@digilogiclabs/platform-core 1.7.0 → 1.9.0

package/dist/auth.d.mts

@@ -1,5 +1,6 @@
-import { R as RateLimitStore, a as RateLimitRule, b as RateLimitOptions } from './env-DerQ7Da-.mjs';
-export { as as AllowlistConfig, A as ApiError, k as ApiErrorCode, m as ApiErrorCodeType, o as ApiPaginatedResponse, _ as ApiSecurityConfig, a0 as ApiSecurityContext, n as ApiSuccessResponse, aK as AuditRequest, P as AuthCookiesConfig, W as AuthMethod, C as CommonApiErrors, ay as CommonRateLimits, aj as DateRangeInput, ad as DateRangeSchema, an as DeploymentStage, ah as EmailInput, a6 as EmailSchema, E as EnvValidationConfig, x as EnvValidationResult, ap as FlagDefinition, aq as FlagDefinitions, ao as FlagValue, z as KEYCLOAK_DEFAULT_ROLES, N as KeycloakCallbacksConfig, K as KeycloakConfig, O as KeycloakJwtFields, y as KeycloakTokenSet, al as LoginInput, af as LoginSchema, aF as OpsAuditActor, aH as OpsAuditEvent, aJ as OpsAuditLoggerOptions, aI as OpsAuditRecord, aG as OpsAuditResource, ai as PaginationInput, ac as PaginationSchema, a7 as PasswordSchema, aa as PersonNameSchema, a9 as PhoneSchema, ax as RateLimitCheckResult, Y as RateLimitPreset, S as RedirectCallbackConfig, ar as ResolvedFlags, X as RouteAuditConfig, ak as SearchQueryInput, ae as SearchQuerySchema, $ as SecuritySession, am as SignupInput, ag as SignupSchema, a8 as SlugSchema, aM as StandardAuditActionType, aL as StandardAuditActions, Z as StandardRateLimitPresets, T as TokenRefreshResult, a5 as WrapperPresets, av as buildAllowlist, Q as buildAuthCookies, a4 as buildErrorBody, V as buildKeycloakCallbacks, l as buildPagination, a3 as buildRateLimitHeaders, aD as buildRateLimitResponseHeaders, U as buildRedirectCallback, I as buildTokenRefreshParams, u as checkEnvVars, aA as checkRateLimit, i as classifyError, c as constantTimeEqual, f as containsHtml, d as containsUrls, aQ as createAuditActor, aR as createAuditLogger, au as createFeatureFlags, az as createMemoryRateLimitStore, ab as createSafeTextSchema, at as detectStage, e as escapeHtml, aN as extractAuditIp, aP as extractAuditRequestId, aO as extractAuditUserAgent, a2 as extractClientIp, r as getBoolEnv, h as getCorrelationId, L as getEndSessionEndpoint, w as getEnvSummary, t as getIntEnv, q as getOptionalEnv, aB as getRateLimitStatus, p as getRequiredEnv, J as getTokenEndpoint, G as hasAllRoles, F as hasAnyRole, D as hasRole, aw as isAllowlisted, j as isApiError, H as isTokenExpired, B as parseKeycloakRoles, M as refreshKeycloakToken, aC as resetRateLimitForKey, aE as resolveIdentifier, a1 as resolveRateLimitIdentifier, g as sanitizeApiError, s as stripHtml, v as validateEnvVars } from './env-DerQ7Da-.mjs';
+import { R as RateLimitStore, a as RateLimitRule, b as RateLimitOptions } from './env-DHPZR3Lv.mjs';
+export { al as AllowlistConfig, A as ApiError, d as ApiErrorCode, f as ApiErrorCodeType, h as ApiPaginatedResponse, Q as ApiSecurityConfig, V as ApiSecurityContext, g as ApiSuccessResponse, aD as AuditRequest, H as AuthCookiesConfig, N as AuthMethod, aL as BetaClientConfig, C as CommonApiErrors, ar as CommonRateLimits, ac as DateRangeInput, a6 as DateRangeSchema, ag as DeploymentStage, aa as EmailInput, $ as EmailSchema, E as EnvValidationConfig, p as EnvValidationResult, ai as FlagDefinition, aj as FlagDefinitions, ah as FlagValue, r as KEYCLOAK_DEFAULT_ROLES, F as KeycloakCallbacksConfig, K as KeycloakConfig, G as KeycloakJwtFields, q as KeycloakTokenSet, ae as LoginInput, a8 as LoginSchema, ay as OpsAuditActor, aA as OpsAuditEvent, aC as OpsAuditLoggerOptions, aB as OpsAuditRecord, az as OpsAuditResource, ab as PaginationInput, a5 as PaginationSchema, a0 as PasswordSchema, a3 as PersonNameSchema, a2 as PhoneSchema, aq as RateLimitCheckResult, P as RateLimitPreset, J as RedirectCallbackConfig, ak as ResolvedFlags, O as RouteAuditConfig, ad as SearchQueryInput, a7 as SearchQuerySchema, U as SecuritySession, af as SignupInput, a9 as SignupSchema, a1 as SlugSchema, aF as StandardAuditActionType, aE as StandardAuditActions, S as StandardRateLimitPresets, T as TokenRefreshResult, _ as WrapperPresets, ao as buildAllowlist, I as buildAuthCookies, Z as buildErrorBody, M as buildKeycloakCallbacks, e as buildPagination, Y as buildRateLimitHeaders, aw as buildRateLimitResponseHeaders, L as buildRedirectCallback, y as buildTokenRefreshParams, n as checkEnvVars, at as checkRateLimit, c as classifyError, aR as clearStoredBetaCode, aJ as createAuditActor, aK as createAuditLogger, aM as createBetaClient, an as createFeatureFlags, as as createMemoryRateLimitStore, a4 as createSafeTextSchema, am as detectStage, aG as extractAuditIp, aI as extractAuditRequestId, aH as extractAuditUserAgent, X as extractClientIp, aN as fetchBetaSettings, l as getBoolEnv, B as getEndSessionEndpoint, o as getEnvSummary, m as getIntEnv, k as getOptionalEnv, au as getRateLimitStatus, j as getRequiredEnv, aQ as getStoredBetaCode, z as getTokenEndpoint, w as hasAllRoles, u as hasAnyRole, t as hasRole, ap as isAllowlisted, i as isApiError, x as isTokenExpired, s as parseKeycloakRoles, D as refreshKeycloakToken, av as resetRateLimitForKey, ax as resolveIdentifier, W as resolveRateLimitIdentifier, aP as storeBetaCode, aO as validateBetaCode, v as validateEnvVars } from './env-DHPZR3Lv.mjs';
+export { c as constantTimeEqual, b as containsHtml, a as containsUrls, e as escapeHtml, g as getCorrelationId, d as sanitizeApiError, s as stripHtml } from './security-BvLXaQkv.mjs';
 import 'zod';
 
 /**

package/dist/auth.d.ts

@@ -1,5 +1,6 @@
-import { R as RateLimitStore, a as RateLimitRule, b as RateLimitOptions } from './env-DerQ7Da-.js';
-export { as as AllowlistConfig, A as ApiError, k as ApiErrorCode, m as ApiErrorCodeType, o as ApiPaginatedResponse, _ as ApiSecurityConfig, a0 as ApiSecurityContext, n as ApiSuccessResponse, aK as AuditRequest, P as AuthCookiesConfig, W as AuthMethod, C as CommonApiErrors, ay as CommonRateLimits, aj as DateRangeInput, ad as DateRangeSchema, an as DeploymentStage, ah as EmailInput, a6 as EmailSchema, E as EnvValidationConfig, x as EnvValidationResult, ap as FlagDefinition, aq as FlagDefinitions, ao as FlagValue, z as KEYCLOAK_DEFAULT_ROLES, N as KeycloakCallbacksConfig, K as KeycloakConfig, O as KeycloakJwtFields, y as KeycloakTokenSet, al as LoginInput, af as LoginSchema, aF as OpsAuditActor, aH as OpsAuditEvent, aJ as OpsAuditLoggerOptions, aI as OpsAuditRecord, aG as OpsAuditResource, ai as PaginationInput, ac as PaginationSchema, a7 as PasswordSchema, aa as PersonNameSchema, a9 as PhoneSchema, ax as RateLimitCheckResult, Y as RateLimitPreset, S as RedirectCallbackConfig, ar as ResolvedFlags, X as RouteAuditConfig, ak as SearchQueryInput, ae as SearchQuerySchema, $ as SecuritySession, am as SignupInput, ag as SignupSchema, a8 as SlugSchema, aM as StandardAuditActionType, aL as StandardAuditActions, Z as StandardRateLimitPresets, T as TokenRefreshResult, a5 as WrapperPresets, av as buildAllowlist, Q as buildAuthCookies, a4 as buildErrorBody, V as buildKeycloakCallbacks, l as buildPagination, a3 as buildRateLimitHeaders, aD as buildRateLimitResponseHeaders, U as buildRedirectCallback, I as buildTokenRefreshParams, u as checkEnvVars, aA as checkRateLimit, i as classifyError, c as constantTimeEqual, f as containsHtml, d as containsUrls, aQ as createAuditActor, aR as createAuditLogger, au as createFeatureFlags, az as createMemoryRateLimitStore, ab as createSafeTextSchema, at as detectStage, e as escapeHtml, aN as extractAuditIp, aP as extractAuditRequestId, aO as extractAuditUserAgent, a2 as extractClientIp, r as getBoolEnv, h as getCorrelationId, L as getEndSessionEndpoint, w as getEnvSummary, t as getIntEnv, q as getOptionalEnv, aB as getRateLimitStatus, p as getRequiredEnv, J as getTokenEndpoint, G as hasAllRoles, F as hasAnyRole, D as hasRole, aw as isAllowlisted, j as isApiError, H as isTokenExpired, B as parseKeycloakRoles, M as refreshKeycloakToken, aC as resetRateLimitForKey, aE as resolveIdentifier, a1 as resolveRateLimitIdentifier, g as sanitizeApiError, s as stripHtml, v as validateEnvVars } from './env-DerQ7Da-.js';
+import { R as RateLimitStore, a as RateLimitRule, b as RateLimitOptions } from './env-DHPZR3Lv.js';
+export { al as AllowlistConfig, A as ApiError, d as ApiErrorCode, f as ApiErrorCodeType, h as ApiPaginatedResponse, Q as ApiSecurityConfig, V as ApiSecurityContext, g as ApiSuccessResponse, aD as AuditRequest, H as AuthCookiesConfig, N as AuthMethod, aL as BetaClientConfig, C as CommonApiErrors, ar as CommonRateLimits, ac as DateRangeInput, a6 as DateRangeSchema, ag as DeploymentStage, aa as EmailInput, $ as EmailSchema, E as EnvValidationConfig, p as EnvValidationResult, ai as FlagDefinition, aj as FlagDefinitions, ah as FlagValue, r as KEYCLOAK_DEFAULT_ROLES, F as KeycloakCallbacksConfig, K as KeycloakConfig, G as KeycloakJwtFields, q as KeycloakTokenSet, ae as LoginInput, a8 as LoginSchema, ay as OpsAuditActor, aA as OpsAuditEvent, aC as OpsAuditLoggerOptions, aB as OpsAuditRecord, az as OpsAuditResource, ab as PaginationInput, a5 as PaginationSchema, a0 as PasswordSchema, a3 as PersonNameSchema, a2 as PhoneSchema, aq as RateLimitCheckResult, P as RateLimitPreset, J as RedirectCallbackConfig, ak as ResolvedFlags, O as RouteAuditConfig, ad as SearchQueryInput, a7 as SearchQuerySchema, U as SecuritySession, af as SignupInput, a9 as SignupSchema, a1 as SlugSchema, aF as StandardAuditActionType, aE as StandardAuditActions, S as StandardRateLimitPresets, T as TokenRefreshResult, _ as WrapperPresets, ao as buildAllowlist, I as buildAuthCookies, Z as buildErrorBody, M as buildKeycloakCallbacks, e as buildPagination, Y as buildRateLimitHeaders, aw as buildRateLimitResponseHeaders, L as buildRedirectCallback, y as buildTokenRefreshParams, n as checkEnvVars, at as checkRateLimit, c as classifyError, aR as clearStoredBetaCode, aJ as createAuditActor, aK as createAuditLogger, aM as createBetaClient, an as createFeatureFlags, as as createMemoryRateLimitStore, a4 as createSafeTextSchema, am as detectStage, aG as extractAuditIp, aI as extractAuditRequestId, aH as extractAuditUserAgent, X as extractClientIp, aN as fetchBetaSettings, l as getBoolEnv, B as getEndSessionEndpoint, o as getEnvSummary, m as getIntEnv, k as getOptionalEnv, au as getRateLimitStatus, j as getRequiredEnv, aQ as getStoredBetaCode, z as getTokenEndpoint, w as hasAllRoles, u as hasAnyRole, t as hasRole, ap as isAllowlisted, i as isApiError, x as isTokenExpired, s as parseKeycloakRoles, D as refreshKeycloakToken, av as resetRateLimitForKey, ax as resolveIdentifier, W as resolveRateLimitIdentifier, aP as storeBetaCode, aO as validateBetaCode, v as validateEnvVars } from './env-DHPZR3Lv.js';
+export { c as constantTimeEqual, b as containsHtml, a as containsUrls, e as escapeHtml, g as getCorrelationId, d as sanitizeApiError, s as stripHtml } from './security-BvLXaQkv.js';
 import 'zod';
 
 /**

package/dist/auth.js

@@ -50,11 +50,13 @@ __export(auth_exports, {
   checkEnvVars: () => checkEnvVars,
   checkRateLimit: () => checkRateLimit,
   classifyError: () => classifyError,
+  clearStoredBetaCode: () => clearStoredBetaCode,
   constantTimeEqual: () => constantTimeEqual,
   containsHtml: () => containsHtml,
   containsUrls: () => containsUrls,
   createAuditActor: () => createAuditActor,
   createAuditLogger: () => createAuditLogger,
+  createBetaClient: () => createBetaClient,
   createFeatureFlags: () => createFeatureFlags,
   createMemoryRateLimitStore: () => createMemoryRateLimitStore,
   createRedisRateLimitStore: () => createRedisRateLimitStore,
@@ -68,6 +70,7 @@ __export(auth_exports, {
   extractAuditUserAgent: () => extractAuditUserAgent,
   extractBearerToken: () => extractBearerToken,
   extractClientIp: () => extractClientIp,
+  fetchBetaSettings: () => fetchBetaSettings,
   getBoolEnv: () => getBoolEnv,
   getCorrelationId: () => getCorrelationId,
   getEndSessionEndpoint: () => getEndSessionEndpoint,
@@ -76,6 +79,7 @@ __export(auth_exports, {
   getOptionalEnv: () => getOptionalEnv,
   getRateLimitStatus: () => getRateLimitStatus,
   getRequiredEnv: () => getRequiredEnv,
+  getStoredBetaCode: () => getStoredBetaCode,
   getTokenEndpoint: () => getTokenEndpoint,
   hasAllRoles: () => hasAllRoles,
   hasAnyRole: () => hasAnyRole,
@@ -90,7 +94,9 @@ __export(auth_exports, {
   resolveIdentifier: () => resolveIdentifier,
   resolveRateLimitIdentifier: () => resolveRateLimitIdentifier,
   sanitizeApiError: () => sanitizeApiError,
+  storeBetaCode: () => storeBetaCode,
   stripHtml: () => stripHtml,
+  validateBetaCode: () => validateBetaCode,
   validateEnvVars: () => validateEnvVars,
   zodErrorResponse: () => zodErrorResponse
 });
@@ -1204,6 +1210,113 @@ function isValidBearerToken(request, secret) {
   return constantTimeEqual(token, secret);
 }
 
+// src/auth/beta-client.ts
+var DEFAULT_CONFIG = {
+  baseUrl: "",
+  settingsEndpoint: "/api/beta-settings",
+  validateEndpoint: "/api/validate-beta-code",
+  storageKey: "beta_code",
+  failSafeDefaults: {
+    betaMode: true,
+    requireInviteCode: true,
+    betaMessage: ""
+  }
+};
+function createBetaClient(config = {}) {
+  const cfg = {
+    ...DEFAULT_CONFIG,
+    ...config,
+    failSafeDefaults: {
+      ...DEFAULT_CONFIG.failSafeDefaults,
+      ...config.failSafeDefaults
+    }
+  };
+  return {
+    fetchSettings: () => fetchBetaSettings(cfg),
+    validateCode: (code) => validateBetaCode(code, cfg),
+    storeCode: (code) => storeBetaCode(code, cfg),
+    getStoredCode: () => getStoredBetaCode(cfg),
+    clearStoredCode: () => clearStoredBetaCode(cfg)
+  };
+}
+async function fetchBetaSettings(config = {}) {
+  const cfg = { ...DEFAULT_CONFIG, ...config };
+  try {
+    const response = await fetch(`${cfg.baseUrl}${cfg.settingsEndpoint}`, {
+      method: "GET",
+      headers: { "Content-Type": "application/json" },
+      cache: "no-store"
+    });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch beta settings: ${response.status}`);
+    }
+    const data = await response.json();
+    return {
+      betaMode: data.betaMode ?? cfg.failSafeDefaults.betaMode ?? true,
+      requireInviteCode: data.requireInviteCode ?? cfg.failSafeDefaults.requireInviteCode ?? true,
+      betaMessage: data.betaMessage ?? cfg.failSafeDefaults.betaMessage ?? ""
+    };
+  } catch (error) {
+    console.error("Error fetching beta settings:", error);
+    return {
+      betaMode: cfg.failSafeDefaults.betaMode ?? true,
+      requireInviteCode: cfg.failSafeDefaults.requireInviteCode ?? true,
+      betaMessage: cfg.failSafeDefaults.betaMessage ?? ""
+    };
+  }
+}
+async function validateBetaCode(code, config = {}) {
+  const cfg = { ...DEFAULT_CONFIG, ...config };
+  if (!code || code.trim().length < 3) {
+    return {
+      valid: false,
+      message: "Please enter a valid invite code."
+    };
+  }
+  try {
+    const response = await fetch(`${cfg.baseUrl}${cfg.validateEndpoint}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code: code.trim().toUpperCase() })
+    });
+    if (response.status === 429) {
+      return {
+        valid: false,
+        message: "Too many attempts. Please try again later."
+      };
+    }
+    if (!response.ok) {
+      throw new Error(`Validation request failed: ${response.status}`);
+    }
+    return await response.json();
+  } catch (error) {
+    console.error("Error validating invite code:", error);
+    return {
+      valid: false,
+      message: "Unable to validate code. Please try again."
+    };
+  }
+}
+function storeBetaCode(code, config = {}) {
+  const key = config.storageKey ?? DEFAULT_CONFIG.storageKey;
+  if (typeof window !== "undefined") {
+    sessionStorage.setItem(key, code.trim().toUpperCase());
+  }
+}
+function getStoredBetaCode(config = {}) {
+  const key = config.storageKey ?? DEFAULT_CONFIG.storageKey;
+  if (typeof window !== "undefined") {
+    return sessionStorage.getItem(key);
+  }
+  return null;
+}
+function clearStoredBetaCode(config = {}) {
+  const key = config.storageKey ?? DEFAULT_CONFIG.storageKey;
+  if (typeof window !== "undefined") {
+    sessionStorage.removeItem(key);
+  }
+}
+
 // src/env.ts
 function getRequiredEnv(key) {
   const value = process.env[key];
@@ -1326,11 +1439,13 @@ function getEnvSummary(keys) {
   checkEnvVars,
   checkRateLimit,
   classifyError,
+  clearStoredBetaCode,
   constantTimeEqual,
   containsHtml,
   containsUrls,
   createAuditActor,
   createAuditLogger,
+  createBetaClient,
   createFeatureFlags,
   createMemoryRateLimitStore,
   createRedisRateLimitStore,
@@ -1344,6 +1459,7 @@ function getEnvSummary(keys) {
   extractAuditUserAgent,
   extractBearerToken,
   extractClientIp,
+  fetchBetaSettings,
   getBoolEnv,
   getCorrelationId,
   getEndSessionEndpoint,
@@ -1352,6 +1468,7 @@ function getEnvSummary(keys) {
   getOptionalEnv,
   getRateLimitStatus,
   getRequiredEnv,
+  getStoredBetaCode,
   getTokenEndpoint,
   hasAllRoles,
   hasAnyRole,
@@ -1366,7 +1483,9 @@ function getEnvSummary(keys) {
   resolveIdentifier,
   resolveRateLimitIdentifier,
   sanitizeApiError,
+  storeBetaCode,
   stripHtml,
+  validateBetaCode,
   validateEnvVars,
   zodErrorResponse
 });