@burdenoff/be-sdk 2026.512.99 → 2026.512.100

package/dist/{chunk-SAK2JCA7.js.map → chunk-WBWM7UY7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-SAK2JCA7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}
+{"version":3,"sources":["../src/auth/index.ts"],"names":["ACCESS_TOKEN_COOKIE","REFRESH_TOKEN_COOKIE","ACCESS_TOKEN_MAX_AGE","REFRESH_TOKEN_MAX_AGE","REFRESH_TOKEN_REMEMBER_MAX_AGE","buildCookieString","name","value","maxAge","buildClearCookieString","AuthCookieHelper","setAuthCookies","context","tokens","options","headers","responseHeaders","rememberMe","refreshMaxAge","append","accessToken","refreshToken","clearAuthCookies","AuthModule","client","verifyToken","token","logger","debug","isTokenExpired","valid","error","query","response","Error","message","decodeToken","payload","parseJWT","mutation","info","AuthenticationError","validatePermission","userId","permission","resourceId","allowed","isTokenValid","getUserIdFromToken","user_id","getWorkspaceIdFromToken","workspace_id","getTokenClaims","willExpireSoon","withinSeconds","exp","now","Math","floor","Date"],"mappings":";;;;;;AAgBA,IAAMA,mBAAAA,GAAsB,iBAAA;AAC5B,IAAMC,oBAAAA,GAAuB,kBAAA;AAC7B,IAAMC,uBAAuB,EAAA,GAAK,EAAA;AAClC,IAAMC,qBAAAA,GAAwB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAC7C,IAAMC,8BAAAA,GAAiC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA;AAEtD,SAASC,iBAAAA,CAAkBC,IAAAA,EAAcC,KAAAA,EAAeC,MAAAA,EAAc;AACpE,EAAA,OAAO,CAAA,EAAGF,IAAAA,CAAAA,CAAAA,EAAQC,KAAAA,aAAkBC,MAAAA,CAAAA,mCAAAA,CAAAA;AACtC;AAFSH,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAIT,SAASI,uBAAuBH,IAAAA,EAAY;AAC1C,EAAA,OAAO,GAAGA,IAAAA,CAAAA,+CAAAA,CAAAA;AACZ;AAFSG,MAAAA,CAAAA,sBAAAA,EAAAA,wBAAAA,CAAAA;AAIF,IAAMC,gBAAAA,GAAmB;EAC9BC,cAAAA,CACEC,OAAAA,EACAC,QACAC,OAAAA,EAAkC;AAElC,IAAA,MAAMC,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEd,IAAA,MAAME,UAAAA,GAAaH,SAASG,UAAAA,IAAc,KAAA;AAC1C,IAAA,MAAMC,aAAAA,GAAgBD,aAAab,8BAAAA,GAAiCD,qBAAAA;AAEpEY,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBL,qBAAqBa,MAAAA,CAAOO,WAAAA,EAAalB,oBAAAA,CAAAA,CAAAA;AACxFa,IAAAA,OAAAA,CAAQI,OAAO,YAAA,EAAcd,iBAAAA,CAAkBJ,sBAAsBY,MAAAA,CAAOQ,YAAAA,EAAcH,aAAAA,CAAAA,CAAAA;AAC5F,EAAA,CAAA;AAEAI,EAAAA,gBAAAA,CAAiBV,OAAAA,EAAsB;AACrC,IAAA,MAAMG,UAAUH,OAAAA,CAAQI,eAAAA;AACxB,IAAA,IAAI,CAACD,OAAAA,EAAS;AAEdA,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBT,mBAAAA,CAAAA,CAAAA;AACpDe,IAAAA,OAAAA,CAAQI,MAAAA,CAAO,YAAA,EAAcV,sBAAAA,CAAuBR,oBAAAA,CAAAA,CAAAA;AACtD,EAAA;AACF;AA+BO,IAAMsB,aAAN,MAAMA;EApFb;;;;;AAqFE,EAAA,WAAA,CACUC,QACAZ,OAAAA,EACR;SAFQY,MAAAA,GAAAA,MAAAA;SACAZ,OAAAA,GAAAA,OAAAA;AACP,EAAA;;;;AAKH,EAAA,MAAaa,YAAYC,KAAAA,EAA2C;AAClEC,IAAAA,MAAAA,CAAOC,MAAM,wBAAA,CAAA;AAGb,IAAA,IAAIC,cAAAA,CAAeH,KAAAA,CAAAA,EAAQ;AACzB,MAAA,OAAO;QACLI,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAO;AACT,OAAA;AACF,IAAA;AAEA,IAAA,MAAMC,KAAAA,GAAQ;;;;;;;;;AAUd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAA0CA,KAAAA,EAAO;AAAEN,QAAAA;AAAM,OAAA,EAAG,KAAKd,OAAO,CAAA;AAE3Ge,MAAAA,MAAAA,CAAOC,MAAM,kCAAA,EAAoC;AAAEE,QAAAA,KAAAA,EAAOG,SAASR,WAAAA,CAAYK;OAAM,CAAA;AAErF,MAAA,OAAOG,QAAAA,CAASR,WAAAA;AAClB,IAAA,CAAA,CAAA,OAASM,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,kCAAA,EAAoC;AAAEA,QAAAA;OAAM,CAAA;AACzD,MAAA,OAAO;QACLD,KAAAA,EAAO,KAAA;QACPC,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;AAClD,OAAA;AACF,IAAA;AACF,EAAA;;;;AAKOC,EAAAA,WAAAA,CAAYV,KAAAA,EAAoC;AACrD,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,IAAI,CAACW,OAAAA,EAAS;AACZ,MAAA,OAAO,IAAA;AACT,IAAA;AACA,IAAA,OAAOA,OAAAA;AACT,EAAA;;;;AAKA,EAAA,MAAahB,aAAaA,YAAAA,EAAmD;AAC3EM,IAAAA,MAAAA,CAAOC,MAAM,yBAAA,CAAA;AAEb,IAAA,MAAMW,QAAAA,GAAW;;;;;;;;;AAUjB,IAAA,IAAI;AACF,MAAA,MAAMN,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MACjCO,QAAAA,EACA;AAAElB,QAAAA;AAAa,OAAA,EACf,KAAKT,OAAO,CAAA;AAGde,MAAAA,MAAAA,CAAOa,KAAK,qCAAA,CAAA;AAEZ,MAAA,OAAOP,QAAAA,CAASZ,YAAAA;AAClB,IAAA,CAAA,CAAA,OAASU,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,6BAAA,EAA+B;AAAEA,QAAAA;OAAM,CAAA;AACpD,MAAA,MAAM,IAAIU,oBAAoB,yBAAA,EAA2B;QACvDV,KAAAA,EAAOA,KAAAA,YAAiBG,KAAAA,GAAQH,KAAAA,CAAMI,OAAAA,GAAU;OAClD,CAAA;AACF,IAAA;AACF,EAAA;;;;EAKA,MAAaO,kBAAAA,CAAmBC,MAAAA,EAAgBC,UAAAA,EAAoBC,UAAAA,EAAuC;AACzGlB,IAAAA,MAAAA,CAAOC,MAAM,8BAAA,EAAgC;AAAEe,MAAAA,MAAAA;AAAQC,MAAAA,UAAAA;AAAYC,MAAAA;KAAW,CAAA;AAE9E,IAAA,MAAMb,KAAAA,GAAQ;;;;;;;AAQd,IAAA,IAAI;AACF,MAAA,MAAMC,QAAAA,GAAW,MAAM,IAAA,CAAKT,MAAAA,CAAOQ,MAEhCA,KAAAA,EAAO;AAAEW,QAAAA,MAAAA;AAAQC,QAAAA,UAAAA;AAAYC,QAAAA;AAAW,OAAA,EAAG,KAAKjC,OAAO,CAAA;AAE1De,MAAAA,MAAAA,CAAOC,MAAM,qCAAA,EAAuC;AAClDkB,QAAAA,OAAAA,EAASb,SAASS,kBAAAA,CAAmBI;OACvC,CAAA;AAEA,MAAA,OAAOb,SAASS,kBAAAA,CAAmBI,OAAAA;AACrC,IAAA,CAAA,CAAA,OAASf,KAAAA,EAAO;AACdJ,MAAAA,MAAAA,CAAOI,MAAM,qCAAA,EAAuC;AAAEA,QAAAA;OAAM,CAAA;AAC5D,MAAA,OAAO,KAAA;AACT,IAAA;AACF,EAAA;;;;AAKOgB,EAAAA,YAAAA,CAAarB,KAAAA,EAAwB;AAC1C,IAAA,OAAO,CAACG,eAAeH,KAAAA,CAAAA;AACzB,EAAA;;;;AAKOsB,EAAAA,kBAAAA,CAAmBtB,KAAAA,EAA8B;AACtD,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASY,OAAAA,IAAW,IAAA;AAC7B,EAAA;;;;AAKOC,EAAAA,uBAAAA,CAAwBxB,KAAAA,EAA8B;AAC3D,IAAA,MAAMW,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,OAAOW,SAASc,YAAAA,IAAgB,IAAA;AAClC,EAAA;;;;AAKOC,EAAAA,cAAAA,CAAe1B,KAAAA,EAA+C;AACnE,IAAA,MAAMW,OAAAA,GAAUC,SAASZ,KAAAA,CAAAA;AACzB,IAAA,OAAOW,OAAAA;AACT,EAAA;;;;EAKOgB,cAAAA,CAAe3B,KAAAA,EAAe4B,gBAAwB,GAAA,EAAc;AACzE,IAAA,MAAMjB,OAAAA,GAAU,IAAA,CAAKD,WAAAA,CAAYV,KAAAA,CAAAA;AACjC,IAAA,IAAI,CAACW,OAAAA,IAAW,OAAOA,OAAAA,CAAQkB,QAAQ,QAAA,EAAU;AAC/C,MAAA,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,MAAMC,MAAMC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKH,GAAAA,KAAQ,GAAA,CAAA;AACpC,IAAA,OAAOnB,OAAAA,CAAQkB,MAAMC,GAAAA,GAAMF,aAAAA;AAC7B,EAAA;AACF","file":"chunk-WBWM7UY7.js","sourcesContent":["/**\n * Authentication Module\n * JWT verification, token management, and user authentication\n */\n\nimport type { BurdenoffGraphQLClient } from '../client/graphql.js';\nimport type { SDKContext } from '../types/index.js';\nimport { AuthenticationError } from '../types/index.js';\nimport { logger } from '../logger/index.js';\nimport { parseJWT, isTokenExpired } from '../utils/index.js';\n\ninterface CookieContext {\n  responseHeaders?: Headers;\n  [key: string]: unknown;\n}\n\nconst ACCESS_TOKEN_COOKIE = 'bf_access_token';\nconst REFRESH_TOKEN_COOKIE = 'bf_refresh_token';\nconst ACCESS_TOKEN_MAX_AGE = 15 * 60; // 15 minutes\nconst REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60; // 30 days\nconst REFRESH_TOKEN_REMEMBER_MAX_AGE = 30 * 24 * 60 * 60; // 30 days (same, controlled by backend)\n\nfunction buildCookieString(name: string, value: string, maxAge: number): string {\n  return `${name}=${value}; Max-Age=${maxAge}; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nfunction buildClearCookieString(name: string): string {\n  return `${name}=; Max-Age=0; Path=/; HttpOnly; SameSite=Strict`;\n}\n\nexport const AuthCookieHelper = {\n  setAuthCookies(\n    context: CookieContext,\n    tokens: { accessToken: string; refreshToken: string },\n    options?: { rememberMe?: boolean }\n  ): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    const rememberMe = options?.rememberMe ?? false;\n    const refreshMaxAge = rememberMe ? REFRESH_TOKEN_REMEMBER_MAX_AGE : REFRESH_TOKEN_MAX_AGE;\n\n    headers.append('Set-Cookie', buildCookieString(ACCESS_TOKEN_COOKIE, tokens.accessToken, ACCESS_TOKEN_MAX_AGE));\n    headers.append('Set-Cookie', buildCookieString(REFRESH_TOKEN_COOKIE, tokens.refreshToken, refreshMaxAge));\n  },\n\n  clearAuthCookies(context: CookieContext): void {\n    const headers = context.responseHeaders;\n    if (!headers) return;\n\n    headers.append('Set-Cookie', buildClearCookieString(ACCESS_TOKEN_COOKIE));\n    headers.append('Set-Cookie', buildClearCookieString(REFRESH_TOKEN_COOKIE));\n  },\n};\n\nexport interface TokenPayload {\n  jti: string;\n  sub: string;\n  user_id: string;\n  workspace_id?: string;\n  org_id?: string;\n  tenant_endpoint?: string;\n  iat: number;\n  exp: number;\n  scope?: string;\n}\n\nexport interface VerifyTokenResult {\n  valid: boolean;\n  payload?: TokenPayload;\n  error?: string;\n}\n\nexport interface RefreshTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport * from './cookie-helper.js';\n\n/**\n * Authentication Module\n */\nexport class AuthModule {\n  constructor(\n    private client: BurdenoffGraphQLClient,\n    private context: SDKContext\n  ) {}\n\n  /**\n   * Verify JWT token\n   */\n  public async verifyToken(token: string): Promise<VerifyTokenResult> {\n    logger.debug('[Auth] Verifying token');\n\n    // First check if token is expired locally\n    if (isTokenExpired(token)) {\n      return {\n        valid: false,\n        error: 'Token expired',\n      };\n    }\n\n    const query = `\n      query VerifyToken($token: String!) {\n        verifyToken(token: $token) {\n          valid\n          payload\n          error\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ verifyToken: VerifyTokenResult }>(query, { token }, this.context);\n\n      logger.debug('[Auth] Token verification result', { valid: response.verifyToken.valid });\n\n      return response.verifyToken;\n    } catch (error) {\n      logger.error('[Auth] Token verification failed', { error });\n      return {\n        valid: false,\n        error: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Decode token without verification\n   */\n  public decodeToken(token: string): TokenPayload | null {\n    const payload = parseJWT(token);\n    if (!payload) {\n      return null;\n    }\n    return payload as unknown as TokenPayload;\n  }\n\n  /**\n   * Refresh access token using refresh token\n   */\n  public async refreshToken(refreshToken: string): Promise<RefreshTokenResult> {\n    logger.debug('[Auth] Refreshing token');\n\n    const mutation = `\n      mutation RefreshToken($refreshToken: String!) {\n        refreshToken(refreshToken: $refreshToken) {\n          accessToken\n          refreshToken\n          expiresIn\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{ refreshToken: RefreshTokenResult }>(\n        mutation,\n        { refreshToken },\n        this.context\n      );\n\n      logger.info('[Auth] Token refreshed successfully');\n\n      return response.refreshToken;\n    } catch (error) {\n      logger.error('[Auth] Token refresh failed', { error });\n      throw new AuthenticationError('Failed to refresh token', {\n        error: error instanceof Error ? error.message : 'Unknown error',\n      });\n    }\n  }\n\n  /**\n   * Validate user has specific permission\n   */\n  public async validatePermission(userId: string, permission: string, resourceId?: string): Promise<boolean> {\n    logger.debug('[Auth] Validating permission', { userId, permission, resourceId });\n\n    const query = `\n      query ValidatePermission($userId: ID!, $permission: String!, $resourceId: ID) {\n        validatePermission(userId: $userId, permission: $permission, resourceId: $resourceId) {\n          allowed\n        }\n      }\n    `;\n\n    try {\n      const response = await this.client.query<{\n        validatePermission: { allowed: boolean };\n      }>(query, { userId, permission, resourceId }, this.context);\n\n      logger.debug('[Auth] Permission validation result', {\n        allowed: response.validatePermission.allowed,\n      });\n\n      return response.validatePermission.allowed;\n    } catch (error) {\n      logger.error('[Auth] Permission validation failed', { error });\n      return false;\n    }\n  }\n\n  /**\n   * Check if token is valid and not expired\n   */\n  public isTokenValid(token: string): boolean {\n    return !isTokenExpired(token);\n  }\n\n  /**\n   * Get user ID from token\n   */\n  public getUserIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.user_id || null;\n  }\n\n  /**\n   * Get workspace ID from token\n   */\n  public getWorkspaceIdFromToken(token: string): string | null {\n    const payload = this.decodeToken(token);\n    return payload?.workspace_id || null;\n  }\n\n  /**\n   * Extract all claims from token\n   */\n  public getTokenClaims(token: string): Record<string, unknown> | null {\n    const payload = parseJWT(token);\n    return payload;\n  }\n\n  /**\n   * Check if token will expire soon (within given seconds)\n   */\n  public willExpireSoon(token: string, withinSeconds: number = 300): boolean {\n    const payload = this.decodeToken(token);\n    if (!payload || typeof payload.exp !== 'number') {\n      return true;\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n    return payload.exp - now < withinSeconds;\n  }\n}\n"]}

package/dist/{chunk-F5XEAGHQ.js → chunk-ZUCYUSLC.js}

@@ -1,6 +1,6 @@
 import { shouldSyncRelationship, shouldSyncEntity, parseRelationship, getCollectionForEntity, extractMinimalFields, extractEntityTitle, createRelationshipEvent, createEntityEvent, addGraphExtension, GraphRegistry } from './chunk-TKBD2ONF.js';
-import { getGraphEventEmitter, NatsGraphEventEmitter } from './chunk-ELLX3K54.js';
-import { ValidationError } from './chunk-SAG6ZYWQ.js';
+import { getGraphEventEmitter, NatsGraphEventEmitter } from './chunk-MLFKAPWK.js';
+import { ValidationError } from './chunk-RTQIRGVB.js';
 import { logger } from './chunk-CBZNP6RF.js';
 import { __export, __name } from './chunk-XE4OXN2W.js';
 
@@ -1871,5 +1871,5 @@ var GraphModule = class {
 };
 
 export { AUDIT_FIELDS, GraphEventsPublisher, GraphExportService, GraphModule, SOFT_DELETE_FIELDS, STANDARD_FIELDS, TENANT_FIELDS, createGraphEventsHelper, createGraphExportService, createPrismaGraphIntegration, createRelationshipFromEntity, defineEntity, defineGraphConfig, defineModuleGraph, defineRelationship, getGraphEventsPublisher, getGraphStats, graph_exports, initializeGraph, isGraphInitialized };
-//# sourceMappingURL=chunk-F5XEAGHQ.js.map
-//# sourceMappingURL=chunk-F5XEAGHQ.js.map
+//# sourceMappingURL=chunk-ZUCYUSLC.js.map
+//# sourceMappingURL=chunk-ZUCYUSLC.js.map