@c1m-public/platform-auth 0.5.0 → 0.7.0

package/dist/chunk-FBC2NUH7.js

@@ -0,0 +1,83 @@
+// src/token.ts
+function readStringClaim(value, fallback = "") {
+  return typeof value === "string" ? value : fallback;
+}
+function readBooleanClaim(value, fallback) {
+  return typeof value === "boolean" ? value : fallback;
+}
+function decodeBase64Url(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(normalized.length + (4 - normalized.length % 4) % 4, "=");
+  try {
+    const binary = globalThis.atob(padded);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder().decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function decodeTokenPayload(token) {
+  const payloadSegment = token.split(".")[1];
+  if (!payloadSegment) return null;
+  const decodedJson = decodeBase64Url(payloadSegment);
+  if (!decodedJson) return null;
+  try {
+    const parsed = JSON.parse(decodedJson);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function hasTokenAudience(token, requiredAudience) {
+  const audience = decodeTokenPayload(token)?.aud;
+  return typeof audience === "string" ? audience === requiredAudience : Array.isArray(audience) && audience.includes(requiredAudience);
+}
+function nowInSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function tokenMaxAgeSeconds(token, configuredMaxAge) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return configuredMaxAge;
+  return Math.max(0, Math.min(configuredMaxAge, decoded.exp - nowInSeconds()));
+}
+function isTokenExpired(token) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return true;
+  return decoded.exp <= nowInSeconds();
+}
+function isTokenExpiringSoon(token, bufferSeconds = 120) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded?.exp) return true;
+  return decoded.exp < nowInSeconds() + bufferSeconds;
+}
+function decodeDefaultSession(token) {
+  const decoded = decodeTokenPayload(token);
+  if (!decoded) return null;
+  const actorId = decoded.effective_user_id || decoded.actor_id || decoded.customer_id || decoded.user_id || (typeof decoded.sub === "string" ? decoded.sub : void 0);
+  if (!actorId) return null;
+  return {
+    user: {
+      id: String(actorId),
+      email: readStringClaim(decoded.email),
+      name: readStringClaim(decoded.name),
+      role: readStringClaim(decoded.role, "user"),
+      is_active: readBooleanClaim(decoded.is_active, true),
+      email_verified: readBooleanClaim(decoded.email_verified, false),
+      created_at: readStringClaim(decoded.created_at),
+      has_passkey: readBooleanClaim(decoded.has_passkeys, false)
+    },
+    token,
+    exp: decoded.exp || 0,
+    iat: decoded.iat || 0
+  };
+}
+function parseAuthResponse(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  if (typeof candidate.access_token !== "string" || typeof candidate.refresh_token !== "string" || typeof candidate.token_type !== "string" || typeof candidate.expires_at !== "string" || !candidate.user || typeof candidate.user !== "object") {
+    return null;
+  }
+  return candidate;
+}
+
+export { decodeBase64Url, decodeDefaultSession, decodeTokenPayload, hasTokenAudience, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, tokenMaxAgeSeconds };

package/dist/chunk-RR5DP3QT.js

@@ -0,0 +1,261 @@
+import { resolveValue, forwardedRequestHeaders, timedFetch } from './chunk-RVKIDFXM.js';
+
+// src/access/generated/keys.ts
+var PLATFORM_PERMISSIONS = [
+  "affiliates.finance.manage",
+  "affiliates.partners.manage",
+  "affiliates.programmes.manage",
+  "affiliates.view",
+  "linkservice.domains.manage",
+  "linkservice.links.manage",
+  "linkservice.qr.manage",
+  "linkservice.view",
+  "platform.admin.view",
+  "platform.audit.view",
+  "platform.auth.manage",
+  "platform.billing.manage",
+  "platform.channels.manage",
+  "platform.channels.view",
+  "platform.config.manage",
+  "platform.docs.manage",
+  "platform.docs.view",
+  "platform.observability.manage",
+  "platform.observability.view",
+  "platform.offboarding.view",
+  "platform.ops.manage",
+  "platform.support.impersonate",
+  "platform.support.sessions",
+  "platform.tenants.archive",
+  "platform.tenants.manage",
+  "platform.tenants.restore",
+  "platform.users.deactivate",
+  "platform.users.delete",
+  "platform.users.invite",
+  "platform.users.manage_access",
+  "platform.users.reactivate",
+  "platform.users.view"
+];
+var DASH_PERMISSIONS = [
+  "dash.apps.manage",
+  "dash.billing.manage",
+  "dash.channels.manage",
+  "dash.customers.manage",
+  "dash.domains.manage",
+  "dash.members.manage",
+  "dash.ownership.transfer",
+  "dash.plans.manage",
+  "dash.publish",
+  "dash.settings.manage",
+  "dash.workspaces.admin",
+  "dash.workspaces.manage"
+];
+var DASH_ROLES = [
+  "dash.admin",
+  "dash.owner"
+];
+var LEADBROKER_PERMISSIONS = [
+  "leadbroker.finance.manage",
+  "leadbroker.leads.dispatch",
+  "leadbroker.leads.review",
+  "leadbroker.leads.view",
+  "leadbroker.policy.manage"
+];
+var WORKSPACE_PERMISSIONS = [
+  "workspace.channels.manage",
+  "workspace.channels.secrets",
+  "workspace.channels.view",
+  "workspace.crm.manage",
+  "workspace.crm.view",
+  "workspace.customers.manage",
+  "workspace.customers.view",
+  "workspace.orders.manage",
+  "workspace.orders.view",
+  "workspace.payments.record",
+  "workspace.site.edit",
+  "workspace.site.view",
+  "workspace.staff.manage"
+];
+var WORKSPACE_ROLES = [
+  "workspace.editor",
+  "workspace.frontdesk",
+  "workspace.manager"
+];
+
+// src/access/errors.ts
+var AccessSnapshotError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "AccessSnapshotError";
+    this.code = code;
+    this.status = status;
+  }
+};
+function isAccessSnapshotError(error, code) {
+  return error instanceof AccessSnapshotError && (code === void 0 || error.code === code);
+}
+
+// src/access/snapshot.ts
+var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
+function emptySnapshot(subjectId = "") {
+  return {
+    subject_id: subjectId,
+    access_version: 0,
+    is_owner: false,
+    active: false,
+    platform_role: "",
+    permissions: [],
+    dash_roles: {},
+    workspace_permissions: {},
+    workspace_roles: {}
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function fail(field, why) {
+  throw new AccessSnapshotError("invalid_snapshot", `access snapshot: ${field} ${why}`);
+}
+function parseAccessSnapshot(input) {
+  if (!isRecord(input)) fail("payload", "is not an object");
+  const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
+  if (typeof subject_id !== "string" || subject_id === "") fail("subject_id", "must be a non-empty string");
+  if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0) fail("access_version", "must be a non-negative integer");
+  if (typeof is_owner !== "boolean") fail("is_owner", "must be a boolean");
+  if (typeof active !== "boolean") fail("active", "must be a boolean");
+  if (platform_role !== void 0 && platform_role !== null && typeof platform_role !== "string") fail("platform_role", "must be a string");
+  if (!Array.isArray(permissions)) fail("permissions", "must be an array");
+  const entries = permissions.map((raw, i) => {
+    if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
+    const { key, scope_type, scope_id } = raw;
+    if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
+    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
+    if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
+    return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
+  });
+  const dashRoles = {};
+  if (dash_roles !== void 0 && dash_roles !== null) {
+    if (!isRecord(dash_roles)) fail("dash_roles", "must be an object");
+    for (const [dash, role] of Object.entries(dash_roles)) {
+      if (typeof role !== "string") fail(`dash_roles[${dash}]`, "must be a string");
+      dashRoles[dash] = role;
+    }
+  }
+  const wsPerms = {};
+  if (workspace_permissions !== void 0 && workspace_permissions !== null) {
+    if (!isRecord(workspace_permissions)) fail("workspace_permissions", "must be an object");
+    for (const [ws, keys] of Object.entries(workspace_permissions)) {
+      if (!Array.isArray(keys) || keys.some((k) => typeof k !== "string")) fail(`workspace_permissions[${ws}]`, "must be a string array");
+      wsPerms[ws] = [...keys];
+    }
+  }
+  const wsRoles = {};
+  if (workspace_roles !== void 0 && workspace_roles !== null) {
+    if (!isRecord(workspace_roles)) fail("workspace_roles", "must be an object");
+    for (const [ws, role] of Object.entries(workspace_roles)) {
+      if (typeof role !== "string") fail(`workspace_roles[${ws}]`, "must be a string");
+      wsRoles[ws] = role;
+    }
+  }
+  return {
+    subject_id,
+    access_version,
+    is_owner,
+    active,
+    platform_role: typeof platform_role === "string" ? platform_role : "",
+    permissions: entries,
+    dash_roles: dashRoles,
+    workspace_permissions: wsPerms,
+    workspace_roles: wsRoles
+  };
+}
+
+// src/access/predicates.ts
+function entryCoversApp(entry, saasApp) {
+  switch (entry.scope_type) {
+    case "platform":
+      return true;
+    case "saas_app":
+      if (saasApp === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+    default:
+      return false;
+  }
+}
+function hasPermission(snapshot, key, opts = {}) {
+  if (!snapshot.active) return false;
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+}
+function hasAnyPermission(snapshot, keys, opts = {}) {
+  return keys.some((key) => hasPermission(snapshot, key, opts));
+}
+function hasAllPermissions(snapshot, keys, opts = {}) {
+  return keys.every((key) => hasPermission(snapshot, key, opts));
+}
+function hasWorkspacePermission(snapshot, workspaceId, key) {
+  if (!snapshot.active) return false;
+  if (snapshot.is_owner) return true;
+  return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
+}
+function managedDashes(snapshot) {
+  if (!snapshot.active) return [];
+  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+}
+function dashRole(snapshot, saasApp) {
+  if (!snapshot.active) return "";
+  return snapshot.dash_roles[saasApp] ?? "";
+}
+function isPlatformOwner(snapshot) {
+  return snapshot.active && snapshot.is_owner;
+}
+function appScopes(snapshot, key) {
+  if (!snapshot.active) return { all: false, apps: [] };
+  const apps = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) {
+    if (entry.key !== key) continue;
+    if (entry.scope_type === "platform") return { all: true, apps: [] };
+    if (entry.scope_type === "saas_app") {
+      if (entry.scope_id === "*") return { all: true, apps: [] };
+      apps.add(entry.scope_id.toLowerCase());
+    }
+  }
+  return { all: false, apps: [...apps].sort() };
+}
+function permissionsFor(snapshot, opts = {}) {
+  if (!snapshot.active) return [];
+  const keys = /* @__PURE__ */ new Set();
+  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
+  return [...keys].sort();
+}
+
+// src/access/fetch.ts
+var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
+async function fetchAccessSnapshot(opts) {
+  const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
+  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
+  headers.set("Authorization", `Bearer ${opts.accessToken}`);
+  headers.set("Accept", "application/json");
+  let response;
+  try {
+    response = await timedFetch(url, {
+      init: { method: "GET", headers },
+      timeoutMs: opts.fetchTimeoutMs,
+      fetchImpl: opts.fetchImpl
+    });
+  } catch (error) {
+    throw new AccessSnapshotError("unavailable", `access snapshot request failed: ${error.message}`);
+  }
+  if (response.status === 401) throw new AccessSnapshotError("unauthenticated", "session expired", 401);
+  if (response.status === 403) throw new AccessSnapshotError("forbidden", "access snapshot refused", 403);
+  if (!response.ok) throw new AccessSnapshotError("unavailable", `access snapshot returned ${response.status}`, response.status);
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new AccessSnapshotError("invalid_snapshot", "access snapshot body is not JSON", response.status);
+  }
+  return parseAccessSnapshot(body);
+}
+
+export { AccessSnapshotError, DASH_PERMISSIONS, DASH_ROLES, DEFAULT_ACCESS_ENDPOINT_PATH, LEADBROKER_PERMISSIONS, PLATFORM_PERMISSIONS, WORKSPACE_PERMISSIONS, WORKSPACE_ROLES, appScopes, dashRole, emptySnapshot, entryCoversApp, fetchAccessSnapshot, hasAllPermissions, hasAnyPermission, hasPermission, hasWorkspacePermission, isAccessSnapshotError, isPlatformOwner, managedDashes, parseAccessSnapshot, permissionsFor };

package/dist/chunk-RVKIDFXM.js

@@ -0,0 +1,44 @@
+// ../transport/src/forwarding.ts
+function applyForwardedClientHeaders(incoming, headers = new Headers()) {
+  const forwardedFor = incoming.get("x-forwarded-for");
+  const realIp = incoming.get("x-real-ip") ?? forwardedFor?.split(",")[0]?.trim();
+  if (realIp && !headers.has("X-Client-IP")) headers.set("X-Client-IP", realIp);
+  if (realIp && !headers.has("X-Real-IP")) headers.set("X-Real-IP", realIp);
+  if (forwardedFor && !headers.has("X-Forwarded-For")) headers.set("X-Forwarded-For", forwardedFor);
+  const country = incoming.get("cf-ipcountry") ?? incoming.get("x-vercel-ip-country") ?? incoming.get("x-geo-country") ?? incoming.get("x-country-code");
+  if (country && country !== "XX" && !headers.has("X-Geo-Country")) {
+    headers.set("X-Geo-Country", country);
+  }
+  const host = incoming.get("host");
+  if (host && !headers.has("X-Forwarded-Host")) headers.set("X-Forwarded-Host", host);
+  const proto = incoming.get("x-forwarded-proto");
+  if (proto && !headers.has("X-Forwarded-Proto")) headers.set("X-Forwarded-Proto", proto);
+  const userAgent = incoming.get("user-agent");
+  if (userAgent && !headers.has("X-Client-User-Agent")) headers.set("X-Client-User-Agent", userAgent);
+  return headers;
+}
+function forwardedRequestHeaders(request, init) {
+  return applyForwardedClientHeaders(request.headers, new Headers(init));
+}
+
+// src/internal.ts
+function resolveValue(value) {
+  return typeof value === "function" ? value() : value;
+}
+var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
+async function timedFetch(url, options = {}) {
+  const doFetch = options.fetch ?? options.fetchImpl ?? fetch;
+  const controller = options.timeoutMs ? new AbortController() : void 0;
+  const timer = controller ? setTimeout(() => controller.abort(), options.timeoutMs) : void 0;
+  try {
+    return await doFetch(url, {
+      ...options.init,
+      cache: "no-store",
+      ...controller ? { signal: controller.signal } : {}
+    });
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+export { DEFAULT_FETCH_TIMEOUT_MS, applyForwardedClientHeaders, forwardedRequestHeaders, resolveValue, timedFetch };