@burdenoff/microfe-auth 2026.718.3 → 2026.725.1

package/dist/auth/types/index.d.ts

@@ -0,0 +1,678 @@
+import { MicrofrontendRootProps, NavItem, FooterItem } from '../../shared/types';
+
+export type { MicrofrontendRootProps, NavItem, FooterItem };
+/**
+ * Props for the AuthRoot component
+ */
+export interface AuthRootProps extends MicrofrontendRootProps {
+    /**
+     * Callback when authentication is successful
+     * @param user - The authenticated user
+     * @param accessToken - The access token (optional, for shell integration)
+     * @param refreshToken - The refresh token (optional, for shell integration)
+     */
+    onAuthSuccess?: (user: User, accessToken?: string, refreshToken?: string) => void;
+    /**
+     * Callback when user logs out
+     */
+    onLogout?: () => void;
+    /**
+     * Optional function to register navigation items with the shell
+     * Injected by the shell app
+     */
+    registerNavItems?: (items: NavItem | NavItem[]) => () => void;
+    /**
+     * Optional function to register footer items with the shell
+     * Injected by the shell app
+     */
+    registerFooterItems?: (items: FooterItem | FooterItem[]) => () => void;
+    /**
+     * Whether tenant/platform administration routes should be mounted by this
+     * auth surface. Product app shells should leave this disabled and route
+     * administrators to admin-app instead.
+     */
+    enableAdminRoutes?: boolean;
+    /**
+     * When true, the enterprise-plan gate on the SSO configuration page is
+     * bypassed so that the full SSO config UI is always rendered.
+     * Intended for admin-app surfaces where platform admins must be able to
+     * configure SSO regardless of the workspace's billing plan.
+     */
+    bypassEnterprisePlanGate?: boolean;
+    /**
+     * Path to redirect to after a successful login when no `returnTo` is set.
+     * Defaults to `/dashboard` to preserve existing host behavior (workspaces-app).
+     * Product shells whose home route is not `/dashboard` (e.g. vibecontrols-app's
+     * `/vibecontrols`) should pass this explicitly.
+     */
+    defaultPostLoginPath?: string;
+    /**
+     * OAuth provider client IDs, resolved by the HOST app shell from its own
+     * build-time env (`import.meta.env.VITE_*_CLIENT_ID`).
+     *
+     * This MUST be injected by the host: build-time MFE composition compiles
+     * this package into its own npm dist BEFORE the vars exist, and Vite bakes
+     * `import.meta.env` into a frozen object literal at that point — so a client
+     * ID read from `import.meta.env` inside this package is permanently
+     * `undefined` in published builds, and the social-login buttons render
+     * disabled. The host's build DOES inline these correctly, so it passes them
+     * down here. (When this package is consumed from source in local dev, the
+     * `import.meta.env` fallback in `useOAuthOperations` still works.)
+     */
+    oauthClientIds?: {
+        google?: string;
+        microsoft?: string;
+        github?: string;
+    };
+    /**
+     * Product slug of the host app shell (e.g. `"vibecontrols"`, `"workspaces"`).
+     *
+     * Used to look up the product's reCAPTCHA site key via the public
+     * `publicProduct(slug)` query so the signup page can render the reCAPTCHA v2
+     * checkbox ONLY for products that have keys configured in the platform
+     * product catalog. A product opts into signup captcha simply by having its
+     * `recaptchaSiteKey` (+ server-side `recaptchaSecretKey`) set — there is no
+     * separate flag. When omitted, the signup captcha stays disabled.
+     */
+    productSlug?: string;
+}
+/**
+ * User entity (matches backend schema)
+ */
+export interface User {
+    id: string;
+    email: string;
+    username: string;
+    firstName?: string;
+    lastName?: string;
+    name?: string;
+    avatar?: string;
+    phoneNumber?: string;
+    role: UserRole;
+    status: UserStatus;
+    emailVerified: boolean;
+    mfaEnabled: boolean;
+    defaultWorkspaceId?: string;
+    tenantId?: string;
+    lastLoginAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * User roles
+ */
+export type UserRole = "SUPER_ADMIN" | "TENANT_ADMIN" | "ORG_ADMIN" | "WORKSPACE_ADMIN" | "MEMBER" | "GUEST";
+/**
+ * User status
+ */
+export type UserStatus = "ACTIVE" | "INACTIVE" | "SUSPENDED" | "DELETED";
+/**
+ * User connection for pagination
+ */
+export interface UserConnection {
+    users: User[];
+    totalCount: number;
+    hasMore: boolean;
+}
+/**
+ * User filter input
+ */
+export interface UserFilterInput {
+    email?: string;
+    username?: string;
+    role?: UserRole;
+    status?: UserStatus;
+    tenantId?: string;
+    search?: string;
+}
+/**
+ * Pagination input
+ */
+export interface PaginationInput {
+    offset?: number;
+    limit?: number;
+    sortBy?: string;
+    sortOrder?: "ASC" | "DESC";
+}
+/**
+ * Auth types supported
+ */
+export type AuthType = "JWT" | "OAUTH" | "SAML" | "OIDC" | "API_KEY" | "MAGIC_LINK" | "MFA";
+/**
+ * Auth method
+ */
+export interface AuthMethod {
+    type: AuthType;
+    name: string;
+    enabled: boolean;
+    requiresMFA?: boolean;
+}
+/**
+ * Auth method config
+ */
+export interface AuthMethodConfig {
+    type: AuthType;
+    enabled: boolean;
+    config?: Record<string, unknown>;
+}
+/**
+ * Auth strategy health
+ */
+export interface AuthStrategyHealth {
+    name: string;
+    type: AuthType;
+    healthy: boolean;
+}
+/**
+ * Auth payload (from signIn/signUp)
+ * When MFA is required, user and tokens will be null
+ */
+export interface AuthPayload {
+    user: User | null;
+    accessToken: string | null;
+    refreshToken: string | null;
+    expiresIn: number | null;
+    requiresMFA?: boolean;
+    mfaChallengeId?: string;
+    mfaMethod?: MFAMethod;
+}
+/**
+ * Auth result (from strategy-based auth)
+ */
+export interface AuthResult {
+    success: boolean;
+    user?: User;
+    token?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    requiresMFA?: boolean;
+    mfaChallengeId?: string;
+    sessionId?: string;
+    error?: string;
+    metadata?: Record<string, unknown>;
+    redirectPath?: string;
+}
+/**
+ * Sign in input
+ */
+export interface SignInInput {
+    email?: string;
+    username?: string;
+    password: string;
+    /** Hint to the server to issue a longer-lived session */
+    rememberMe?: boolean;
+    /** reCAPTCHA token (required when captcha is enabled in prod) */
+    recaptchaToken?: string;
+}
+/**
+ * Sign up input
+ */
+export interface SignUpInput {
+    email: string;
+    username: string;
+    password: string;
+    firstName?: string;
+    lastName?: string;
+    name?: string;
+    phoneNumber?: string;
+    /** reCAPTCHA token (required when captcha is enabled in prod) */
+    recaptchaToken?: string;
+}
+/**
+ * Change password input
+ */
+export interface ChangePasswordInput {
+    currentPassword: string;
+    newPassword: string;
+}
+/**
+ * MFA methods
+ */
+export type MFAMethod = "TOTP" | "SMS" | "EMAIL" | "WEBAUTHN";
+/**
+ * MFA setup result
+ */
+export interface MFASetupResult {
+    secret?: string;
+    qrCode?: string;
+    backupCodes?: string[];
+    method: MFAMethod;
+}
+/**
+ * MFA verify input
+ */
+export interface MFAVerifyInput {
+    challengeId: string;
+    code: string;
+    method: MFAMethod;
+}
+/**
+ * OAuth input
+ */
+export interface OAuthInput {
+    provider: string;
+    code: string;
+    redirectUri?: string;
+}
+/**
+ * SAML input
+ */
+export interface SAMLInput {
+    samlResponse: string;
+    relayState?: string;
+}
+/**
+ * SAML request result
+ */
+export interface SAMLRequestResult {
+    requestId: string;
+    ssoUrl: string;
+    samlRequest: string;
+}
+/**
+ * Auth context for magic link
+ */
+export interface AuthContext {
+    ipAddress?: string;
+    userAgent?: string;
+    deviceId?: string;
+}
+/**
+ * Magic link send result
+ */
+export interface MagicLinkSendResult {
+    success: boolean;
+    message: string;
+    expiresIn?: number;
+}
+/**
+ * Organization entity (for context switcher)
+ */
+export interface Organization {
+    id: string;
+    name: string;
+    slug?: string;
+    tenantId?: string;
+    description?: string;
+    logo?: string;
+    website?: string;
+    status?: string;
+    type?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+/**
+ * Organization connection for pagination
+ */
+export interface OrganizationConnection {
+    total: number;
+    items: Organization[];
+}
+/**
+ * Workspace entity
+ */
+export interface Workspace {
+    id: string;
+    name: string;
+    slug: string;
+    tenantId: string;
+    organizationId: string;
+    type?: string;
+    status?: string;
+    region?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+/**
+ * Workspace secret status
+ */
+export type WorkspaceSecretStatus = "ACTIVE" | "INACTIVE" | "REVOKED" | "ROTATED";
+/**
+ * Workspace secret info
+ */
+export interface WorkspaceSecretInfo {
+    workspaceId: string;
+    status: WorkspaceSecretStatus;
+    algorithm: string;
+    createdAt: string;
+    updatedAt: string;
+    lastRotatedAt?: string;
+    isInGracePeriod: boolean;
+    gracePeriodEndsAt?: string;
+    rotationSchedule?: string;
+}
+/**
+ * Workspace token response
+ */
+export interface WorkspaceTokenResponse {
+    workspaceToken: string;
+    tokenType: string;
+    expiresIn: number;
+}
+/**
+ * Generate workspace token input
+ */
+export interface GenerateWorkspaceTokenInput {
+    workspaceId: string;
+}
+/**
+ * Rotate workspace secret input
+ */
+export interface RotateWorkspaceSecretInput {
+    workspaceId: string;
+    gracePeriodDays?: number;
+}
+/**
+ * Secret rotation response
+ */
+export interface SecretRotationResponse {
+    success: boolean;
+    message: string;
+    rotationStartedAt: string;
+    gracePeriodEndsAt: string;
+}
+/**
+ * Project entity (for context switcher)
+ */
+export interface Project {
+    id: string;
+    name: string;
+    key?: string;
+    workspaceId: string;
+    status?: ProjectStatus;
+    archived?: boolean;
+    createdAt?: string;
+    updatedAt?: string;
+}
+/**
+ * Project status
+ */
+export type ProjectStatus = "ACTIVE" | "ARCHIVED" | "INACTIVE";
+/**
+ * Project connection for pagination
+ */
+export interface ProjectConnection {
+    total: number;
+    items: Project[];
+}
+/**
+ * Token validation error
+ */
+export interface TokenValidationError {
+    code: string;
+    message: string;
+}
+/**
+ * Token validation response
+ */
+export interface TokenValidationResponse {
+    valid: boolean;
+    userId?: string;
+    email?: string;
+    role?: string;
+    tenantId?: string;
+    workspaceId?: string;
+    appId?: string;
+    delegationId?: string;
+    scopes?: string[];
+    tokenType?: string;
+    expiresAt?: number;
+    error?: TokenValidationError;
+}
+/**
+ * Validate tokens input
+ */
+export interface ValidateTokensInput {
+    authToken: string;
+    workspaceToken?: string;
+}
+/**
+ * Email verification result
+ */
+export interface EmailVerificationResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Resend verification result
+ */
+export interface ResendVerificationResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Password reset request result
+ */
+export interface PasswordResetRequestResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Delete user result
+ */
+export interface DeleteUserResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * MFA device (legacy)
+ */
+export interface MfaDevice {
+    id: string;
+    type: MFAMethod;
+    name: string;
+    verified: boolean;
+    lastUsedAt: string | null;
+    createdAt: string;
+}
+/**
+ * Session entity
+ */
+export interface Session {
+    id: string;
+    status: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    location: string | null;
+    lastActivityAt: string;
+    expiresAt: string;
+    createdAt: string;
+    isCurrent: boolean;
+}
+/**
+ * OAuth account (legacy)
+ */
+export interface OAuthAccount {
+    id: string;
+    provider: string;
+    providerEmail: string;
+    providerUsername: string | null;
+    createdAt: string;
+}
+/**
+ * OAuth providers (legacy)
+ */
+export type OAuthProvider = "google" | "github" | "microsoft" | "apple" | "linkedin" | "facebook";
+/**
+ * Trusted device (legacy)
+ */
+export interface TrustedDevice {
+    id: string;
+    deviceName: string;
+    ipAddress: string;
+    trustedAt: string;
+    expiresAt: string;
+}
+/**
+ * Security audit event (legacy)
+ */
+export interface SecurityAudit {
+    id: string;
+    eventType: SecurityEventType;
+    ipAddress: string;
+    userAgent: string;
+    location: string | null;
+    metadata: Record<string, unknown>;
+    timestamp: string;
+    success: boolean;
+}
+/**
+ * Security event types (legacy)
+ */
+export type SecurityEventType = "LOGIN" | "LOGIN_FAILED" | "LOGOUT" | "PASSWORD_CHANGED" | "PASSWORD_RESET_REQUESTED" | "PASSWORD_RESET_COMPLETED" | "MFA_ENABLED" | "MFA_DISABLED" | "MFA_VERIFIED" | "MFA_FAILED" | "OAUTH_LINKED" | "OAUTH_UNLINKED" | "SESSION_REVOKED" | "API_KEY_CREATED" | "API_KEY_REVOKED" | "DEVICE_TRUSTED" | "DEVICE_REVOKED" | "ANOMALY_DETECTED";
+/**
+ * Password strength
+ */
+export interface PasswordStrength {
+    score: 0 | 1 | 2 | 3 | 4;
+    feedback: string[];
+    crackTime: string;
+}
+/**
+ * SSO configuration
+ */
+export interface SSOConfig {
+    id: string;
+    tenantId: string;
+    type?: "SAML" | "OIDC";
+    enabled: boolean;
+    entityId: string;
+    ssoUrl: string;
+    sloUrl?: string;
+    certificate: string;
+    domains?: string[];
+    metadata?: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * API key entity (matches myApiKeys query response)
+ */
+export interface ApiKey {
+    id: string;
+    name: string;
+    prefix: string;
+    scopes: string[];
+    appId?: string;
+    appName?: string;
+    createdAt: string;
+    expiresAt?: string;
+    lastUsedAt?: string;
+}
+/**
+ * Input for generating a new API key
+ */
+export interface GenerateAPIKeyInput {
+    appId: string;
+    name: string;
+    scope: string[];
+    expiresInDays?: number;
+    recaptchaToken?: string;
+}
+/**
+ * Result of API key generation (matches generateAPIKey mutation response)
+ * Fields: apiKey, apiSecret, keyId
+ */
+export interface APIKeyResult {
+    keyId: string;
+    apiKey: string;
+    apiSecret: string;
+}
+/**
+ * Result of API key rotation (matches rotateAPIKey mutation response)
+ * Fields: apiSecret
+ */
+export interface APIKeyRotateResult {
+    apiSecret: string;
+}
+/**
+ * App type enum
+ */
+export type AppType = "SERVICE" | "INTEGRATION" | "BOT";
+/**
+ * OAuth application entity (matches backend schema)
+ */
+export interface App {
+    id: string;
+    name: string;
+    description?: string;
+    type: AppType;
+    clientId: string;
+    status: string;
+    scopes: string[];
+    redirectUris: string[];
+    ownerId: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * Input for creating an OAuth application
+ */
+export interface CreateAppInput {
+    name: string;
+    description?: string;
+    type: AppType;
+    scopes?: string[];
+    redirectUris?: string[];
+}
+/**
+ * Input for updating an OAuth application
+ */
+export interface UpdateAppInput {
+    name?: string;
+    description?: string;
+    scopes?: string[];
+    redirectUris?: string[];
+}
+/**
+ * Response from creating an app (includes client secret, shown only once)
+ */
+export interface AppCreateResponse {
+    app: App;
+    clientSecret: string;
+}
+/**
+ * Response from authenticating an app or generating an app token
+ */
+export interface AppTokenResponse {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    scopes: string[];
+}
+/**
+ * Response from generating an app-as-user token or token exchange
+ */
+export interface AppAsUserTokenResponse {
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    scopes: string[];
+    actingAs: string;
+}
+/**
+ * App-user delegation entity (matches backend schema)
+ */
+export interface AppUserDelegation {
+    id: string;
+    appId: string;
+    userId: string;
+    scopes: string[];
+    workspaceIds: string[];
+    status: "ACTIVE" | "REVOKED" | "EXPIRED";
+    grantedAt: string;
+    expiresAt?: string;
+    revokedAt?: string;
+    revokeReason?: string;
+    app?: App;
+}
+/**
+ * Input for granting delegation to an app
+ */
+export interface GrantDelegationInput {
+    appId: string;
+    userId: string;
+    scopes: string[];
+    workspaceIds?: string[];
+    expiresInDays?: number;
+}

package/dist/auth/utils/captchaConfig.d.ts

@@ -0,0 +1,3 @@
+export declare function isCaptchaEnabled(): boolean;
+export declare function getRecaptchaSiteKey(): string | undefined;
+export declare function requireRecaptchaSiteKey(): string;

package/dist/auth/utils/formatters.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Format date relative to now (e.g., "2 minutes ago", "3 days ago")
+ */
+export declare function formatRelativeTime(dateString: string): string;
+/**
+ * Format date to human-readable string
+ */
+export declare function formatDate(dateString: string): string;
+/**
+ * Format date and time
+ */
+export declare function formatDateTime(dateString: string): string;
+/**
+ * Mask API key (show only prefix and last 4 characters)
+ */
+export declare function maskApiKey(key: string, prefix: string): string;
+/**
+ * Format IP address with location
+ */
+export declare function formatLocationString(ipAddress: string, location: string | null): string;
+/**
+ * Get device icon based on user agent
+ */
+export declare function getDeviceIcon(userAgent: string): string;
+/**
+ * Parse device name from user agent
+ */
+export declare function parseDeviceName(userAgent: string | null | undefined): string;
+/**
+ * Parse browser name from user agent
+ */
+export declare function parseBrowserName(userAgent: string | null | undefined): string;
+/**
+ * Format OAuth provider name
+ */
+export declare function formatOAuthProvider(provider: string): string;

package/dist/auth/utils/gatewayBaseUrls.d.ts

@@ -0,0 +1,5 @@
+export interface GatewayBaseUrls {
+    globalBaseUrl: string;
+    workspaceBaseUrl: string;
+}
+export declare function resolveGatewayBaseUrls(): GatewayBaseUrls;

package/dist/auth/utils/index.d.ts

@@ -0,0 +1,2 @@
+export * from './validation';
+export * from './formatters';