@cleverclouds/auth-client 0.0.0-stage → 1.0.0

package/dist/nextjs/types.d.ts

@@ -0,0 +1,51 @@
+export interface NextAuthOptions {
+    /**
+     * Name of the cookie storing the session token.
+     * Default: 'cc_session'
+     */
+    cookieName?: string;
+    /**
+     * Cookie store instance (e.g. from `await cookies()` or `request.cookies`).
+     */
+    cookieStore?: {
+        get(name: string): {
+            value?: string;
+        } | undefined;
+    };
+    /**
+     * Next.js Request object or standard Web API Request.
+     */
+    request?: Request | {
+        headers: Headers | Record<string, string>;
+        cookies?: {
+            get(name: string): {
+                value?: string;
+            } | undefined;
+        };
+    };
+}
+export interface ProtectRouteOptions extends NextAuthOptions {
+    /**
+     * Optional application-scoped permission(s) required to access this route.
+     */
+    permission?: string | string[];
+    /**
+     * If true, requires all listed permissions. If false, requires at least one.
+     * Default: true
+     */
+    requireAllPermissions?: boolean;
+    /**
+     * Optional role(s) required to access this route.
+     */
+    role?: string | string[];
+    /**
+     * If true, redirects browser navigation requests to the Identity login page.
+     * Default: false for API routes, true when redirectUrl is provided.
+     */
+    redirectOnUnauthorized?: boolean;
+    /**
+     * URL to return the user to after successful login.
+     */
+    returnTo?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/nextjs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/nextjs/types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,WAAW,CAAC,EAAE;QACZ,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;KACnD,CAAC;IAEF;;OAEG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG;QAClB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;gBAAE,KAAK,CAAC,EAAE,MAAM,CAAA;aAAE,GAAG,SAAS,CAAA;SAAE,CAAC;KACjE,CAAC;CACH;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE/B;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAEhC;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/nextjs/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/nextjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/nextjs/types.ts"],"names":[],"mappings":""}

package/dist/permissions.d.ts

@@ -0,0 +1,25 @@
+/**
+ * RBAC Evaluation Helpers
+ */
+/**
+ * Checks if the granted permissions satisfy a required permission.
+ * Supports exact matches (e.g. "projects.create") and resource wildcards (e.g. "projects.*").
+ */
+export declare function hasPermission(permissions: string[], required: string): boolean;
+/**
+ * Checks if granted permissions satisfy AT LEAST ONE of the required permissions.
+ */
+export declare function hasAnyPermission(permissions: string[], requiredList: string[]): boolean;
+/**
+ * Checks if granted permissions satisfy ALL of the required permissions.
+ */
+export declare function hasAllPermissions(permissions: string[], requiredList: string[]): boolean;
+/**
+ * Checks if granted roles include a specific role slug.
+ */
+export declare function hasRole(roles: string[], roleSlug: string): boolean;
+/**
+ * Checks if granted roles include at least one of the role slugs.
+ */
+export declare function hasAnyRole(roles: string[], roleSlugs: string[]): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgB9E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAGvF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAGxF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKlE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAGxE"}

package/dist/permissions.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * RBAC Evaluation Helpers
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasPermission = hasPermission;
+exports.hasAnyPermission = hasAnyPermission;
+exports.hasAllPermissions = hasAllPermissions;
+exports.hasRole = hasRole;
+exports.hasAnyRole = hasAnyRole;
+/**
+ * Checks if the granted permissions satisfy a required permission.
+ * Supports exact matches (e.g. "projects.create") and resource wildcards (e.g. "projects.*").
+ */
+function hasPermission(permissions, required) {
+    if (!permissions || !Array.isArray(permissions) || !required) {
+        return false;
+    }
+    if (permissions.includes(required) || permissions.includes('*.*') || permissions.includes('*')) {
+        return true;
+    }
+    const [requiredResource, requiredAction] = required.split('.');
+    if (!requiredAction) {
+        return permissions.includes(required);
+    }
+    // Check for resource-level wildcard: e.g. "projects.*" satisfies "projects.create"
+    return permissions.includes(`${requiredResource}.*`);
+}
+/**
+ * Checks if granted permissions satisfy AT LEAST ONE of the required permissions.
+ */
+function hasAnyPermission(permissions, requiredList) {
+    if (!requiredList || !requiredList.length)
+        return false;
+    return requiredList.some((p) => hasPermission(permissions, p));
+}
+/**
+ * Checks if granted permissions satisfy ALL of the required permissions.
+ */
+function hasAllPermissions(permissions, requiredList) {
+    if (!requiredList || !requiredList.length)
+        return false;
+    return requiredList.every((p) => hasPermission(permissions, p));
+}
+/**
+ * Checks if granted roles include a specific role slug.
+ */
+function hasRole(roles, roleSlug) {
+    if (!roles || !Array.isArray(roles) || !roleSlug) {
+        return false;
+    }
+    return roles.includes(roleSlug.toLowerCase()) || roles.includes(roleSlug.toUpperCase());
+}
+/**
+ * Checks if granted roles include at least one of the role slugs.
+ */
+function hasAnyRole(roles, roleSlugs) {
+    if (!roleSlugs || !roleSlugs.length)
+        return false;
+    return roleSlugs.some((r) => hasRole(roles, r));
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":";AAAA;;GAEG;;AAMH,sCAgBC;AAKD,4CAGC;AAKD,8CAGC;AAKD,0BAKC;AAKD,gCAGC;AAtDD;;;GAGG;AACH,SAAgB,aAAa,CAAC,WAAqB,EAAE,QAAgB;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,mFAAmF;IACnF,OAAO,WAAW,CAAC,QAAQ,CAAC,GAAG,gBAAgB,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,WAAqB,EAAE,YAAsB;IAC5E,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,WAAqB,EAAE,YAAsB;IAC7E,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,SAAgB,OAAO,CAAC,KAAe,EAAE,QAAgB;IACvD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,KAAe,EAAE,SAAmB;IAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,53 @@
+/**
+ * CleverClouds Identity — Client SDK Types
+ */
+export interface CleverCloudsUser {
+    id: string;
+    email: string;
+    name: string;
+    avatar?: string;
+    status: string;
+    platformRole?: string;
+}
+export interface ApplicationScope {
+    id: string;
+    name: string;
+    slug: string;
+}
+export interface VerificationResult {
+    valid: boolean;
+    user: CleverCloudsUser;
+    application: ApplicationScope;
+    roles: string[];
+    permissions: string[];
+}
+export interface ClientConfig {
+    /**
+     * The base URL of CleverClouds Identity (e.g. https://auth.cleverclouds.in or http://localhost:3000)
+     */
+    identityBaseUrl?: string;
+    /**
+     * The unique slug of this downstream application (e.g. "projects", "hr", "finance")
+     */
+    applicationSlug: string;
+    /**
+     * The secret API key issued by CleverClouds Identity for server-to-server integration
+     */
+    applicationApiKey: string;
+    /**
+     * The whitelisted callback URL where Identity redirects users after signing in
+     */
+    redirectUri: string;
+    /**
+     * Optional secret used to sign downstream session cookies via HMAC-SHA256
+     */
+    sessionSecret?: string;
+}
+export interface AuthorizationUrlOptions {
+    returnTo?: string;
+    state?: string;
+}
+export interface CookieSignOptions {
+    ttlSeconds?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/types.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * CleverClouds Identity — Client SDK Types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;GAEG"}

package/package.json

@@ -1,6 +1,88 @@
 {
   "name": "@cleverclouds/auth-client",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Lightweight client SDK for CleverClouds Identity with Express and Next.js middlewares",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./express": {
+      "types": "./dist/express/index.d.ts",
+      "import": "./dist/express/index.js",
+      "default": "./dist/express/index.js"
+    },
+    "./nextjs": {
+      "types": "./dist/nextjs/index.d.ts",
+      "import": "./dist/nextjs/index.js",
+      "default": "./dist/nextjs/index.js"
+    },
+    "./cookies": {
+      "types": "./dist/crypto.d.ts",
+      "import": "./dist/crypto.js",
+      "default": "./dist/crypto.js"
+    }
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/darshan-kinge/cleverclouds-oneauth.git",
+    "directory": "packages/auth-client"
+  },
+  "bugs": {
+    "url": "https://github.com/darshan-kinge/cleverclouds-oneauth/issues"
+  },
+  "homepage": "https://github.com/darshan-kinge/cleverclouds-oneauth#readme",
+  "keywords": [
+    "cleverclouds",
+    "auth",
+    "sso",
+    "identity",
+    "nextjs",
+    "express",
+    "fastify",
+    "rbac",
+    "session-security"
+  ],
+  "files": [
+    "dist",
+    "README.md",
+    "AGENTS.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build && npm test",
+    "test": "tsx --test tests/client.test.ts tests/permissions.test.ts tests/crypto.test.ts tests/express.test.ts"
+  },
+  "peerDependencies": {
+    "cookie-parser": "^1.4.0",
+    "express": "^4.0.0 || ^5.0.0",
+    "next": ">=14.0.0"
+  },
+  "peerDependenciesMeta": {
+    "cookie-parser": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/cookie-parser": "^1.4.8",
+    "@types/express": "^5.0.0",
+    "@types/node": "^20.17.19",
+    "cookie-parser": "^1.4.7",
+    "express": "^4.21.2",
+    "tsx": "^4.23.15",
+    "typescript": "^5"
+  }
+}