. */
+    registerPermissions(permissions) {
+        return this.internal('POST', '/permissions/register', {
+            service: this.service,
+            permissions,
+        });
+    }
+    /** Registra l'URL di invalidazione; il segreto HMAC resta in memoria. */
+    async registerWebhook(url) {
+        const res = await this.internal('POST', '/llm-config/webhook', { url });
+        this.webhookSecret = res.secret;
+        return res;
+    }
+    /** Verifica firma e freschezza di una notifica di Suite. Ritorna l'org da invalidare. */
+    verifyWebhook(headers, rawBody) {
+        if (!this.webhookSecret)
+            throw new TokenError('webhook non registrato');
+        const ts = String(headers['x-suite-timestamp'] ?? '');
+        const sig = String(headers['x-suite-signature'] ?? '').replace(/^sha256=/, '');
+        const age = Math.abs(Date.now() / 1000 - Number(ts));
+        if (!ts || !Number.isFinite(age) || age > WEBHOOK_TOLERANCE_SEC) {
+            throw new TokenError('timestamp del webhook non valido');
+        }
+        const expected = createHmac('sha256', this.webhookSecret).update(`${ts}.${rawBody}`).digest();
+        const given = Buffer.from(sig, 'hex');
+        if (given.length !== expected.length || !timingSafeEqual(given, expected)) {
+            throw new TokenError('firma del webhook non valida');
+        }
+        return JSON.parse(rawBody);
+    }
+    /** Config LLM dell'organizzazione, con cache e deduplica delle richieste concorrenti. */
+    async llmConfig(orgId) {
+        const hit = this.cache.get(orgId);
+        if (hit && hit.expires > Date.now())
+            return hit.value;
+        const pending = this.inflight.get(orgId);
+        if (pending)
+            return pending;
+        const p = this.internal('GET', `/llm-config?org_id=${encodeURIComponent(orgId)}`)
+            .then((value) => {
+            this.cache.set(orgId, {
+                value,
+                expires: Date.now() + (this.opts.llmConfigTtl ?? 300) * 1000,
+            });
+            return value;
+        })
+            .finally(() => this.inflight.delete(orgId));
+        this.inflight.set(orgId, p);
+        return p;
+    }
+    /** Invalida la cache (di un'org o tutta). */
+    invalidate(orgId) {
+        if (orgId)
+            this.cache.delete(orgId);
+        else
+            this.cache.clear();
+    }
+    /** Modello per un tipo di task, con fallback. */
+    async modelFor(orgId, taskType) {
+        const cfg = await this.llmConfig(orgId);
+        const m = cfg.task_mapping.find((t) => t.task_type === taskType);
+        if (!m)
+            return undefined;
+        return { modelId: m.model_id, fallbackModelId: m.fallback_model_id };
+    }
+    introspect(token) {
+        return this.internal('POST', '/introspect', { token });
+    }
+    members(orgId) {
+        return this.internal('GET', `/orgs/${encodeURIComponent(orgId)}/members`);
+    }
+    /**
+     * Token exchange (RFC 8693) per chiamare un altro servizio per conto dell'utente:
+     * un JWT con aud di questo servizio diventa un JWT con aud del servizio di destinazione.
+     */
+    async exchangeToken(input) {
+        if (!this.opts.clientId || !this.opts.clientSecret) {
+            throw new SuiteError('clientId/clientSecret necessari per il token exchange');
+        }
+        const d = await this.getDiscovery();
+        const body = new URLSearchParams({
+            grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            subject_token: input.subjectToken,
+            subject_token_type: input.subjectToken.split('.').length === 3
+                ? 'urn:ietf:params:oauth:token-type:jwt'
+                : 'urn:ietf:params:oauth:token-type:access_token',
+            audience: input.audience,
+        });
+        if (input.orgId)
+            body.set('org_id', input.orgId);
+        const basic = Buffer.from(`${encodeURIComponent(this.opts.clientId)}:${encodeURIComponent(this.opts.clientSecret)}`).toString('base64');
+        const res = await this.doFetch(d.token_endpoint, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                authorization: `Basic ${basic}`,
+            },
+            body,
+        });
+        const json = (await res.json());
+        if (!res.ok || !json.access_token) {
+            throw new SuiteError(`token exchange fallito: ${json.error ?? res.status}`, res.status, json);
+        }
+        return { accessToken: json.access_token, expiresIn: json.expires_in ?? 0 };
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAwDnF,MAAM,OAAO,UAAW,SAAQ,KAAK;IAGjB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,IAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAU;IAGhC,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;CAAG;AAExC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAQlC;;;GAGG;AACH,MAAM,OAAO,WAAW;IAWO;IAVpB,MAAM,CAAS;IACf,OAAO,CAAS;IACR,WAAW,CAAS;IACpB,OAAO,CAAe;IAC/B,SAAS,CAAsB;IAC/B,IAAI,CAAyC;IACpC,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC1D,aAAa,CAAU;IAE/B,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,mCAAmC,CAAC,CAAC;YAClF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAc,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,4EAA4E;YAC5E,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;gBAClD,gBAAgB,EAAE,MAAM;gBACxB,WAAW,EAAE,EAAE,GAAG,MAAM;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE;gBAC1D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,GAAG,EAAE,QAAQ;gBACb,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC;aAC9C,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,UAAU,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7F,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;QAC9E,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,OAAO;YAC/B,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;SAC5C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAI,MAAc,EAAE,IAAY,EAAE,IAAc;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,YAAY,IAAI,EAAE,EAAE;YACpE,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,UAAU,CAAC,SAAS,MAAM,IAAI,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1F,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,4EAA4E;IAC5E,mBAAmB,CAAC,WAAmC;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAyB,MAAM,EAAE,uBAAuB,EAAE;YAC5E,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAqB,MAAM,EAAE,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACzF,aAAa,CAAC,OAAsD,EAAE,OAAe;QACnF,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACxE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,qBAAqB,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAKxB,CAAC;IACJ,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAY,KAAK,EAAE,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;aACzF,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;gBACpB,KAAK;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,GAAG,IAAI;aAC7D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6CAA6C;IAC7C,UAAU,CAAC,KAAc;QACvB,IAAI,KAAK;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,QAAgB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;IACvE,CAAC;IAED,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAKjB,MAAM,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAc,KAAK,EAAE,SAAS,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAAiE;QACnF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,iDAAiD;YAC7D,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,kBAAkB,EAChB,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBACxC,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,+CAA+C;YACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAC1F,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;aAChC;YACD,IAAI;SACL,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { suiteAuth, type SuiteAuthOptions } from './plugin.js';
+export { SuiteClient, SuiteError, TokenError, type LlmConfig, type OrgMember, type PermissionDefinition, type SuiteAuth, type SuiteClientOptions, } from './client.js';

package/dist/index.js

@@ -0,0 +1,3 @@
+export { suiteAuth } from './plugin.js';
+export { SuiteClient, SuiteError, TokenError, } from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,WAAW,EACX,UAAU,EACV,UAAU,GAMX,MAAM,aAAa,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,32 @@
+import type { FastifyPluginAsync, preHandlerAsyncHookHandler } from 'fastify';
+import { SuiteClient, type PermissionDefinition, type SuiteAuth, type SuiteClientOptions } from './client.js';
+export interface SuiteAuthOptions extends SuiteClientOptions {
+    /** Permessi del servizio, registrati all'avvio con upsert idempotente. */
+    permissions?: PermissionDefinition[];
+    /**
+     * URL pubblico (raggiungibile da Suite) dell'endpoint di invalidazione. Se valorizzato,
+     * all'avvio il plugin lo registra presso Suite (la route su `webhookPath` è sempre montata).
+     */
+    webhookUrl?: string;
+    /**
+     * Path locale dell'endpoint di invalidazione, montato sempre dal plugin
+     * (risponde 401 finché il webhook non è registrato). Default: /internal/config-changed.
+     * `false` per non montarlo.
+     */
+    webhookPath?: string | false;
+    /** Se false, un errore di registrazione (permessi/webhook) viene solo loggato. Default: true. */
+    failOnRegisterError?: boolean;
+}
+declare module 'fastify' {
+    interface FastifyInstance {
+        suite: SuiteClient;
+        /** preHandler: valida il bearer JWT e popola `req.auth`. */
+        authenticate: preHandlerAsyncHookHandler;
+        /** preHandler: autentica e richiede il permesso indicato (nel token scoped del servizio). */
+        requirePermission: (...permissions: string[]) => preHandlerAsyncHookHandler;
+    }
+    interface FastifyRequest {
+        auth: SuiteAuth;
+    }
+}
+export declare const suiteAuth: FastifyPluginAsync<SuiteAuthOptions>;

package/dist/plugin.js

@@ -0,0 +1,80 @@
+import fp from 'fastify-plugin';
+import { SuiteClient, TokenError, } from './client.js';
+function unauthorized(reply, message) {
+    return reply
+        .code(401)
+        .header('www-authenticate', 'Bearer error="invalid_token"')
+        .send({ error: 'unauthorized', message });
+}
+const plugin = async (app, opts) => {
+    const client = new SuiteClient(opts);
+    app.decorate('suite', client);
+    app.decorateRequest('auth', null);
+    async function authenticate(req, reply) {
+        const header = req.headers.authorization;
+        if (!header?.startsWith('Bearer '))
+            return unauthorized(reply, 'bearer token mancante');
+        try {
+            req.auth = await client.verifyToken(header.slice(7));
+        }
+        catch (err) {
+            if (err instanceof TokenError)
+                return unauthorized(reply, err.message);
+            throw err;
+        }
+    }
+    app.decorate('authenticate', authenticate);
+    app.decorate('requirePermission', (...required) => {
+        return async function (req, reply) {
+            if (!req.auth) {
+                await authenticate(req, reply);
+                if (reply.sent)
+                    return;
+            }
+            const missing = required.filter((p) => !req.auth.permissions.includes(p));
+            if (missing.length) {
+                return reply
+                    .code(403)
+                    .send({ error: 'forbidden', message: `permesso richiesto: ${missing.join(', ')}` });
+            }
+        };
+    });
+    if (opts.webhookPath !== false) {
+        const path = opts.webhookPath ?? '/internal/config-changed';
+        await app.register(async (child) => {
+            // La firma HMAC è calcolata sul body grezzo.
+            child.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => done(null, body));
+            child.post(path, async (req, reply) => {
+                try {
+                    const event = client.verifyWebhook(req.headers, String(req.body ?? ''));
+                    client.invalidate(event.org_id);
+                    return reply.code(204).send();
+                }
+                catch (err) {
+                    if (err instanceof TokenError || err instanceof SyntaxError) {
+                        return reply.code(401).send({ error: 'unauthorized', message: err.message });
+                    }
+                    throw err;
+                }
+            });
+        });
+    }
+    // Registrazione all'avvio: permessi e webhook. Senza service key non c'è nulla da registrare.
+    app.addHook('onReady', async () => {
+        if (!opts.serviceKey)
+            return;
+        try {
+            if (opts.permissions?.length)
+                await client.registerPermissions(opts.permissions);
+            if (opts.webhookUrl)
+                await client.registerWebhook(opts.webhookUrl);
+        }
+        catch (err) {
+            if (opts.failOnRegisterError ?? true)
+                throw err;
+            app.log.warn({ err }, 'registrazione presso Suite fallita');
+        }
+    });
+};
+export const suiteAuth = fp(plugin, { name: '@babelpeak/babel-suite-server-sdk', fastify: '5.x' });
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,UAAU,GAIX,MAAM,aAAa,CAAC;AAiCrB,SAAS,YAAY,CAAC,KAAmB,EAAE,OAAe;IACxD,OAAO,KAAK;SACT,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;SAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,MAAM,GAAyC,KAAK,EAAE,GAAoB,EAAE,IAAI,EAAE,EAAE;IACxF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9B,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,IAA4B,CAAC,CAAC;IAE1D,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAmB;QAClE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,YAAY,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,YAA0C,CAAC,CAAC;IACzE,GAAG,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,QAAkB,EAAE,EAAE;QAC1D,OAAO,KAAK,WAAW,GAAmB,EAAE,KAAmB;YAC7D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/B,IAAI,KAAK,CAAC,IAAI;oBAAE,OAAO;YACzB,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,KAAK;qBACT,IAAI,CAAC,GAAG,CAAC;qBACT,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAA+B,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,0BAA0B,CAAC;QAC5D,MAAM,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,6CAA6C;YAC7C,KAAK,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACzF,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CACjB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBACpC,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;oBACxE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,GAAG,YAAY,UAAU,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;wBAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC1F,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8FAA8F;IAC9F,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAC7B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM;gBAAE,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,UAAU;gBAAE,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI;gBAAE,MAAM,GAAG,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@babelpeak/babel-suite-server-sdk",
+  "version": "0.1.0",
+  "description": "SDK Node per integrare un servizio con Babel Suite: auth JWT, permessi, config LLM",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Babel-Peak/babel-suite.git",
+    "directory": "packages/suite-server"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "@babel-suite/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "fastify": "^5.0.0"
+  },
+  "dependencies": {
+    "fastify-plugin": "^6.0.0",
+    "jose": "^6.2.12"
+  },
+  "devDependencies": {
+    "fastify": "^5.12.5"
+  }
+}