@camstack/addon-auth 1.1.1

package/dist/magic-link/auth-magic-link.addon.js

@@ -0,0 +1,240 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+require("../chunk-Cek0wNdY.js");
+const require_dist = require("../dist-CXCR7sEk.js");
+//#region src/magic-link/auth-magic-link.addon.ts
+/**
+* Magic-link authentication addon.
+*
+* Passwordless flow:
+*   1. Operator types their email on the login page → clicks "Send link".
+*   2. The addon's `/request` route accepts the email, looks up the user
+*      via `user-management.listUsers()`, mints a short-lived HMAC bridge
+*      token (via `sso-bridge` cap), and delivers a URL of the form
+*      `https://<hub>/addon/auth-magic-link/login?bridge=<token>` to the
+*      user's email.
+*   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
+*      → hub verifies the bridge token and mints the real session.
+*
+* Delivery is pluggable. This addon ships a "log-only" mode by default
+* (writes the URL to the addon log so operators can copy it during
+* setup before SMTP is configured). Production deployments configure
+* the SMTP relay via global settings.
+*
+* Open follow-ups:
+*   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
+*     declares `smtpProvider` cap if/when we ship an SMTP addon).
+*   - Throttle requests per-email (rate-limit window).
+*   - Auto-provision unknown emails (currently rejected for safety).
+*/
+var DEFAULT_CONFIG = {
+	displayName: "Email magic link",
+	icon: "mail",
+	publicOrigin: "",
+	deliveryMode: "log-only",
+	defaultRole: "viewer",
+	ttlSec: 600
+};
+var AuthMagicLinkAddon = class extends require_dist.BaseAddon {
+	kind = "magic-link";
+	hasRedirectFlow = false;
+	hasCredentialFlow = true;
+	displayName;
+	icon;
+	constructor() {
+		super({ ...DEFAULT_CONFIG });
+		this.displayName = DEFAULT_CONFIG.displayName;
+		this.icon = DEFAULT_CONFIG.icon;
+	}
+	async onInitialize() {
+		Object.assign(this, {
+			displayName: this.config.displayName || DEFAULT_CONFIG.displayName,
+			icon: this.config.icon || DEFAULT_CONFIG.icon
+		});
+		const authProvider = {
+			validateCredentials: async () => null,
+			validateToken: async () => null,
+			getLoginUrl: async () => {
+				throw new Error("Magic link does not support direct getLoginUrl — POST email to /addon/auth-magic-link/request");
+			},
+			handleCallback: async () => {
+				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
+			}
+		};
+		const routes = [{
+			method: "POST",
+			path: "/request",
+			access: "public",
+			description: "Request a magic link be delivered to the given email",
+			handler: async (req, reply) => this.handleRequest(req, reply)
+		}, {
+			method: "GET",
+			path: "/login",
+			access: "public",
+			description: "Click target embedded in the magic-link email",
+			handler: async (req, reply) => this.handleLogin(req, reply)
+		}];
+		const routeProvider = {
+			id: "auth-magic-link",
+			getRoutes: () => routes
+		};
+		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		return [{
+			capability: require_dist.authProviderCapability,
+			provider: authProvider
+		}, {
+			capability: require_dist.addonRoutesCapability,
+			provider: routeProvider
+		}];
+	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "magic-link",
+			title: "Magic Link Settings",
+			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
+			columns: 1,
+			fields: [
+				this.field({
+					type: "text",
+					key: "displayName",
+					label: "Display name",
+					default: DEFAULT_CONFIG.displayName
+				}),
+				this.field({
+					type: "text",
+					key: "icon",
+					label: "Icon",
+					default: DEFAULT_CONFIG.icon
+				}),
+				this.field({
+					type: "text",
+					key: "publicOrigin",
+					label: "Public origin",
+					description: "Where the email link points. Empty = read CAMSTACK_PUBLIC_ORIGIN env var.",
+					default: ""
+				}),
+				this.field({
+					type: "select",
+					key: "deliveryMode",
+					label: "Delivery mode",
+					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					default: DEFAULT_CONFIG.deliveryMode,
+					options: [{
+						value: "log-only",
+						label: "Log-only (no email sent)"
+					}, {
+						value: "smtp",
+						label: "SMTP (when configured)"
+					}]
+				}),
+				this.field({
+					type: "select",
+					key: "defaultRole",
+					label: "Default role",
+					default: DEFAULT_CONFIG.defaultRole,
+					options: [{
+						value: "viewer",
+						label: "Viewer"
+					}, {
+						value: "admin",
+						label: "Admin"
+					}]
+				}),
+				this.field({
+					type: "number",
+					key: "ttlSec",
+					label: "Link TTL (seconds)",
+					description: "How long the magic link stays valid. Default 600 (10 min).",
+					default: DEFAULT_CONFIG.ttlSec
+				})
+			]
+		}] });
+	}
+	buildPublicOrigin() {
+		const configured = this.config.publicOrigin?.trim();
+		if (configured) return configured.replace(/\/+$/, "");
+		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+	}
+	async findUserByEmail(email) {
+		let users;
+		try {
+			users = await this.ctx.api.userManagement.listUsers.query();
+		} catch (err) {
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: require_dist.errMsg(err) } });
+			return null;
+		}
+		const needle = email.trim().toLowerCase();
+		for (const u of users) if (u.username.toLowerCase() === needle) return u;
+		return null;
+	}
+	async handleRequest(req, reply) {
+		try {
+			const body = req.body ?? {};
+			const email = typeof body.email === "string" ? body.email.trim() : "";
+			if (!email || !email.includes("@")) {
+				reply.code(400);
+				reply.send({ error: "A valid email address is required" });
+				return;
+			}
+			const ok = { sent: true };
+			const user = await this.findUserByEmail(email);
+			if (!user) {
+				reply.code(200);
+				reply.send(ok);
+				return;
+			}
+			let token;
+			try {
+				({token} = await this.ctx.api.ssoBridge.signBridgeToken.query({
+					claims: {
+						userId: user.id,
+						username: user.username,
+						isAdmin: user.isAdmin,
+						provider: "auth-magic-link",
+						email
+					},
+					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
+				}));
+			} catch (err) {
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: require_dist.errMsg(err) } });
+				reply.code(503);
+				reply.send({ error: "sso-bridge capability unavailable" });
+				return;
+			}
+			const link = `${this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+				email,
+				link,
+				ttlSec: this.config.ttlSec
+			} });
+			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+				email,
+				link
+			} });
+			reply.code(200);
+			reply.send(ok);
+		} catch (err) {
+			reply.code(500);
+			reply.send({
+				error: "Magic-link request failed",
+				message: require_dist.errMsg(err)
+			});
+		}
+	}
+	async handleLogin(req, reply) {
+		const bridge = req.query["bridge"];
+		if (!bridge) {
+			reply.code(400);
+			reply.send({ error: "Missing bridge token" });
+			return;
+		}
+		reply.code(302);
+		reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridge)}`);
+		reply.send("");
+	}
+};
+//#endregion
+exports.AuthMagicLinkAddon = AuthMagicLinkAddon;
+exports.default = AuthMagicLinkAddon;

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -0,0 +1,234 @@
+import { a as BaseAddon, i as errMsg, n as authProviderCapability, t as addonRoutesCapability } from "../dist-JmuFs-U5.mjs";
+//#region src/magic-link/auth-magic-link.addon.ts
+/**
+* Magic-link authentication addon.
+*
+* Passwordless flow:
+*   1. Operator types their email on the login page → clicks "Send link".
+*   2. The addon's `/request` route accepts the email, looks up the user
+*      via `user-management.listUsers()`, mints a short-lived HMAC bridge
+*      token (via `sso-bridge` cap), and delivers a URL of the form
+*      `https://<hub>/addon/auth-magic-link/login?bridge=<token>` to the
+*      user's email.
+*   3. Email click hits `/login?bridge=…` → 302 to `/api/auth/sso/finish?bridge=…`
+*      → hub verifies the bridge token and mints the real session.
+*
+* Delivery is pluggable. This addon ships a "log-only" mode by default
+* (writes the URL to the addon log so operators can copy it during
+* setup before SMTP is configured). Production deployments configure
+* the SMTP relay via global settings.
+*
+* Open follow-ups:
+*   - Wire `nodemailer` for real SMTP delivery (peer dep; the framework
+*     declares `smtpProvider` cap if/when we ship an SMTP addon).
+*   - Throttle requests per-email (rate-limit window).
+*   - Auto-provision unknown emails (currently rejected for safety).
+*/
+var DEFAULT_CONFIG = {
+	displayName: "Email magic link",
+	icon: "mail",
+	publicOrigin: "",
+	deliveryMode: "log-only",
+	defaultRole: "viewer",
+	ttlSec: 600
+};
+var AuthMagicLinkAddon = class extends BaseAddon {
+	kind = "magic-link";
+	hasRedirectFlow = false;
+	hasCredentialFlow = true;
+	displayName;
+	icon;
+	constructor() {
+		super({ ...DEFAULT_CONFIG });
+		this.displayName = DEFAULT_CONFIG.displayName;
+		this.icon = DEFAULT_CONFIG.icon;
+	}
+	async onInitialize() {
+		Object.assign(this, {
+			displayName: this.config.displayName || DEFAULT_CONFIG.displayName,
+			icon: this.config.icon || DEFAULT_CONFIG.icon
+		});
+		const authProvider = {
+			validateCredentials: async () => null,
+			validateToken: async () => null,
+			getLoginUrl: async () => {
+				throw new Error("Magic link does not support direct getLoginUrl — POST email to /addon/auth-magic-link/request");
+			},
+			handleCallback: async () => {
+				throw new Error("Magic link does not use callback — the email link redirects to /api/auth/sso/finish directly");
+			}
+		};
+		const routes = [{
+			method: "POST",
+			path: "/request",
+			access: "public",
+			description: "Request a magic link be delivered to the given email",
+			handler: async (req, reply) => this.handleRequest(req, reply)
+		}, {
+			method: "GET",
+			path: "/login",
+			access: "public",
+			description: "Click target embedded in the magic-link email",
+			handler: async (req, reply) => this.handleLogin(req, reply)
+		}];
+		const routeProvider = {
+			id: "auth-magic-link",
+			getRoutes: () => routes
+		};
+		this.ctx.logger.info("Magic-link auth provider initialized", { meta: { deliveryMode: this.config.deliveryMode } });
+		return [{
+			capability: authProviderCapability,
+			provider: authProvider
+		}, {
+			capability: addonRoutesCapability,
+			provider: routeProvider
+		}];
+	}
+	globalSettingsSchema() {
+		return this.schema({ sections: [{
+			id: "magic-link",
+			title: "Magic Link Settings",
+			description: "Passwordless email login. The user types an email; the hub mails them a one-time link valid for the configured TTL.",
+			columns: 1,
+			fields: [
+				this.field({
+					type: "text",
+					key: "displayName",
+					label: "Display name",
+					default: DEFAULT_CONFIG.displayName
+				}),
+				this.field({
+					type: "text",
+					key: "icon",
+					label: "Icon",
+					default: DEFAULT_CONFIG.icon
+				}),
+				this.field({
+					type: "text",
+					key: "publicOrigin",
+					label: "Public origin",
+					description: "Where the email link points. Empty = read CAMSTACK_PUBLIC_ORIGIN env var.",
+					default: ""
+				}),
+				this.field({
+					type: "select",
+					key: "deliveryMode",
+					label: "Delivery mode",
+					description: "log-only writes the URL to the addon log (setup only). smtp uses the configured SMTP relay.",
+					default: DEFAULT_CONFIG.deliveryMode,
+					options: [{
+						value: "log-only",
+						label: "Log-only (no email sent)"
+					}, {
+						value: "smtp",
+						label: "SMTP (when configured)"
+					}]
+				}),
+				this.field({
+					type: "select",
+					key: "defaultRole",
+					label: "Default role",
+					default: DEFAULT_CONFIG.defaultRole,
+					options: [{
+						value: "viewer",
+						label: "Viewer"
+					}, {
+						value: "admin",
+						label: "Admin"
+					}]
+				}),
+				this.field({
+					type: "number",
+					key: "ttlSec",
+					label: "Link TTL (seconds)",
+					description: "How long the magic link stays valid. Default 600 (10 min).",
+					default: DEFAULT_CONFIG.ttlSec
+				})
+			]
+		}] });
+	}
+	buildPublicOrigin() {
+		const configured = this.config.publicOrigin?.trim();
+		if (configured) return configured.replace(/\/+$/, "");
+		return (process.env["CAMSTACK_PUBLIC_ORIGIN"] || "").replace(/\/+$/, "") || "https://localhost:4443";
+	}
+	async findUserByEmail(email) {
+		let users;
+		try {
+			users = await this.ctx.api.userManagement.listUsers.query();
+		} catch (err) {
+			this.ctx.logger.warn("Magic-link user lookup failed (user-management cap unavailable)", { meta: { message: errMsg(err) } });
+			return null;
+		}
+		const needle = email.trim().toLowerCase();
+		for (const u of users) if (u.username.toLowerCase() === needle) return u;
+		return null;
+	}
+	async handleRequest(req, reply) {
+		try {
+			const body = req.body ?? {};
+			const email = typeof body.email === "string" ? body.email.trim() : "";
+			if (!email || !email.includes("@")) {
+				reply.code(400);
+				reply.send({ error: "A valid email address is required" });
+				return;
+			}
+			const ok = { sent: true };
+			const user = await this.findUserByEmail(email);
+			if (!user) {
+				reply.code(200);
+				reply.send(ok);
+				return;
+			}
+			let token;
+			try {
+				({token} = await this.ctx.api.ssoBridge.signBridgeToken.query({
+					claims: {
+						userId: user.id,
+						username: user.username,
+						isAdmin: user.isAdmin,
+						provider: "auth-magic-link",
+						email
+					},
+					ttlSec: this.config.ttlSec || DEFAULT_CONFIG.ttlSec
+				}));
+			} catch (err) {
+				this.ctx.logger.error("Magic-link bridge-token minting failed (sso-bridge unavailable)", { meta: { message: errMsg(err) } });
+				reply.code(503);
+				reply.send({ error: "sso-bridge capability unavailable" });
+				return;
+			}
+			const link = `${this.buildPublicOrigin()}/addon/auth-magic-link/login?bridge=${encodeURIComponent(token)}`;
+			if (this.config.deliveryMode === "log-only") this.ctx.logger.warn("Magic link generated (log-only mode — NOT delivered via email)", { meta: {
+				email,
+				link,
+				ttlSec: this.config.ttlSec
+			} });
+			else this.ctx.logger.warn("Magic link delivery: SMTP mode requested but no smtp-provider cap registered. Falling back to log.", { meta: {
+				email,
+				link
+			} });
+			reply.code(200);
+			reply.send(ok);
+		} catch (err) {
+			reply.code(500);
+			reply.send({
+				error: "Magic-link request failed",
+				message: errMsg(err)
+			});
+		}
+	}
+	async handleLogin(req, reply) {
+		const bridge = req.query["bridge"];
+		if (!bridge) {
+			reply.code(400);
+			reply.send({ error: "Missing bridge token" });
+			return;
+		}
+		reply.code(302);
+		reply.header("Location", `/api/auth/sso/finish?bridge=${encodeURIComponent(bridge)}`);
+		reply.send("");
+	}
+};
+//#endregion
+export { AuthMagicLinkAddon, AuthMagicLinkAddon as default };