@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.13

package/dist/MachineAuth.js

@@ -0,0 +1,147 @@
+import { Data, Effect, Redacted } from "effect";
+export class MachineAuthError extends Data.TaggedError("MachineAuthError") {
+}
+export const bearerToken = (headers) => {
+    const authorization = headers.get("authorization");
+    if (authorization === null) {
+        return undefined;
+    }
+    const [scheme, token] = authorization.trim().split(/\s+/, 2);
+    return scheme?.toLowerCase() === "bearer" && token !== undefined && token !== ""
+        ? token
+        : undefined;
+};
+export const apiKeyPrefixFromSecret = (secret) => {
+    const separator = secret.indexOf(".");
+    return separator > 0 ? secret.slice(0, separator) : "malformed";
+};
+export const jwtClaimScopes = (claims) => {
+    const { scope, scopes } = claims;
+    if (typeof scope === "string") {
+        return scope.split(/\s+/).filter((value) => value.length > 0);
+    }
+    return Array.isArray(scopes) &&
+        scopes.every((value) => typeof value === "string")
+        ? scopes
+        : [];
+};
+const nonEmptyStringField = (record, key) => {
+    if (key === undefined) {
+        return undefined;
+    }
+    const value = record?.[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+};
+const machineActorMetadataFields = (record, options, defaults) => {
+    const tenantId = nonEmptyStringField(record, options.tenantIdField ?? defaults.tenantIdField);
+    const serviceAccountId = nonEmptyStringField(record, options.serviceAccountIdField ?? defaults.serviceAccountIdField);
+    return {
+        ...(tenantId === undefined ? {} : { tenantId }),
+        ...(serviceAccountId === undefined ? {} : { serviceAccountId }),
+    };
+};
+export const apiKeyMachineActor = (key, options = {}) => ({
+    kind: "api_key",
+    userId: key.userId,
+    keyId: key.id,
+    scopes: key.scopes,
+    key,
+    ...machineActorMetadataFields(key.metadata, options, {
+        tenantIdField: "tenantId",
+        serviceAccountIdField: "serviceAccountId",
+    }),
+});
+export const jwtMachineActor = (input, options = {}) => {
+    const jwtId = typeof input.claims.jti === "string" && input.claims.jti.length > 0
+        ? input.claims.jti
+        : undefined;
+    return {
+        kind: "jwt",
+        subject: input.claims.sub,
+        scopes: input.scopes ?? jwtClaimScopes(input.claims),
+        claims: input.claims,
+        key: input.key,
+        ...(jwtId === undefined ? {} : { jwtId }),
+        ...machineActorMetadataFields(input.claims, options, {
+            tenantIdField: "tenant_id",
+            serviceAccountIdField: "service_account_id",
+        }),
+    };
+};
+const missingScopes = (actorScopes, requiredScopes) => (requiredScopes ?? []).filter((scope) => !actorScopes.includes(scope));
+export const requireMachineScopes = (input) => {
+    const missing = missingScopes(input.actor.scopes, input.scopes);
+    return missing.length === 0
+        ? Effect.succeed(input.actor)
+        : Effect.fail(new MachineAuthError({
+            reason: "missing_scope",
+            message: "Machine credential is missing a required scope",
+        }));
+};
+export const verifyMachineApiKey = (options) => Effect.gen(function* () {
+    const secret = bearerToken(options.headers);
+    if (secret === undefined) {
+        return yield* new MachineAuthError({
+            reason: "missing_bearer",
+            message: "Missing bearer token",
+        });
+    }
+    const result = yield* options.apiKeyVerification
+        .verify({
+        secret: Redacted.make(secret),
+        ...(options.now === undefined ? {} : { now: options.now }),
+        ...(options.verificationMetadata === undefined
+            ? {}
+            : { metadata: options.verificationMetadata }),
+    })
+        .pipe(Effect.mapError((cause) => new MachineAuthError({
+        reason: "verification_failed",
+        message: "Failed to verify machine API key",
+        cause,
+    })));
+    if (!result.valid || result.key === undefined) {
+        return yield* new MachineAuthError({
+            reason: "invalid_api_key",
+            message: "Invalid API key bearer token",
+        });
+    }
+    return yield* requireMachineScopes({
+        actor: apiKeyMachineActor(result.key, options),
+        scopes: options.requiredScopes ?? [],
+    });
+});
+export const verifyMachineJwt = (options) => Effect.gen(function* () {
+    const token = bearerToken(options.headers);
+    if (token === undefined) {
+        return yield* new MachineAuthError({
+            reason: "missing_bearer",
+            message: "Missing bearer token",
+        });
+    }
+    const result = yield* options.jwtVerifier
+        .verify({
+        token: Redacted.make(token),
+        ...(options.issuer === undefined ? {} : { issuer: options.issuer }),
+        ...(options.audience === undefined ? {} : { audience: options.audience }),
+        ...(options.now === undefined ? {} : { now: options.now }),
+        ...(options.clockTolerance === undefined
+            ? {}
+            : { clockTolerance: options.clockTolerance }),
+    })
+        .pipe(Effect.mapError((cause) => new MachineAuthError({
+        reason: "verification_failed",
+        message: "Failed to verify machine JWT",
+        cause,
+    })));
+    if (!result.valid) {
+        return yield* new MachineAuthError({
+            reason: "invalid_jwt",
+            message: "Invalid JWT bearer token",
+        });
+    }
+    return yield* requireMachineScopes({
+        actor: jwtMachineActor(result, options),
+        scopes: options.requiredScopes ?? [],
+    });
+});
+//# sourceMappingURL=MachineAuth.js.map

package/dist/MachineAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineAuth.js","sourceRoot":"","sources":["../src/MachineAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAyBhD,MAAM,OAAO,gBAAiB,SAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAIvE;CAAG;AAiDL,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAsB,EAAE;IAClE,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEnD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE7D,OAAO,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAC9E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAAU,EAAE;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtC,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAiB,EAAqB,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEjC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnE,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,CAAC;AACT,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC1B,MAAqD,EACrD,GAAuB,EACH,EAAE;IACtB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAE5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CACjC,MAAqD,EACrD,OAAiC,EACjC,QAA4C,EAChB,EAAE;IAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAClC,MAAM,EACN,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC1C,MAAM,EACN,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB,CAChE,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,GAAe,EACf,UAAoC,EAAE,EAClB,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,KAAK,EAAE,GAAG,CAAC,EAAE;IACb,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,GAAG;IACH,GAAG,0BAA0B,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE;QACnD,aAAa,EAAE,UAAU;QACzB,qBAAqB,EAAE,kBAAkB;KAC1C,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAIC,EACD,UAAoC,EAAE,EACrB,EAAE;IACnB,MAAM,KAAK,GACT,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAClB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE;YACnD,aAAa,EAAE,WAAW;YAC1B,qBAAqB,EAAE,oBAAoB;SAC5C,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,WAA8B,EAC9B,cAA6C,EAC1B,EAAE,CACrB,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAyB,KAG5D,EAAsC,EAAE;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEhE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,IAAI,gBAAgB,CAAC;YACnB,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CACH,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAAmC,EACkB,EAAE,CACvD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB;SAC7C,MAAM,CAAC;QACN,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;KAChD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,kCAAkC;QAC3C,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEJ,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,iBAAiB;YACzB,OAAO,EAAE,8BAA8B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAC9C,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAgC,EACkB,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,WAAW;SACtC,MAAM,CAAC;QACN,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;YACtC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAChD,CAAC;SACD,IAAI,CACH,MAAM,CAAC,QAAQ,CACb,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,gBAAgB,CAAC;QACnB,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,8BAA8B;QACvC,KAAK;KACN,CAAC,CACL,CACF,CAAC;IAEJ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC,CAAC,IAAI,gBAAgB,CAAC;YACjC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,oBAAoB,CAAC;QACjC,KAAK,EAAE,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC;QACvC,MAAM,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/MagicLink.d.ts

@@ -79,7 +79,7 @@ export interface MagicLinkDependencies extends MagicLinkOptions {
 export declare const defaultMagicLinkTtl: Duration.Duration;
 export declare const defaultMagicLinkSecretBytes = 32;
 export declare const makeMagicLinkLogin: (dependencies: MagicLinkDependencies) => MagicLinkLoginService;
-export declare const MagicLinkLoginLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | AuthMailer | Challenge | AuthFlow>;
-export declare const MagicLinkFeatureLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | AuthMailer | Challenge | AuthFlow>;
+export declare const MagicLinkLoginLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | Challenge | AuthMailer | AuthFlow>;
+export declare const MagicLinkFeatureLive: (options: MagicLinkOptions) => Layer.Layer<MagicLinkLogin, never, Crypto | UserStore | Challenge | AuthMailer | AuthFlow>;
 export {};
 //# sourceMappingURL=MagicLink.d.ts.map