@classic-homes/auth 0.1.0

package/dist/core/index.js

@@ -0,0 +1,887 @@
+// src/core/config.ts
+var config = null;
+function initAuth(options) {
+  config = {
+    ...options,
+    storageKey: options.storageKey ?? "classic_auth"
+  };
+}
+function getConfig() {
+  if (!config) {
+    throw new Error(
+      '@classic-homes/auth not initialized. Call initAuth({ baseUrl: "..." }) before using auth services.'
+    );
+  }
+  return config;
+}
+function isInitialized() {
+  return config !== null;
+}
+function resetConfig() {
+  config = null;
+}
+function getDefaultStorage() {
+  if (typeof window !== "undefined" && window.localStorage) {
+    return {
+      getItem: (key) => localStorage.getItem(key),
+      setItem: (key, value) => localStorage.setItem(key, value),
+      removeItem: (key) => localStorage.removeItem(key)
+    };
+  }
+  return {
+    getItem: () => null,
+    setItem: () => {
+    },
+    removeItem: () => {
+    }
+  };
+}
+function getStorage() {
+  const cfg = getConfig();
+  return cfg.storage ?? getDefaultStorage();
+}
+function getFetch() {
+  const cfg = getConfig();
+  return cfg.fetch ?? fetch;
+}
+
+// src/core/client.ts
+var isRefreshing = false;
+var refreshSubscribers = [];
+function subscribeTokenRefresh(cb) {
+  refreshSubscribers.push(cb);
+}
+function onTokenRefreshed(token) {
+  refreshSubscribers.forEach((cb) => cb(token));
+  refreshSubscribers = [];
+}
+function getAccessToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.accessToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getRefreshToken() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const authData = storage.getItem(config2.storageKey ?? "classic_auth");
+  if (!authData) return null;
+  try {
+    const parsed = JSON.parse(authData);
+    return parsed.refreshToken ?? null;
+  } catch {
+    return null;
+  }
+}
+function getSessionToken() {
+  const storage = getStorage();
+  return storage.getItem("sessionToken");
+}
+function updateStoredTokens(accessToken, refreshToken) {
+  const config2 = getConfig();
+  const storage = getStorage();
+  const storageKey = config2.storageKey ?? "classic_auth";
+  const authData = storage.getItem(storageKey);
+  let parsed = {};
+  if (authData) {
+    try {
+      parsed = JSON.parse(authData);
+    } catch {
+    }
+  }
+  parsed.accessToken = accessToken;
+  parsed.refreshToken = refreshToken;
+  storage.setItem(storageKey, JSON.stringify(parsed));
+  config2.onTokenRefresh?.({ accessToken, refreshToken });
+}
+function clearStoredAuth() {
+  const config2 = getConfig();
+  const storage = getStorage();
+  storage.removeItem(config2.storageKey ?? "classic_auth");
+  storage.removeItem("sessionToken");
+}
+async function refreshAccessToken() {
+  const refreshToken = getRefreshToken();
+  const config2 = getConfig();
+  const fetchFn = getFetch();
+  if (!refreshToken) {
+    return false;
+  }
+  try {
+    const response = await fetchFn(`${config2.baseUrl}/auth/refresh`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ refreshToken })
+    });
+    if (response.ok) {
+      const apiResponse = await response.json();
+      const data = apiResponse.data;
+      const tokens = data && typeof data === "object" && "data" in data ? data.data : data;
+      if (tokens?.accessToken && tokens?.refreshToken) {
+        updateStoredTokens(tokens.accessToken, tokens.refreshToken);
+        onTokenRefreshed(tokens.accessToken);
+        return true;
+      }
+    }
+  } catch (error) {
+    config2.onAuthError?.(error instanceof Error ? error : new Error("Token refresh failed"));
+  }
+  return false;
+}
+function extractData(response) {
+  if (response && typeof response === "object" && "data" in response) {
+    const dataField = response.data;
+    if (dataField && typeof dataField === "object" && "data" in dataField) {
+      return dataField.data;
+    }
+    if (dataField !== void 0) {
+      return dataField;
+    }
+  }
+  return response;
+}
+async function apiRequest(endpoint, options = {}) {
+  const { authenticated = false, customFetch, body, ...fetchOptions } = options;
+  const config2 = getConfig();
+  const fetchFn = customFetch ?? getFetch();
+  const url = endpoint.startsWith("http") ? endpoint : `${config2.baseUrl}${endpoint}`;
+  const headers = {
+    "Content-Type": "application/json",
+    ...fetchOptions.headers
+  };
+  if (authenticated) {
+    const accessToken = getAccessToken();
+    const sessionToken = getSessionToken();
+    if (accessToken) {
+      headers["Authorization"] = `Bearer ${accessToken}`;
+    }
+    if (sessionToken) {
+      headers["X-Session-Token"] = sessionToken;
+    }
+  }
+  try {
+    const response = await fetchFn(url, {
+      ...fetchOptions,
+      headers,
+      body: body ? JSON.stringify(body) : void 0
+    });
+    if (response.status === 401 && authenticated && typeof window !== "undefined") {
+      if (!isRefreshing) {
+        isRefreshing = true;
+        const refreshed = await refreshAccessToken();
+        isRefreshing = false;
+        if (refreshed) {
+          return apiRequest(endpoint, options);
+        } else {
+          clearStoredAuth();
+          config2.onLogout?.();
+          throw new Error("Authentication failed. Please sign in again.");
+        }
+      } else {
+        return new Promise((resolve, reject) => {
+          subscribeTokenRefresh(() => {
+            apiRequest(endpoint, options).then(resolve).catch(reject);
+          });
+        });
+      }
+    }
+    const data = await response.json();
+    if (!response.ok) {
+      const dataObj = data;
+      const errorMessage = data.error?.message || (typeof dataObj.message === "string" ? dataObj.message : void 0) || data.meta?.message || (typeof dataObj.detail === "string" ? dataObj.detail : void 0) || "Request failed";
+      const error = new Error(errorMessage);
+      config2.onAuthError?.(error);
+      throw error;
+    }
+    return data;
+  } catch (error) {
+    if (error instanceof Error) {
+      throw error;
+    }
+    throw new Error("API request failed");
+  }
+}
+var api = {
+  get: (endpoint, authenticated = false, customFetch) => apiRequest(endpoint, { method: "GET", authenticated, customFetch }),
+  post: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "POST",
+    body,
+    authenticated,
+    customFetch
+  }),
+  put: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "PUT",
+    body,
+    authenticated,
+    customFetch
+  }),
+  patch: (endpoint, body, authenticated = false, customFetch) => apiRequest(endpoint, {
+    method: "PATCH",
+    body,
+    authenticated,
+    customFetch
+  }),
+  delete: (endpoint, authenticated = false, customFetch, body) => apiRequest(endpoint, {
+    method: "DELETE",
+    body,
+    authenticated,
+    customFetch
+  })
+};
+
+// src/core/api.ts
+var authApi = {
+  // ============================================================================
+  // Authentication
+  // ============================================================================
+  /**
+   * Login with username and password.
+   */
+  async login(credentials) {
+    const response = await api.post("/auth/login", credentials);
+    return extractData(response);
+  },
+  /**
+   * Logout the current user.
+   */
+  async logout() {
+    await api.post("/auth/logout", {}, true);
+  },
+  /**
+   * Register a new user.
+   */
+  async register(data) {
+    const response = await api.post("/auth/register", data);
+    return extractData(response);
+  },
+  /**
+   * Request a password reset email.
+   */
+  async forgotPassword(email) {
+    await api.post("/auth/forgot-password", { email });
+  },
+  /**
+   * Reset password with a token.
+   */
+  async resetPassword(token, newPassword) {
+    await api.post("/auth/reset-password", { token, newPassword });
+  },
+  /**
+   * Refresh the access token.
+   */
+  async refreshToken(refreshToken) {
+    const response = await api.post("/auth/refresh", { refreshToken });
+    return extractData(response);
+  },
+  /**
+   * Initiate SSO login by redirecting to the SSO provider.
+   */
+  initiateSSOLogin() {
+    if (typeof window === "undefined") return;
+    const config2 = getConfig();
+    const authorizeUrl = config2.sso?.authorizeUrl ?? `${config2.baseUrl}/auth/sso/authorize`;
+    window.location.href = authorizeUrl;
+  },
+  // ============================================================================
+  // Profile
+  // ============================================================================
+  /**
+   * Get the current user's profile.
+   */
+  async getProfile(customFetch) {
+    const response = await api.get("/auth/profile", true, customFetch);
+    return response;
+  },
+  /**
+   * Update the current user's profile.
+   */
+  async updateProfile(data) {
+    const response = await api.put("/auth/profile", data, true);
+    return extractData(response);
+  },
+  /**
+   * Change the current user's password.
+   */
+  async changePassword(data) {
+    await api.put("/auth/change-password", data, true);
+  },
+  // ============================================================================
+  // Email Verification
+  // ============================================================================
+  /**
+   * Resend email verification.
+   */
+  async resendVerification() {
+    await api.post("/auth/resend-verification", {}, true);
+  },
+  /**
+   * Verify email with a token.
+   */
+  async verifyEmail(token) {
+    const response = await api.post("/auth/verify-email", {
+      token
+    });
+    return extractData(response);
+  },
+  // ============================================================================
+  // Session Management
+  // ============================================================================
+  /**
+   * Get all active sessions.
+   */
+  async getSessions(customFetch) {
+    const response = await api.get(
+      "/auth/sessions",
+      true,
+      customFetch
+    );
+    return response;
+  },
+  /**
+   * Revoke a specific session.
+   */
+  async revokeSession(sessionId) {
+    await api.delete(`/auth/sessions/${sessionId}`, true);
+  },
+  /**
+   * Revoke all sessions except the current one.
+   */
+  async revokeAllSessions() {
+    await api.delete("/auth/sessions", true);
+  },
+  // ============================================================================
+  // API Key Management
+  // ============================================================================
+  /**
+   * Get all API keys.
+   */
+  async getApiKeys(customFetch) {
+    const response = await api.get("/auth/api-keys", true, customFetch);
+    return response;
+  },
+  /**
+   * Create a new API key.
+   */
+  async createApiKey(data) {
+    const response = await api.post("/auth/api-keys", data, true);
+    return extractData(response);
+  },
+  /**
+   * Revoke an API key.
+   */
+  async revokeApiKey(keyId) {
+    await api.delete(`/auth/api-keys/${keyId}`, true);
+  },
+  /**
+   * Update an API key's name.
+   */
+  async updateApiKey(keyId, data) {
+    await api.put(`/auth/api-keys/${keyId}`, data, true);
+  },
+  // ============================================================================
+  // MFA Management
+  // ============================================================================
+  /**
+   * Get MFA status for the current user.
+   */
+  async getMFAStatus() {
+    const response = await api.get("/auth/mfa/status", true);
+    return response;
+  },
+  /**
+   * Setup MFA (get QR code and backup codes).
+   */
+  async setupMFA() {
+    const response = await api.post("/auth/mfa-setup", {}, true);
+    return extractData(response);
+  },
+  /**
+   * Verify MFA setup with a code.
+   */
+  async verifyMFASetup(code) {
+    await api.post("/auth/mfa/verify", { code }, true);
+  },
+  /**
+   * Disable MFA.
+   */
+  async disableMFA(password) {
+    await api.delete("/auth/mfa", true, void 0, { password });
+  },
+  /**
+   * Regenerate MFA backup codes.
+   */
+  async regenerateBackupCodes(password) {
+    const response = await api.post(
+      "/auth/mfa/regenerate-backup-codes",
+      { password },
+      true
+    );
+    return extractData(response);
+  },
+  /**
+   * Verify MFA challenge during login.
+   */
+  async verifyMFAChallenge(data) {
+    const config2 = getConfig();
+    const fetchFn = config2.fetch ?? fetch;
+    const requestBody = {
+      code: data.code,
+      type: data.method === "backup" ? "backup" : "totp",
+      trustDevice: data.trustDevice
+    };
+    const response = await fetchFn(`${config2.baseUrl}/auth/mfa/challenge`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${data.mfaToken}`
+      },
+      body: JSON.stringify(requestBody)
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: "Verification failed" }));
+      throw new Error(error.error?.message || error.message || "Invalid verification code");
+    }
+    const result = await response.json();
+    return extractData(result);
+  },
+  // ============================================================================
+  // Device Management
+  // ============================================================================
+  /**
+   * Get all devices.
+   */
+  async getDevices(customFetch) {
+    const response = await api.get(
+      "/auth/devices",
+      true,
+      customFetch
+    );
+    return response;
+  },
+  /**
+   * Trust a device.
+   */
+  async trustDevice(deviceId) {
+    await api.put(`/auth/devices/${deviceId}/trust`, {}, true);
+  },
+  /**
+   * Revoke device trust.
+   */
+  async revokeDevice(deviceId) {
+    await api.delete(`/auth/devices/${deviceId}/revoke`, true);
+  },
+  /**
+   * Remove a device completely.
+   */
+  async removeDevice(deviceId) {
+    await api.delete(`/auth/devices/${deviceId}`, true);
+  },
+  /**
+   * Approve a device with a token.
+   */
+  async approveDevice(token) {
+    const response = await api.post("/auth/device/approve", {
+      token
+    });
+    return extractData(response);
+  },
+  /**
+   * Block a device with a token.
+   */
+  async blockDevice(token) {
+    const response = await api.post("/auth/device/block", {
+      token
+    });
+    return extractData(response);
+  },
+  // ============================================================================
+  // Preferences
+  // ============================================================================
+  /**
+   * Get user preferences.
+   */
+  async getPreferences(customFetch) {
+    const response = await api.get(
+      "/auth/preferences",
+      true,
+      customFetch
+    );
+    if (response && typeof response === "object" && "preferences" in response) {
+      return response.preferences;
+    }
+    return response ?? {};
+  },
+  /**
+   * Update user preferences.
+   */
+  async updatePreferences(data) {
+    await api.put("/auth/preferences", data, true);
+  },
+  // ============================================================================
+  // SSO / Linked Accounts
+  // ============================================================================
+  /**
+   * Get SSO linked accounts.
+   */
+  async getSSOAccounts(customFetch) {
+    const response = await api.get(
+      "/auth/sso/accounts",
+      true,
+      customFetch
+    );
+    if (response && typeof response === "object" && "accounts" in response) {
+      return response.accounts;
+    }
+    return Array.isArray(response) ? response : [];
+  },
+  /**
+   * Unlink an SSO account.
+   */
+  async unlinkSSOAccount(provider, password) {
+    await api.delete("/auth/sso/unlink", true, void 0, { provider, password });
+  },
+  /**
+   * Link an SSO account (redirects to SSO provider).
+   */
+  async linkSSOAccount(provider = "authentik") {
+    if (typeof window === "undefined") return;
+    const accessToken = getAccessToken();
+    if (!accessToken) {
+      throw new Error("Not authenticated");
+    }
+    const config2 = getConfig();
+    const params = new URLSearchParams({
+      token: accessToken,
+      provider
+    });
+    window.location.href = `${config2.baseUrl}/auth/sso/link?${params.toString()}`;
+  },
+  // ============================================================================
+  // Security Events
+  // ============================================================================
+  /**
+   * Get security event history.
+   */
+  async getSecurityEvents(params, customFetch) {
+    const queryParams = new URLSearchParams();
+    if (params?.page) queryParams.append("page", params.page.toString());
+    if (params?.limit) queryParams.append("limit", params.limit.toString());
+    if (params?.type) queryParams.append("type", params.type);
+    const response = await api.get(`/auth/security/events?${queryParams.toString()}`, true, customFetch);
+    return extractData(response);
+  }
+};
+
+// src/core/service.ts
+var AuthService = class {
+  // ============================================================================
+  // Authentication
+  // ============================================================================
+  /**
+   * Login with username and password.
+   */
+  async login(credentials) {
+    return await authApi.login(credentials);
+  }
+  /**
+   * Logout the current user.
+   */
+  async logout() {
+    await authApi.logout();
+  }
+  /**
+   * Register a new user.
+   */
+  async register(data) {
+    return await authApi.register(data);
+  }
+  /**
+   * Request a password reset email.
+   */
+  async forgotPassword(email) {
+    await authApi.forgotPassword(email);
+  }
+  /**
+   * Reset password with a token.
+   */
+  async resetPassword(token, newPassword) {
+    await authApi.resetPassword(token, newPassword);
+  }
+  /**
+   * Change the current user's password.
+   */
+  async changePassword(currentPassword, newPassword) {
+    await authApi.changePassword({ currentPassword, newPassword });
+  }
+  /**
+   * Refresh the access token.
+   */
+  async refreshToken(refreshToken) {
+    return await authApi.refreshToken(refreshToken);
+  }
+  /**
+   * Initiate SSO login (redirects to SSO provider).
+   */
+  initiateSSOLogin() {
+    authApi.initiateSSOLogin();
+  }
+  // ============================================================================
+  // Profile
+  // ============================================================================
+  /**
+   * Get the current user's profile.
+   */
+  async getProfile(customFetch) {
+    return await authApi.getProfile(customFetch);
+  }
+  /**
+   * Update the current user's profile.
+   */
+  async updateProfile(data) {
+    return await authApi.updateProfile(data);
+  }
+  /**
+   * Resend email verification.
+   */
+  async resendVerification() {
+    await authApi.resendVerification();
+  }
+  /**
+   * Verify email with a token.
+   */
+  async verifyEmail(token) {
+    return await authApi.verifyEmail(token);
+  }
+  // ============================================================================
+  // Session Management
+  // ============================================================================
+  /**
+   * Get all active sessions.
+   */
+  async getSessions(customFetch) {
+    return await authApi.getSessions(customFetch);
+  }
+  /**
+   * Revoke a specific session.
+   */
+  async revokeSession(sessionId) {
+    await authApi.revokeSession(sessionId);
+  }
+  /**
+   * Revoke all sessions except the current one.
+   */
+  async revokeAllSessions() {
+    await authApi.revokeAllSessions();
+  }
+  // ============================================================================
+  // API Key Management
+  // ============================================================================
+  /**
+   * Get all API keys.
+   */
+  async getApiKeys(customFetch) {
+    return await authApi.getApiKeys(customFetch);
+  }
+  /**
+   * Create a new API key.
+   */
+  async createApiKey(data) {
+    return await authApi.createApiKey(data);
+  }
+  /**
+   * Revoke an API key.
+   */
+  async revokeApiKey(keyId) {
+    await authApi.revokeApiKey(keyId);
+  }
+  /**
+   * Update an API key's name.
+   */
+  async updateApiKey(keyId, name) {
+    await authApi.updateApiKey(keyId, { name });
+  }
+  // ============================================================================
+  // MFA Management
+  // ============================================================================
+  /**
+   * Get MFA status for the current user.
+   */
+  async getMFAStatus() {
+    return await authApi.getMFAStatus();
+  }
+  /**
+   * Setup MFA (get QR code and backup codes).
+   */
+  async setupMFA() {
+    return await authApi.setupMFA();
+  }
+  /**
+   * Verify MFA setup with a code.
+   */
+  async verifyMFASetup(code) {
+    await authApi.verifyMFASetup(code);
+  }
+  /**
+   * Disable MFA.
+   */
+  async disableMFA(password) {
+    await authApi.disableMFA(password);
+  }
+  /**
+   * Regenerate MFA backup codes.
+   */
+  async regenerateBackupCodes(password) {
+    return await authApi.regenerateBackupCodes(password);
+  }
+  /**
+   * Verify MFA challenge during login.
+   */
+  async verifyMFAChallenge(data) {
+    return await authApi.verifyMFAChallenge(data);
+  }
+  // ============================================================================
+  // Device Management
+  // ============================================================================
+  /**
+   * Get all devices.
+   */
+  async getDevices(customFetch) {
+    return await authApi.getDevices(customFetch);
+  }
+  /**
+   * Trust a device.
+   */
+  async trustDevice(deviceId) {
+    await authApi.trustDevice(deviceId);
+  }
+  /**
+   * Revoke device trust.
+   */
+  async revokeDevice(deviceId) {
+    await authApi.revokeDevice(deviceId);
+  }
+  /**
+   * Remove a device completely.
+   */
+  async removeDevice(deviceId) {
+    await authApi.removeDevice(deviceId);
+  }
+  /**
+   * Approve a device with a token.
+   */
+  async approveDevice(token) {
+    return await authApi.approveDevice(token);
+  }
+  /**
+   * Block a device with a token.
+   */
+  async blockDevice(token) {
+    return await authApi.blockDevice(token);
+  }
+  // ============================================================================
+  // Preferences
+  // ============================================================================
+  /**
+   * Get user preferences.
+   */
+  async getPreferences(customFetch) {
+    return await authApi.getPreferences(customFetch);
+  }
+  /**
+   * Update user preferences.
+   */
+  async updatePreferences(data) {
+    await authApi.updatePreferences(data);
+  }
+  // ============================================================================
+  // SSO / Linked Accounts
+  // ============================================================================
+  /**
+   * Get SSO linked accounts.
+   */
+  async getLinkedAccounts(customFetch) {
+    return await authApi.getSSOAccounts(customFetch);
+  }
+  /**
+   * Link an SSO account (redirects to SSO provider).
+   */
+  async linkAccount(provider = "authentik") {
+    await authApi.linkSSOAccount(provider);
+  }
+  /**
+   * Unlink an SSO account.
+   */
+  async unlinkAccount(provider, password) {
+    await authApi.unlinkSSOAccount(provider, password);
+  }
+  // ============================================================================
+  // Security Events
+  // ============================================================================
+  /**
+   * Get security event history.
+   */
+  async getSecurityEvents(params, customFetch) {
+    return await authApi.getSecurityEvents(params, customFetch);
+  }
+};
+var authService = new AuthService();
+
+// src/core/jwt.ts
+function decodeJWT(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const payload = parts[1];
+    const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+function isTokenExpired(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return true;
+  }
+  return payload.exp * 1e3 < Date.now();
+}
+function getTokenRemainingTime(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return 0;
+  }
+  const remainingMs = payload.exp * 1e3 - Date.now();
+  return Math.max(0, remainingMs);
+}
+function getTokenExpiration(token) {
+  const payload = decodeJWT(token);
+  if (!payload || !payload.exp) {
+    return null;
+  }
+  return new Date(payload.exp * 1e3);
+}
+function extractClaims(token, claims) {
+  const payload = decodeJWT(token);
+  if (!payload) {
+    return null;
+  }
+  const result = {};
+  for (const claim of claims) {
+    if (claim in payload) {
+      result[claim] = payload[claim];
+    }
+  }
+  return result;
+}
+
+export { AuthService, api, apiRequest, authApi, authService, clearStoredAuth, decodeJWT, extractClaims, extractData, getAccessToken, getConfig, getDefaultStorage, getFetch, getRefreshToken, getSessionToken, getStorage, getTokenExpiration, getTokenRemainingTime, initAuth, isInitialized, isTokenExpired, resetConfig, updateStoredTokens };