@classic-homes/auth 0.1.0

package/dist/svelte/index.d.ts

@@ -0,0 +1,212 @@
+import { A as AuthState, U as User } from '../types-exFUQyBX.js';
+
+/**
+ * Auth Store
+ *
+ * Authentication state management.
+ * Uses a simple observable pattern that works with Svelte's reactivity.
+ *
+ * Note: This store is designed to work with Svelte 5 runes in components.
+ * The store itself doesn't use runes to avoid build complexity.
+ */
+
+type Subscriber<T> = (value: T) => void;
+type Unsubscriber = () => void;
+declare class AuthStore {
+    private state;
+    private subscribers;
+    constructor();
+    /**
+     * Subscribe to state changes (Svelte store contract).
+     */
+    subscribe(subscriber: Subscriber<AuthState>): Unsubscriber;
+    private notify;
+    get accessToken(): string | null;
+    get refreshToken(): string | null;
+    get user(): User | null;
+    get isAuthenticated(): boolean;
+    /**
+     * Get the current auth state snapshot.
+     */
+    getState(): AuthState;
+    /**
+     * Set auth data after successful login.
+     */
+    setAuth(accessToken: string, refreshToken: string, user: User, sessionToken?: string): void;
+    /**
+     * Update tokens (e.g., after refresh).
+     */
+    updateTokens(accessToken: string, refreshToken: string): void;
+    /**
+     * Update user data (e.g., after profile update).
+     */
+    updateUser(user: User): void;
+    /**
+     * Clear auth state (logout).
+     */
+    logout(): void;
+    /**
+     * Check if user has a specific permission.
+     */
+    hasPermission(permission: string): boolean;
+    /**
+     * Check if user has a specific role.
+     */
+    hasRole(role: string): boolean;
+    /**
+     * Check if user has any of the specified roles.
+     */
+    hasAnyRole(roles: string[]): boolean;
+    /**
+     * Check if user has all of the specified roles.
+     */
+    hasAllRoles(roles: string[]): boolean;
+    /**
+     * Check if user has any of the specified permissions.
+     */
+    hasAnyPermission(permissions: string[]): boolean;
+    /**
+     * Check if user has all of the specified permissions.
+     */
+    hasAllPermissions(permissions: string[]): boolean;
+    /**
+     * Re-hydrate state from storage (useful after config changes).
+     */
+    rehydrate(): void;
+}
+/** Singleton auth store instance */
+declare const authStore: AuthStore;
+/**
+ * Auth actions for modifying auth state.
+ * Provides a stable reference for use in callbacks.
+ */
+declare const authActions: {
+    setAuth: (accessToken: string, refreshToken: string, user: User, sessionToken?: string) => void;
+    updateTokens: (accessToken: string, refreshToken: string) => void;
+    updateUser: (user: User) => void;
+    logout: () => void;
+    hasPermission: (permission: string) => boolean;
+    hasRole: (role: string) => boolean;
+    hasAnyRole: (roles: string[]) => boolean;
+    hasAllRoles: (roles: string[]) => boolean;
+    hasAnyPermission: (permissions: string[]) => boolean;
+    hasAllPermissions: (permissions: string[]) => boolean;
+    rehydrate: () => void;
+};
+/**
+ * Derived stores for common auth values.
+ * These follow the Svelte store contract for use with $store syntax.
+ */
+declare const isAuthenticated: {
+    subscribe: (subscriber: Subscriber<boolean>) => Unsubscriber;
+};
+declare const currentUser: {
+    subscribe: (subscriber: Subscriber<User | null>) => Unsubscriber;
+};
+
+/**
+ * Auth Guards
+ *
+ * Route protection utilities for SvelteKit applications.
+ */
+/**
+ * Options for auth guard checks.
+ */
+interface AuthGuardOptions {
+    /** Required roles (user must have at least one) */
+    roles?: string[];
+    /** Required permissions (user must have at least one) */
+    permissions?: string[];
+    /** Require all specified roles (default: false, any role matches) */
+    requireAllRoles?: boolean;
+    /** Require all specified permissions (default: false, any permission matches) */
+    requireAllPermissions?: boolean;
+}
+/**
+ * Result of an auth guard check.
+ */
+interface AuthGuardResult {
+    /** Whether the user is allowed */
+    allowed: boolean;
+    /** Reason for denial (if not allowed) */
+    reason?: 'not_authenticated' | 'missing_role' | 'missing_permission';
+    /** Redirect URL suggestion */
+    redirectTo?: string;
+}
+/**
+ * Check if the current user passes the auth guard.
+ *
+ * @example
+ * ```typescript
+ * // In a +page.ts load function
+ * import { checkAuth } from '@classic-homes/auth/svelte';
+ * import { redirect } from '@sveltejs/kit';
+ *
+ * export function load() {
+ *   const result = checkAuth({ roles: ['admin'] });
+ *   if (!result.allowed) {
+ *     throw redirect(302, result.redirectTo ?? '/login');
+ *   }
+ * }
+ * ```
+ */
+declare function checkAuth(options?: AuthGuardOptions): AuthGuardResult;
+/**
+ * Create a guard function for use in SvelteKit load functions.
+ *
+ * @example
+ * ```typescript
+ * // In a +page.ts
+ * import { createAuthGuard } from '@classic-homes/auth/svelte';
+ * import { redirect } from '@sveltejs/kit';
+ *
+ * const requireAdmin = createAuthGuard({ roles: ['admin'] });
+ *
+ * export function load() {
+ *   requireAdmin((redirectTo) => {
+ *     throw redirect(302, redirectTo);
+ *   });
+ *   // Continue with protected logic
+ * }
+ * ```
+ */
+declare function createAuthGuard(options?: AuthGuardOptions): (onDenied: (redirectTo: string, reason: string) => void) => boolean;
+/**
+ * Simple authentication check (just checks if authenticated).
+ */
+declare function requireAuth(): AuthGuardResult;
+/**
+ * Check if user has specific role(s).
+ */
+declare function requireRole(roles: string | string[], requireAll?: boolean): AuthGuardResult;
+/**
+ * Check if user has specific permission(s).
+ */
+declare function requirePermission(permissions: string | string[], requireAll?: boolean): AuthGuardResult;
+/**
+ * Utility to protect a load function.
+ *
+ * @example
+ * ```typescript
+ * // In +page.ts
+ * import { protectedLoad } from '@classic-homes/auth/svelte';
+ *
+ * export const load = protectedLoad(
+ *   { roles: ['admin'] },
+ *   async ({ fetch }) => {
+ *     // This only runs if auth check passes
+ *     const data = await fetch('/api/admin/data');
+ *     return { data };
+ *   }
+ * );
+ * ```
+ */
+declare function protectedLoad<T>(options: AuthGuardOptions, loadFn: (event: {
+    fetch: typeof fetch;
+}) => Promise<T>): (event: {
+    fetch: typeof fetch;
+}) => Promise<T | {
+    redirect: string;
+}>;
+
+export { type AuthGuardOptions, type AuthGuardResult, AuthState, User, authActions, authStore, checkAuth, createAuthGuard, currentUser, isAuthenticated, protectedLoad, requireAuth, requirePermission, requireRole };

package/dist/svelte/index.js

@@ -0,0 +1,341 @@
+// src/core/config.ts
+function getDefaultStorage() {
+  if (typeof window !== "undefined" && window.localStorage) {
+    return {
+      getItem: (key) => localStorage.getItem(key),
+      setItem: (key, value) => localStorage.setItem(key, value),
+      removeItem: (key) => localStorage.removeItem(key)
+    };
+  }
+  return {
+    getItem: () => null,
+    setItem: () => {
+    },
+    removeItem: () => {
+    }
+  };
+}
+
+// src/core/jwt.ts
+function decodeJWT(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      return null;
+    }
+    const payload = parts[1];
+    const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    return JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+}
+
+// src/svelte/stores/auth.svelte.ts
+function getStorageKey() {
+  return "classic_auth";
+}
+function getStorageAdapter() {
+  return getDefaultStorage();
+}
+function loadAuthFromStorage() {
+  try {
+    const storage = getStorageAdapter();
+    const data = storage.getItem(getStorageKey());
+    if (!data) {
+      return {
+        accessToken: null,
+        refreshToken: null,
+        user: null,
+        isAuthenticated: false
+      };
+    }
+    const parsed = JSON.parse(data);
+    return {
+      accessToken: parsed.accessToken ?? null,
+      refreshToken: parsed.refreshToken ?? null,
+      user: parsed.user ?? null,
+      isAuthenticated: !!parsed.accessToken && !!parsed.user
+    };
+  } catch {
+    return {
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      isAuthenticated: false
+    };
+  }
+}
+function saveAuthToStorage(state) {
+  try {
+    const storage = getStorageAdapter();
+    const key = getStorageKey();
+    if (!state.accessToken) {
+      storage.removeItem(key);
+    } else {
+      storage.setItem(key, JSON.stringify(state));
+    }
+  } catch {
+  }
+}
+var AuthStore = class {
+  constructor() {
+    this.subscribers = /* @__PURE__ */ new Set();
+    this.state = loadAuthFromStorage();
+  }
+  /**
+   * Subscribe to state changes (Svelte store contract).
+   */
+  subscribe(subscriber) {
+    this.subscribers.add(subscriber);
+    subscriber(this.state);
+    return () => this.subscribers.delete(subscriber);
+  }
+  notify() {
+    this.subscribers.forEach((sub) => sub(this.state));
+  }
+  // Getters for direct access
+  get accessToken() {
+    return this.state.accessToken;
+  }
+  get refreshToken() {
+    return this.state.refreshToken;
+  }
+  get user() {
+    return this.state.user;
+  }
+  get isAuthenticated() {
+    return this.state.isAuthenticated;
+  }
+  /**
+   * Get the current auth state snapshot.
+   */
+  getState() {
+    return { ...this.state };
+  }
+  /**
+   * Set auth data after successful login.
+   */
+  setAuth(accessToken, refreshToken, user, sessionToken) {
+    const jwtPayload = decodeJWT(accessToken);
+    const userWithPermissions = {
+      ...user,
+      permissions: user.permissions || jwtPayload?.permissions || [],
+      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+    };
+    this.state = {
+      accessToken,
+      refreshToken,
+      user: userWithPermissions,
+      isAuthenticated: true
+    };
+    saveAuthToStorage(this.state);
+    if (sessionToken && typeof window !== "undefined") {
+      getStorageAdapter().setItem("sessionToken", sessionToken);
+    }
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(
+        new CustomEvent("auth:login", {
+          detail: { user: userWithPermissions }
+        })
+      );
+    }
+    this.notify();
+  }
+  /**
+   * Update tokens (e.g., after refresh).
+   */
+  updateTokens(accessToken, refreshToken) {
+    const jwtPayload = decodeJWT(accessToken);
+    const updatedUser = this.state.user ? {
+      ...this.state.user,
+      permissions: jwtPayload?.permissions || this.state.user.permissions || [],
+      roles: jwtPayload?.roles || this.state.user.roles || (this.state.user.role ? [this.state.user.role] : [])
+    } : null;
+    this.state = {
+      ...this.state,
+      accessToken,
+      refreshToken,
+      user: updatedUser
+    };
+    saveAuthToStorage(this.state);
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent("auth:token-refresh"));
+    }
+    this.notify();
+  }
+  /**
+   * Update user data (e.g., after profile update).
+   */
+  updateUser(user) {
+    const jwtPayload = this.state.accessToken ? decodeJWT(this.state.accessToken) : null;
+    const updatedUser = {
+      ...user,
+      permissions: user.permissions || jwtPayload?.permissions || [],
+      roles: user.roles || jwtPayload?.roles || (user.role ? [user.role] : [])
+    };
+    this.state = {
+      ...this.state,
+      user: updatedUser
+    };
+    saveAuthToStorage(this.state);
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(
+        new CustomEvent("auth:profile-update", {
+          detail: { user: updatedUser }
+        })
+      );
+    }
+    this.notify();
+  }
+  /**
+   * Clear auth state (logout).
+   */
+  logout() {
+    this.state = {
+      accessToken: null,
+      refreshToken: null,
+      user: null,
+      isAuthenticated: false
+    };
+    const storage = getStorageAdapter();
+    storage.removeItem(getStorageKey());
+    storage.removeItem("sessionToken");
+    if (typeof window !== "undefined") {
+      window.dispatchEvent(new CustomEvent("auth:logout"));
+    }
+    this.notify();
+  }
+  /**
+   * Check if user has a specific permission.
+   */
+  hasPermission(permission) {
+    return this.state.user?.permissions?.includes(permission) ?? false;
+  }
+  /**
+   * Check if user has a specific role.
+   */
+  hasRole(role) {
+    return this.state.user?.roles?.includes(role) ?? false;
+  }
+  /**
+   * Check if user has any of the specified roles.
+   */
+  hasAnyRole(roles) {
+    return roles.some((role) => this.state.user?.roles?.includes(role)) ?? false;
+  }
+  /**
+   * Check if user has all of the specified roles.
+   */
+  hasAllRoles(roles) {
+    return roles.every((role) => this.state.user?.roles?.includes(role)) ?? false;
+  }
+  /**
+   * Check if user has any of the specified permissions.
+   */
+  hasAnyPermission(permissions) {
+    return permissions.some((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+  }
+  /**
+   * Check if user has all of the specified permissions.
+   */
+  hasAllPermissions(permissions) {
+    return permissions.every((perm) => this.state.user?.permissions?.includes(perm)) ?? false;
+  }
+  /**
+   * Re-hydrate state from storage (useful after config changes).
+   */
+  rehydrate() {
+    this.state = loadAuthFromStorage();
+    this.notify();
+  }
+};
+var authStore = new AuthStore();
+var authActions = {
+  setAuth: (accessToken, refreshToken, user, sessionToken) => authStore.setAuth(accessToken, refreshToken, user, sessionToken),
+  updateTokens: (accessToken, refreshToken) => authStore.updateTokens(accessToken, refreshToken),
+  updateUser: (user) => authStore.updateUser(user),
+  logout: () => authStore.logout(),
+  hasPermission: (permission) => authStore.hasPermission(permission),
+  hasRole: (role) => authStore.hasRole(role),
+  hasAnyRole: (roles) => authStore.hasAnyRole(roles),
+  hasAllRoles: (roles) => authStore.hasAllRoles(roles),
+  hasAnyPermission: (permissions) => authStore.hasAnyPermission(permissions),
+  hasAllPermissions: (permissions) => authStore.hasAllPermissions(permissions),
+  rehydrate: () => authStore.rehydrate()
+};
+var isAuthenticated = {
+  subscribe: (subscriber) => {
+    return authStore.subscribe((state) => subscriber(state.isAuthenticated));
+  }
+};
+var currentUser = {
+  subscribe: (subscriber) => {
+    return authStore.subscribe((state) => subscriber(state.user));
+  }
+};
+
+// src/svelte/guards/auth-guard.ts
+function checkAuth(options = {}) {
+  const { roles, permissions, requireAllRoles, requireAllPermissions } = options;
+  if (!authStore.isAuthenticated) {
+    return {
+      allowed: false,
+      reason: "not_authenticated",
+      redirectTo: "/login"
+    };
+  }
+  if (roles && roles.length > 0) {
+    const hasRoles = requireAllRoles ? authStore.hasAllRoles(roles) : authStore.hasAnyRole(roles);
+    if (!hasRoles) {
+      return {
+        allowed: false,
+        reason: "missing_role",
+        redirectTo: "/unauthorized"
+      };
+    }
+  }
+  if (permissions && permissions.length > 0) {
+    const hasPermissions = requireAllPermissions ? authStore.hasAllPermissions(permissions) : authStore.hasAnyPermission(permissions);
+    if (!hasPermissions) {
+      return {
+        allowed: false,
+        reason: "missing_permission",
+        redirectTo: "/unauthorized"
+      };
+    }
+  }
+  return { allowed: true };
+}
+function createAuthGuard(options = {}) {
+  return (onDenied) => {
+    const result = checkAuth(options);
+    if (!result.allowed) {
+      onDenied(result.redirectTo ?? "/login", result.reason ?? "not_authenticated");
+      return false;
+    }
+    return true;
+  };
+}
+function requireAuth() {
+  return checkAuth();
+}
+function requireRole(roles, requireAll = false) {
+  const roleArray = Array.isArray(roles) ? roles : [roles];
+  return checkAuth({ roles: roleArray, requireAllRoles: requireAll });
+}
+function requirePermission(permissions, requireAll = false) {
+  const permArray = Array.isArray(permissions) ? permissions : [permissions];
+  return checkAuth({ permissions: permArray, requireAllPermissions: requireAll });
+}
+function protectedLoad(options, loadFn) {
+  return async (event) => {
+    const result = checkAuth(options);
+    if (!result.allowed) {
+      return { redirect: result.redirectTo ?? "/login" };
+    }
+    return loadFn(event);
+  };
+}
+
+export { authActions, authStore, checkAuth, createAuthGuard, currentUser, isAuthenticated, protectedLoad, requireAuth, requirePermission, requireRole };