@bernierllc/auth-suite 1.0.0

package/dist/managers/audit-manager.js

@@ -0,0 +1,160 @@
+"use strict";
+/*
+Copyright (c) 2025 Bernier LLC
+
+This file is licensed to the client under a limited-use license.
+The client may use and modify this code *only within the scope of the project it was delivered for*.
+Redistribution or use in other products or commercial offerings is not permitted without written consent from Bernier LLC.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileAuditManager = void 0;
+const uuid_1 = require("uuid");
+/**
+ * File-based audit manager
+ * For production use, consider database storage or external logging service
+ */
+class FileAuditManager {
+    logs = [];
+    config;
+    maxLogs;
+    constructor(config) {
+        this.config = config;
+        this.maxLogs = this.parseMaxSize(config.retention?.maxSize || '100MB');
+    }
+    async log(event) {
+        const auditLog = {
+            id: (0, uuid_1.v4)(),
+            timestamp: new Date(),
+            ...event
+        };
+        this.logs.push(auditLog);
+        // Trim logs if we exceed the maximum
+        if (this.logs.length > this.maxLogs) {
+            this.logs = this.logs.slice(-this.maxLogs);
+        }
+        // In a real implementation, this would write to a file or database
+        // eslint-disable-next-line no-console
+        console.log(`[AUDIT] ${auditLog.timestamp.toISOString()} [${auditLog.level.toUpperCase()}] ${auditLog.event}`, auditLog.details);
+    }
+    async query(filters) {
+        let filteredLogs = [...this.logs];
+        // Apply filters
+        if (filters.userId) {
+            filteredLogs = filteredLogs.filter(log => log.userId === filters.userId);
+        }
+        if (filters.sessionId) {
+            filteredLogs = filteredLogs.filter(log => log.sessionId === filters.sessionId);
+        }
+        if (filters.event) {
+            filteredLogs = filteredLogs.filter(log => log.event === filters.event);
+        }
+        if (filters.level) {
+            filteredLogs = filteredLogs.filter(log => log.level === filters.level);
+        }
+        if (filters.startDate) {
+            filteredLogs = filteredLogs.filter(log => log.timestamp >= filters.startDate);
+        }
+        if (filters.endDate) {
+            filteredLogs = filteredLogs.filter(log => log.timestamp <= filters.endDate);
+        }
+        // Sort by timestamp (newest first)
+        filteredLogs.sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+        // Apply pagination
+        const offset = filters.offset || 0;
+        const limit = filters.limit || 100;
+        return filteredLogs.slice(offset, offset + limit);
+    }
+    async cleanup(olderThanDays) {
+        const cutoffDate = new Date();
+        cutoffDate.setDate(cutoffDate.getDate() - olderThanDays);
+        const initialCount = this.logs.length;
+        this.logs = this.logs.filter(log => log.timestamp > cutoffDate);
+        return initialCount - this.logs.length;
+    }
+    // Additional utility methods
+    async getLogStats() {
+        const stats = {
+            total: this.logs.length,
+            byLevel: {},
+            byEvent: {},
+            oldestLog: undefined,
+            newestLog: undefined
+        };
+        if (this.logs.length === 0) {
+            return stats;
+        }
+        // Calculate statistics
+        for (const log of this.logs) {
+            // Count by level
+            stats.byLevel[log.level] = (stats.byLevel[log.level] || 0) + 1;
+            // Count by event
+            stats.byEvent[log.event] = (stats.byEvent[log.event] || 0) + 1;
+        }
+        // Find oldest and newest logs
+        const sortedByTime = [...this.logs].sort((a, b) => a.timestamp.getTime() - b.timestamp.getTime());
+        stats.oldestLog = sortedByTime[0]?.timestamp;
+        stats.newestLog = sortedByTime[sortedByTime.length - 1]?.timestamp;
+        return stats;
+    }
+    async exportLogs(format = 'json') {
+        if (format === 'csv') {
+            return this.exportToCsv();
+        }
+        return JSON.stringify(this.logs, null, 2);
+    }
+    async searchLogs(searchTerm) {
+        const lowerSearchTerm = searchTerm.toLowerCase();
+        return this.logs.filter(log => {
+            // Search in event name
+            if (log.event.toLowerCase().includes(lowerSearchTerm)) {
+                return true;
+            }
+            // Search in user ID
+            if (log.userId?.toLowerCase().includes(lowerSearchTerm)) {
+                return true;
+            }
+            // Search in details (JSON stringify for simple text search)
+            if (JSON.stringify(log.details).toLowerCase().includes(lowerSearchTerm)) {
+                return true;
+            }
+            return false;
+        });
+    }
+    // Private helper methods
+    parseMaxSize(maxSize) {
+        const size = parseInt(maxSize);
+        const unit = maxSize.toUpperCase().slice(-2);
+        switch (unit) {
+            case 'KB':
+                return size * 1024;
+            case 'MB':
+                return size * 1024 * 1024;
+            case 'GB':
+                return size * 1024 * 1024 * 1024;
+            default:
+                return size; // Assume bytes
+        }
+    }
+    exportToCsv() {
+        if (this.logs.length === 0) {
+            return 'id,timestamp,userId,sessionId,event,level,details,ipAddress,userAgent\n';
+        }
+        const headers = 'id,timestamp,userId,sessionId,event,level,details,ipAddress,userAgent\n';
+        const rows = this.logs.map(log => {
+            return [
+                log.id,
+                log.timestamp.toISOString(),
+                log.userId || '',
+                log.sessionId || '',
+                log.event,
+                log.level,
+                JSON.stringify(log.details).replace(/"/g, '""'), // Escape quotes for CSV
+                log.ipAddress || '',
+                log.userAgent || ''
+            ].join(',');
+        }).join('\n');
+        return headers + rows;
+    }
+}
+exports.FileAuditManager = FileAuditManager;
+//# sourceMappingURL=audit-manager.js.map

package/dist/managers/audit-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-manager.js","sourceRoot":"","sources":["../../src/managers/audit-manager.ts"],"names":[],"mappings":";AAAA;;;;;;EAME;;;AAEF,+BAAoC;AAGpC;;;GAGG;AACH,MAAa,gBAAgB;IACnB,IAAI,GAAe,EAAE,CAAC;IACtB,MAAM,CAAM;IACZ,OAAO,CAAS;IAExB,YAAY,MAAW;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAyC;QACjD,MAAM,QAAQ,GAAa;YACzB,EAAE,EAAE,IAAA,SAAM,GAAE;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,GAAG,KAAK;SACT,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEzB,qCAAqC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,mEAAmE;QACnE,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnI,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA0B;QACpC,IAAI,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,gBAAgB;QAChB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,SAAU,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,OAAQ,CAAC,CAAC;QAC/E,CAAC;QAED,mCAAmC;QACnC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAE3E,mBAAmB;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;QAEnC,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QAEzD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QAEhE,OAAO,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACzC,CAAC;IAED,6BAA6B;IAE7B,KAAK,CAAC,WAAW;QAOf,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACvB,OAAO,EAAE,EAA4B;YACrC,OAAO,EAAE,EAA4B;YACrC,SAAS,EAAE,SAA6B;YACxC,SAAS,EAAE,SAA6B;SACzC,CAAC;QAEF,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,uBAAuB;QACvB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,iBAAiB;YACjB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAE/D,iBAAiB;YACjB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;QAC7C,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC;QAEnE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAyB,MAAM;QAC9C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAEjD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YAC5B,uBAAuB;YACvB,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,oBAAoB;YACpB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,4DAA4D;YAC5D,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB;IAEjB,YAAY,CAAC,OAAe;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI;gBACP,OAAO,IAAI,GAAG,IAAI,CAAC;YACrB,KAAK,IAAI;gBACP,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;YAC5B,KAAK,IAAI;gBACP,OAAO,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;YACnC;gBACE,OAAO,IAAI,CAAC,CAAC,eAAe;QAChC,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,yEAAyE,CAAC;QACnF,CAAC;QAED,MAAM,OAAO,GAAG,yEAAyE,CAAC;QAE1F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YAC/B,OAAO;gBACL,GAAG,CAAC,EAAE;gBACN,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC3B,GAAG,CAAC,MAAM,IAAI,EAAE;gBAChB,GAAG,CAAC,SAAS,IAAI,EAAE;gBACnB,GAAG,CAAC,KAAK;gBACT,GAAG,CAAC,KAAK;gBACT,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,wBAAwB;gBACzE,GAAG,CAAC,SAAS,IAAI,EAAE;gBACnB,GAAG,CAAC,SAAS,IAAI,EAAE;aACpB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,OAAO,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AA3LD,4CA2LC"}

package/dist/managers/mfa-manager.d.ts

@@ -0,0 +1,32 @@
+import type { MfaManager, MfaChallenge } from '../types';
+/**
+ * TOTP-based MFA manager
+ * Supports Time-based One-Time Passwords (TOTP) like Google Authenticator
+ */
+export declare class TOTPMfaManager implements MfaManager {
+    private userSecrets;
+    private userBackupCodes;
+    private activeChallenges;
+    private config;
+    constructor(config: any);
+    setupMfa(userId: string, type: string, _config?: Record<string, any>): Promise<{
+        secret: string;
+        qrCode?: string;
+    }>;
+    verifySetup(userId: string, code: string): Promise<boolean>;
+    generateChallenge(userId: string): Promise<MfaChallenge>;
+    verifyChallenge(challengeId: string, response: string): Promise<boolean>;
+    getBackupCodes(userId: string): Promise<string[]>;
+    verifyBackupCode(userId: string, code: string): Promise<boolean>;
+    isMfaEnabled(userId: string): Promise<boolean>;
+    disableMfa(userId: string): Promise<boolean>;
+    regenerateBackupCodes(userId: string): Promise<string[]>;
+    private generateTotpSecret;
+    private generateBackupCodes;
+    private generateQrCodeUrl;
+    private verifyTotpCode;
+    private generateTotpCode;
+    private simpleHash;
+    cleanup(): void;
+}
+//# sourceMappingURL=mfa-manager.d.ts.map

package/dist/managers/mfa-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-manager.d.ts","sourceRoot":"","sources":["../../src/managers/mfa-manager.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEzD;;;GAGG;AACH,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,eAAe,CAAkC;IACzD,OAAO,CAAC,gBAAgB,CAAmC;IAC3D,OAAO,CAAC,MAAM,CAAM;gBAER,MAAM,EAAE,GAAG;IAIjB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBnH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS3D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBxD,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCxE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKjD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBhE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI9C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc5C,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAY9D,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,mBAAmB;IAkB3B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,UAAU;IAWlB,OAAO,IAAI,IAAI;CAShB"}

package/dist/managers/mfa-manager.js

@@ -0,0 +1,206 @@
+"use strict";
+/*
+Copyright (c) 2025 Bernier LLC
+
+This file is licensed to the client under a limited-use license.
+The client may use and modify this code *only within the scope of the project it was delivered for*.
+Redistribution or use in other products or commercial offerings is not permitted without written consent from Bernier LLC.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOTPMfaManager = void 0;
+const uuid_1 = require("uuid");
+/**
+ * TOTP-based MFA manager
+ * Supports Time-based One-Time Passwords (TOTP) like Google Authenticator
+ */
+class TOTPMfaManager {
+    userSecrets = new Map();
+    userBackupCodes = new Map();
+    activeChallenges = new Map();
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async setupMfa(userId, type, _config) {
+        if (type !== 'totp') {
+            throw new Error(`MFA type ${type} not supported`);
+        }
+        // Generate a base32 secret for TOTP
+        const secret = this.generateTotpSecret();
+        this.userSecrets.set(userId, secret);
+        // Generate backup codes
+        if (this.config.backup?.enabled) {
+            const backupCodes = this.generateBackupCodes();
+            this.userBackupCodes.set(userId, new Set(backupCodes));
+        }
+        // Generate QR code URL (for apps like Google Authenticator)
+        const qrCode = this.generateQrCodeUrl(userId, secret);
+        return { secret, qrCode };
+    }
+    async verifySetup(userId, code) {
+        const secret = this.userSecrets.get(userId);
+        if (!secret) {
+            return false;
+        }
+        return this.verifyTotpCode(secret, code);
+    }
+    async generateChallenge(userId) {
+        const challengeId = (0, uuid_1.v4)();
+        const now = new Date();
+        const expiresAt = new Date(now.getTime() + 5 * 60 * 1000); // 5 minutes
+        const challenge = {
+            challengeId,
+            userId,
+            type: 'totp',
+            createdAt: now,
+            expiresAt,
+            verified: false,
+            metadata: {
+                attempts: 0,
+                maxAttempts: 3
+            }
+        };
+        this.activeChallenges.set(challengeId, challenge);
+        return challenge;
+    }
+    async verifyChallenge(challengeId, response) {
+        const challenge = this.activeChallenges.get(challengeId);
+        if (!challenge || challenge.verified || challenge.expiresAt < new Date()) {
+            return false;
+        }
+        // Increment attempt count
+        if (challenge.metadata) {
+            challenge.metadata.attempts = (challenge.metadata.attempts || 0) + 1;
+            // Check if max attempts exceeded
+            if (challenge.metadata.attempts > challenge.metadata.maxAttempts) {
+                this.activeChallenges.delete(challengeId);
+                return false;
+            }
+        }
+        const secret = this.userSecrets.get(challenge.userId);
+        if (!secret) {
+            return false;
+        }
+        const isValid = this.verifyTotpCode(secret, response);
+        if (isValid) {
+            challenge.verified = true;
+            this.activeChallenges.delete(challengeId);
+            return true;
+        }
+        // Update challenge with failed attempt
+        this.activeChallenges.set(challengeId, challenge);
+        return false;
+    }
+    async getBackupCodes(userId) {
+        const codes = this.userBackupCodes.get(userId);
+        return codes ? Array.from(codes) : [];
+    }
+    async verifyBackupCode(userId, code) {
+        const codes = this.userBackupCodes.get(userId);
+        if (!codes || !codes.has(code)) {
+            return false;
+        }
+        // Remove used backup code
+        codes.delete(code);
+        if (codes.size === 0) {
+            this.userBackupCodes.delete(userId);
+        }
+        else {
+            this.userBackupCodes.set(userId, codes);
+        }
+        return true;
+    }
+    // Additional helper methods
+    async isMfaEnabled(userId) {
+        return this.userSecrets.has(userId);
+    }
+    async disableMfa(userId) {
+        const hadSecret = this.userSecrets.delete(userId);
+        this.userBackupCodes.delete(userId);
+        // Remove any active challenges for this user
+        for (const [challengeId, challenge] of this.activeChallenges.entries()) {
+            if (challenge.userId === userId) {
+                this.activeChallenges.delete(challengeId);
+            }
+        }
+        return hadSecret;
+    }
+    async regenerateBackupCodes(userId) {
+        if (!this.userSecrets.has(userId)) {
+            throw new Error('MFA not enabled for user');
+        }
+        const backupCodes = this.generateBackupCodes();
+        this.userBackupCodes.set(userId, new Set(backupCodes));
+        return backupCodes;
+    }
+    // Private helper methods
+    generateTotpSecret() {
+        // Generate a 32-character base32 secret
+        const base32Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+        let secret = '';
+        for (let i = 0; i < 32; i++) {
+            secret += base32Chars.charAt(Math.floor(Math.random() * base32Chars.length));
+        }
+        return secret;
+    }
+    generateBackupCodes() {
+        const codes = [];
+        const codeCount = this.config.backup?.codeCount || 10;
+        const codeLength = this.config.backup?.codeLength || 8;
+        for (let i = 0; i < codeCount; i++) {
+            // Generate a simple alphanumeric code
+            const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'; // Exclude ambiguous chars
+            let code = '';
+            for (let j = 0; j < codeLength; j++) {
+                code += chars.charAt(Math.floor(Math.random() * chars.length));
+            }
+            codes.push(code);
+        }
+        return codes;
+    }
+    generateQrCodeUrl(userId, secret) {
+        const issuer = encodeURIComponent('BernierLLC Auth Suite');
+        const accountName = encodeURIComponent(userId);
+        return `otpauth://totp/${issuer}:${accountName}?secret=${secret}&issuer=${issuer}`;
+    }
+    verifyTotpCode(secret, code) {
+        // This is a simplified TOTP verification
+        // In production, use a proper TOTP library like 'otplib'
+        const timeStep = Math.floor(Date.now() / 1000 / 30); // 30-second window
+        // Check current window and adjacent windows for clock drift tolerance
+        for (let i = -1; i <= 1; i++) {
+            const testCode = this.generateTotpCode(secret, timeStep + i);
+            if (testCode === code) {
+                return true;
+            }
+        }
+        return false;
+    }
+    generateTotpCode(secret, timeStep) {
+        // Simplified TOTP code generation
+        // In production, use proper HMAC-SHA1 implementation
+        // This is a mock implementation for demonstration
+        const hash = this.simpleHash(secret + timeStep.toString());
+        return (hash % 1000000).toString().padStart(6, '0');
+    }
+    simpleHash(str) {
+        let hash = 0;
+        for (let i = 0; i < str.length; i++) {
+            const char = str.charCodeAt(i);
+            hash = ((hash << 5) - hash) + char;
+            hash = hash & hash; // Convert to 32-bit integer
+        }
+        return Math.abs(hash);
+    }
+    // Cleanup method
+    cleanup() {
+        const now = new Date();
+        for (const [challengeId, challenge] of this.activeChallenges.entries()) {
+            if (challenge.expiresAt < now) {
+                this.activeChallenges.delete(challengeId);
+            }
+        }
+    }
+}
+exports.TOTPMfaManager = TOTPMfaManager;
+//# sourceMappingURL=mfa-manager.js.map

package/dist/managers/mfa-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-manager.js","sourceRoot":"","sources":["../../src/managers/mfa-manager.ts"],"names":[],"mappings":";AAAA;;;;;;EAME;;;AAEF,+BAAoC;AAGpC;;;GAGG;AACH,MAAa,cAAc;IACjB,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,gBAAgB,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,MAAM,CAAM;IAEpB,YAAY,MAAW;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAE,OAA6B;QACxE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,oCAAoC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAErC,wBAAwB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,4DAA4D;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,WAAW,GAAG,IAAA,SAAM,GAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY;QAEvE,MAAM,SAAS,GAAiB;YAC9B,WAAW;YACX,MAAM;YACN,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,GAAG;YACd,SAAS;YACT,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE;gBACR,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,CAAC;aACf;SACF,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,QAAgB;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0BAA0B;QAC1B,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,SAAS,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAErE,iCAAiC;YACjC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAEtD,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,IAAY;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0BAA0B;QAC1B,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEnB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4BAA4B;IAE5B,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEpC,6CAA6C;QAC7C,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACvD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,yBAAyB;IAEjB,kBAAkB;QACxB,wCAAwC;QACxC,MAAM,WAAW,GAAG,kCAAkC,CAAC;QACvD,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,mBAAmB;QACzB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC;QAEvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,sCAAsC;YACtC,MAAM,KAAK,GAAG,kCAAkC,CAAC,CAAC,0BAA0B;YAC5E,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CAAC,MAAc,EAAE,MAAc;QACtD,MAAM,MAAM,GAAG,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,kBAAkB,MAAM,IAAI,WAAW,WAAW,MAAM,WAAW,MAAM,EAAE,CAAC;IACrF,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,IAAY;QACjD,yCAAyC;QACzC,yDAAyD;QAEzD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,mBAAmB;QAExE,sEAAsE;QACtE,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QACvD,kCAAkC;QAClC,qDAAqD;QAErD,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAEO,UAAU,CAAC,GAAW;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACnC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,4BAA4B;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,iBAAiB;IACjB,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,IAAI,SAAS,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA7OD,wCA6OC"}

package/dist/managers/rbac-manager.d.ts

@@ -0,0 +1,25 @@
+import type { RBACManager, PermissionCheck, PermissionResult, RoleDefinition, PermissionDefinition } from '../types';
+/**
+ * Basic in-memory RBAC manager
+ * For production use, consider database storage
+ */
+export declare class BasicRBACManager implements RBACManager {
+    private userRoles;
+    private roles;
+    private permissions;
+    private hierarchical;
+    constructor(config: any);
+    checkPermission(check: PermissionCheck): Promise<PermissionResult>;
+    getUserRoles(userId: string): Promise<string[]>;
+    assignRole(userId: string, role: string): Promise<boolean>;
+    revokeRole(userId: string, role: string): Promise<boolean>;
+    getRolePermissions(roleName: string): Promise<string[]>;
+    createRole(role: RoleDefinition): Promise<boolean>;
+    deleteRole(roleName: string): Promise<boolean>;
+    updateRolePermissions(roleName: string, permissions: string[]): Promise<boolean>;
+    createPermission(permission: PermissionDefinition): Promise<boolean>;
+    private addInheritedRoles;
+    private checkConditions;
+    private evaluateCondition;
+}
+//# sourceMappingURL=rbac-manager.d.ts.map

package/dist/managers/rbac-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-manager.d.ts","sourceRoot":"","sources":["../../src/managers/rbac-manager.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACrB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,WAAW;IAClD,OAAO,CAAC,SAAS,CAAkC;IACnD,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,WAAW,CAAoC;IACvD,OAAO,CAAC,YAAY,CAAU;gBAElB,MAAM,EAAE,GAAG;IAMjB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6DlE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB/C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW1D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1D,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IASlD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB9C,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhF,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC;IAa1E,OAAO,CAAC,iBAAiB;YAUX,eAAe;IAY7B,OAAO,CAAC,iBAAiB;CAgB1B"}

package/dist/managers/rbac-manager.js

@@ -0,0 +1,192 @@
+"use strict";
+/*
+Copyright (c) 2025 Bernier LLC
+
+This file is licensed to the client under a limited-use license.
+The client may use and modify this code *only within the scope of the project it was delivered for*.
+Redistribution or use in other products or commercial offerings is not permitted without written consent from Bernier LLC.
+*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BasicRBACManager = void 0;
+/**
+ * Basic in-memory RBAC manager
+ * For production use, consider database storage
+ */
+class BasicRBACManager {
+    userRoles = new Map();
+    roles;
+    permissions;
+    hierarchical;
+    constructor(config) {
+        this.hierarchical = config.hierarchical || false;
+        this.roles = new Map(config.roles?.map((role) => [role.name, role]) || []);
+        this.permissions = new Map(config.permissions?.map((perm) => [perm.name, perm]) || []);
+    }
+    async checkPermission(check) {
+        const userRoles = await this.getUserRoles(check.userId);
+        if (userRoles.length === 0) {
+            return {
+                allowed: false,
+                reason: 'User has no roles assigned'
+            };
+        }
+        // Get all permissions for user's roles
+        const userPermissions = new Set();
+        for (const roleName of userRoles) {
+            const rolePermissions = await this.getRolePermissions(roleName);
+            rolePermissions.forEach(perm => userPermissions.add(perm));
+        }
+        // Check for exact permission match
+        const requiredPermission = `${check.resource}:${check.action}`;
+        if (userPermissions.has(requiredPermission)) {
+            return {
+                allowed: true,
+                reason: 'Direct permission match'
+            };
+        }
+        // Check for wildcard permissions
+        const wildcardPermission = `${check.resource}:*`;
+        if (userPermissions.has(wildcardPermission)) {
+            return {
+                allowed: true,
+                reason: 'Wildcard permission match'
+            };
+        }
+        // Check for global admin permission
+        if (userPermissions.has('*:*')) {
+            return {
+                allowed: true,
+                reason: 'Global admin permission'
+            };
+        }
+        // Check permission conditions if available
+        const permission = this.permissions.get(requiredPermission);
+        if (permission && permission.conditions) {
+            const conditionsMet = await this.checkConditions(permission.conditions, check.context || {});
+            if (conditionsMet) {
+                return {
+                    allowed: true,
+                    reason: 'Permission conditions satisfied'
+                };
+            }
+        }
+        return {
+            allowed: false,
+            reason: `No permission found for ${requiredPermission}`
+        };
+    }
+    async getUserRoles(userId) {
+        const roleSet = this.userRoles.get(userId) || new Set();
+        const roles = Array.from(roleSet);
+        // If hierarchical, include inherited roles
+        if (this.hierarchical) {
+            const inheritedRoles = new Set();
+            for (const roleName of roles) {
+                this.addInheritedRoles(roleName, inheritedRoles);
+            }
+            return Array.from(new Set([...roles, ...inheritedRoles]));
+        }
+        return roles;
+    }
+    async assignRole(userId, role) {
+        if (!this.roles.has(role)) {
+            return false;
+        }
+        const userRoleSet = this.userRoles.get(userId) || new Set();
+        userRoleSet.add(role);
+        this.userRoles.set(userId, userRoleSet);
+        return true;
+    }
+    async revokeRole(userId, role) {
+        const userRoleSet = this.userRoles.get(userId);
+        if (!userRoleSet) {
+            return false;
+        }
+        const removed = userRoleSet.delete(role);
+        if (userRoleSet.size === 0) {
+            this.userRoles.delete(userId);
+        }
+        return removed;
+    }
+    async getRolePermissions(roleName) {
+        const role = this.roles.get(roleName);
+        if (!role) {
+            return [];
+        }
+        return role.permissions || [];
+    }
+    // Additional methods for role/permission management
+    async createRole(role) {
+        if (this.roles.has(role.name)) {
+            return false;
+        }
+        this.roles.set(role.name, role);
+        return true;
+    }
+    async deleteRole(roleName) {
+        const deleted = this.roles.delete(roleName);
+        if (deleted) {
+            // Remove role from all users
+            for (const [userId, userRoles] of this.userRoles.entries()) {
+                userRoles.delete(roleName);
+                if (userRoles.size === 0) {
+                    this.userRoles.delete(userId);
+                }
+            }
+        }
+        return deleted;
+    }
+    async updateRolePermissions(roleName, permissions) {
+        const role = this.roles.get(roleName);
+        if (!role) {
+            return false;
+        }
+        role.permissions = permissions;
+        this.roles.set(roleName, role);
+        return true;
+    }
+    async createPermission(permission) {
+        const permissionKey = `${permission.resource}:${permission.actions.join(',')}`;
+        if (this.permissions.has(permissionKey)) {
+            return false;
+        }
+        this.permissions.set(permissionKey, permission);
+        return true;
+    }
+    // Private helper methods
+    addInheritedRoles(roleName, inheritedRoles) {
+        const role = this.roles.get(roleName);
+        if (!role || !role.parent) {
+            return;
+        }
+        inheritedRoles.add(role.parent);
+        this.addInheritedRoles(role.parent, inheritedRoles);
+    }
+    async checkConditions(conditions, context) {
+        for (const condition of conditions) {
+            const contextValue = context[condition.field];
+            if (!this.evaluateCondition(contextValue, condition.operator, condition.value)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    evaluateCondition(contextValue, operator, conditionValue) {
+        switch (operator) {
+            case 'equals':
+                return contextValue === conditionValue;
+            case 'contains':
+                return typeof contextValue === 'string' && contextValue.includes(conditionValue);
+            case 'startsWith':
+                return typeof contextValue === 'string' && contextValue.startsWith(conditionValue);
+            case 'endsWith':
+                return typeof contextValue === 'string' && contextValue.endsWith(conditionValue);
+            case 'regex':
+                return typeof contextValue === 'string' && new RegExp(conditionValue).test(contextValue);
+            default:
+                return false;
+        }
+    }
+}
+exports.BasicRBACManager = BasicRBACManager;
+//# sourceMappingURL=rbac-manager.js.map

package/dist/managers/rbac-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-manager.js","sourceRoot":"","sources":["../../src/managers/rbac-manager.ts"],"names":[],"mappings":";AAAA;;;;;;EAME;;;AAUF;;;GAGG;AACH,MAAa,gBAAgB;IACnB,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,CAA8B;IACnC,WAAW,CAAoC;IAC/C,YAAY,CAAU;IAE9B,YAAY,MAAW;QACrB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAoB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAA0B,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAsB;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B;aACrC,CAAC;QACJ,CAAC;QAED,uCAAuC;QACvC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAChE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,mCAAmC;QACnC,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/D,IAAI,eAAe,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,yBAAyB;aAClC,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,MAAM,kBAAkB,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC;QACjD,IAAI,eAAe,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,2BAA2B;aACpC,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,yBAAyB;aAClC,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC7F,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,iCAAiC;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,2BAA2B,kBAAkB,EAAE;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAElC,2CAA2C;QAC3C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;YAEzC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;QAC3C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QAC5D,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,oDAAoD;IAEpD,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,OAAO,EAAE,CAAC;YACZ,6BAA6B;YAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC3D,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC3B,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,WAAqB;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,UAAgC;QACrD,MAAM,aAAa,GAAG,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAE/E,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IAEjB,iBAAiB,CAAC,QAAgB,EAAE,cAA2B;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,UAAiB,EAAE,OAA4B;QAC3E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAE9C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,YAAiB,EAAE,QAAgB,EAAE,cAAmB;QAChF,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,QAAQ;gBACX,OAAO,YAAY,KAAK,cAAc,CAAC;YACzC,KAAK,UAAU;gBACb,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACnF,KAAK,YAAY;gBACf,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YACrF,KAAK,UAAU;gBACb,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACnF,KAAK,OAAO;gBACV,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,IAAI,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3F;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAtND,4CAsNC"}