@eva_solutions/auth-sdk 0.0.0-stage → 3.0.0-dev-20261109133200

package/dist/webhooks-Cx11psg1.cjs

@@ -0,0 +1,79 @@
+require("./constants-CcbhOaAP.cjs");
+// src/webhooks/verify-signature.ts
+/**
+* Verificación de firma HMAC-SHA-256 de webhooks entrantes del Auth Service.
+*
+* REQ-WH-03, REQ-WH-04, REQ-WH-05, REQ-WH-06 LOCKED.
+*
+* Algoritmo (espejo del API `firmarWebhook` en webhook-dispatcher.ts):
+*   canonical = `${timestamp}\n${eventId}\n${sha256Hex(rawBody)}`
+*   expected  = HMAC-SHA-256(signingKey, canonical)
+*
+* Usa Web Crypto API (`crypto.subtle`) — isomorfo (browser + worker + Node 20+).
+*
+* D-12 LOCKED: hexToBytes y sha256Hex se duplican aquí (NO se extraen a shared)
+* para que el entry point ./webhooks sea completamente tree-shakeable.
+*/
+const HEX_REGEX = /^[0-9a-f]+$/i;
+/**
+* Decodifica hex string a Uint8Array.
+* Retorna null si la longitud es impar o contiene chars no-hex.
+*/
+function hexToBytes(hex) {
+	if (hex.length === 0 || hex.length % 2 !== 0 || !HEX_REGEX.test(hex)) return null;
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);
+	return bytes;
+}
+/**
+* SHA-256 hex lowercase de un string (encodificado como UTF-8).
+*/
+async function sha256Hex(data) {
+	const bytes = new TextEncoder().encode(data);
+	const digest = await crypto.subtle.digest("SHA-256", bytes);
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Verifica la firma HMAC-SHA-256 de un webhook entrante del Auth Service.
+*
+* @returns `true` si la firma es válida y está dentro de la ventana de tiempo;
+*          `false` en cualquier otro caso (firma inválida, expirada, formato incorrecto).
+*
+* La comparación es constant-time via `crypto.subtle.verify` (por spec).
+*
+* @example
+* ```ts
+* const valid = await verifyWebhookSignature({
+*   rawBody: await req.text(),
+*   signingKey: process.env.WEBHOOK_SIGNING_KEY,
+*   signature: req.headers.get('x-eva-webhook-signature') ?? '',
+*   eventId: req.headers.get('x-eva-webhook-id') ?? '',
+*   timestamp: Number(req.headers.get('x-eva-webhook-timestamp')),
+* })
+* if (!valid) return new Response('Unauthorized', { status: 401 })
+* ```
+*/
+async function verifyWebhookSignature({ rawBody, signingKey, signature, eventId, timestamp, now }) {
+	const currentTime = now ?? Math.floor(Date.now() / 1e3);
+	if (Math.abs(currentTime - timestamp) > 300) return false;
+	if (!signature.startsWith("sha256=")) return false;
+	const expectedHex = signature.slice(7);
+	const keyBytes = hexToBytes(signingKey);
+	if (keyBytes === null) return false;
+	const cryptoKey = await crypto.subtle.importKey("raw", keyBytes.buffer, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	const canonical = `${timestamp}\n${eventId}\n${await sha256Hex(rawBody)}`;
+	const expectedBytes = hexToBytes(expectedHex);
+	if (expectedBytes === null) return false;
+	return crypto.subtle.verify("HMAC", cryptoKey, expectedBytes.buffer, new TextEncoder().encode(canonical));
+}
+Object.defineProperty(exports, "verifyWebhookSignature", {
+	enumerable: true,
+	get: function() {
+		return verifyWebhookSignature;
+	}
+});
+
+//# sourceMappingURL=webhooks-Cx11psg1.cjs.map

package/dist/webhooks-Cx11psg1.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks-Cx11psg1.cjs","names":[],"sources":["../src/webhooks/verify-signature.ts"],"sourcesContent":["/**\n * Verificación de firma HMAC-SHA-256 de webhooks entrantes del Auth Service.\n *\n * REQ-WH-03, REQ-WH-04, REQ-WH-05, REQ-WH-06 LOCKED.\n *\n * Algoritmo (espejo del API `firmarWebhook` en webhook-dispatcher.ts):\n *   canonical = `${timestamp}\\n${eventId}\\n${sha256Hex(rawBody)}`\n *   expected  = HMAC-SHA-256(signingKey, canonical)\n *\n * Usa Web Crypto API (`crypto.subtle`) — isomorfo (browser + worker + Node 20+).\n *\n * D-12 LOCKED: hexToBytes y sha256Hex se duplican aquí (NO se extraen a shared)\n * para que el entry point ./webhooks sea completamente tree-shakeable.\n */\n\nimport { WEBHOOK_TIMESTAMP_WINDOW_SECONDS } from './constants'\n\n// ---------------------------------------------------------------------------\n// Helpers criptográficos locales (D-12 LOCKED — no exportar, no extraer)\n// ---------------------------------------------------------------------------\n\nconst HEX_REGEX = /^[0-9a-f]+$/i\n\n/**\n * Decodifica hex string a Uint8Array.\n * Retorna null si la longitud es impar o contiene chars no-hex.\n */\nfunction hexToBytes(hex: string): Uint8Array | null {\n  if (hex.length === 0 || hex.length % 2 !== 0 || !HEX_REGEX.test(hex)) {\n    return null\n  }\n  const bytes = new Uint8Array(hex.length / 2)\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16)\n  }\n  return bytes\n}\n\n/**\n * SHA-256 hex lowercase de un string (encodificado como UTF-8).\n */\nasync function sha256Hex(data: string): Promise<string> {\n  const bytes = new TextEncoder().encode(data)\n  const digest = await crypto.subtle.digest('SHA-256', bytes as BufferSource)\n  return Array.from(new Uint8Array(digest))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n// ---------------------------------------------------------------------------\n// API pública\n// ---------------------------------------------------------------------------\n\nexport type VerifyWebhookSignatureParams = {\n  /** Body raw del request (string, antes de parsear JSON). */\n  rawBody: string\n  /**\n   * Signing key del webhook — hex 64 chars (32 bytes).\n   * Es el `signingKey` que devolvió el API al crear/rotar la subscription.\n   * NOTA H3 LOCKED: NO re-hashear — usarlo tal como viene.\n   */\n  signingKey: string\n  /**\n   * Valor completo del header `X-Eva-Webhook-Signature`.\n   * Debe comenzar con `\"sha256=\"`.\n   */\n  signature: string\n  /** Valor del header `X-Eva-Webhook-Id` (UUID del evento). */\n  eventId: string\n  /**\n   * Valor del header `X-Eva-Webhook-Timestamp` parseado a number\n   * (unix seconds).\n   */\n  timestamp: number\n  /**\n   * Override del tiempo actual (unix seconds) para tests.\n   * Por defecto: `Math.floor(Date.now() / 1000)`.\n   */\n  now?: number\n}\n\n/**\n * Verifica la firma HMAC-SHA-256 de un webhook entrante del Auth Service.\n *\n * @returns `true` si la firma es válida y está dentro de la ventana de tiempo;\n *          `false` en cualquier otro caso (firma inválida, expirada, formato incorrecto).\n *\n * La comparación es constant-time via `crypto.subtle.verify` (por spec).\n *\n * @example\n * ```ts\n * const valid = await verifyWebhookSignature({\n *   rawBody: await req.text(),\n *   signingKey: process.env.WEBHOOK_SIGNING_KEY,\n *   signature: req.headers.get('x-eva-webhook-signature') ?? '',\n *   eventId: req.headers.get('x-eva-webhook-id') ?? '',\n *   timestamp: Number(req.headers.get('x-eva-webhook-timestamp')),\n * })\n * if (!valid) return new Response('Unauthorized', { status: 401 })\n * ```\n */\nexport async function verifyWebhookSignature({\n  rawBody,\n  signingKey,\n  signature,\n  eventId,\n  timestamp,\n  now,\n}: VerifyWebhookSignatureParams): Promise<boolean> {\n  // Paso 1: verificar ventana de tiempo\n  const currentTime = now ?? Math.floor(Date.now() / 1000)\n  if (Math.abs(currentTime - timestamp) > WEBHOOK_TIMESTAMP_WINDOW_SECONDS) {\n    return false\n  }\n\n  // Paso 2: extraer hex esperado del header (quitar prefijo \"sha256=\")\n  if (!signature.startsWith('sha256=')) {\n    return false\n  }\n  const expectedHex = signature.slice(7)\n\n  // Paso 3: decodificar signing key (sin re-hash — H3 LOCKED)\n  const keyBytes = hexToBytes(signingKey)\n  if (keyBytes === null) {\n    return false\n  }\n\n  // Paso 4: importar clave HMAC\n  const cryptoKey = await crypto.subtle.importKey(\n    'raw',\n    keyBytes.buffer as BufferSource,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['verify'],\n  )\n\n  // Paso 5: construir el canonical string\n  // canonical = `${timestamp}\\n${eventId}\\n${sha256Hex(rawBody)}`\n  const bodyHash = await sha256Hex(rawBody)\n  const canonical = `${timestamp}\\n${eventId}\\n${bodyHash}`\n\n  // Paso 6: decodificar firma esperada\n  const expectedBytes = hexToBytes(expectedHex)\n  if (expectedBytes === null) {\n    return false\n  }\n\n  // Paso 7: verificar HMAC (constant-time por spec de Web Crypto)\n  return crypto.subtle.verify(\n    'HMAC',\n    cryptoKey,\n    expectedBytes.buffer as BufferSource,\n    new TextEncoder().encode(canonical) as BufferSource,\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAqBA,MAAM,YAAY;;;;;AAMlB,SAAS,WAAW,KAAgC;CAClD,IAAI,IAAI,WAAW,KAAK,IAAI,SAAS,MAAM,KAAK,CAAC,UAAU,KAAK,GAAG,GACjE,OAAO;CAET,MAAM,QAAQ,IAAI,WAAW,IAAI,SAAS,CAAC;CAC3C,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,GACnC,MAAM,IAAI,KAAK,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;CAEjD,OAAO;AACT;;;;AAKA,eAAe,UAAU,MAA+B;CACtD,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,IAAI;CAC3C,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,KAAqB;CAC1E,OAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,CAAC,CACtC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAC3C,KAAK,EAAE;AACZ;;;;;;;;;;;;;;;;;;;;;AAsDA,eAAsB,uBAAuB,EAC3C,SACA,YACA,WACA,SACA,WACA,OACiD;CAEjD,MAAM,cAAc,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACvD,IAAI,KAAK,IAAI,cAAc,SAAS,IAAA,KAClC,OAAO;CAIT,IAAI,CAAC,UAAU,WAAW,SAAS,GACjC,OAAO;CAET,MAAM,cAAc,UAAU,MAAM,CAAC;CAGrC,MAAM,WAAW,WAAW,UAAU;CACtC,IAAI,aAAa,MACf,OAAO;CAIT,MAAM,YAAY,MAAM,OAAO,OAAO,UACpC,OACA,SAAS,QACT;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,QAAQ,CACX;CAKA,MAAM,YAAY,GAAG,UAAU,IAAI,QAAQ,IAAI,MADxB,UAAU,OAAO;CAIxC,MAAM,gBAAgB,WAAW,WAAW;CAC5C,IAAI,kBAAkB,MACpB,OAAO;CAIT,OAAO,OAAO,OAAO,OACnB,QACA,WACA,cAAc,QACd,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,CACpC;AACF"}

package/package.json

@@ -1,6 +1,195 @@
 {
   "name": "@eva_solutions/auth-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "3.0.0-dev-20261109133200",
+  "description": "Official TypeScript client for the EVA Auth Service — secure cookie-based auth with JWT ES256, JWKS rotation, S2S signing, and webhooks.",
+  "keywords": [
+    "auth",
+    "sdk",
+    "typescript",
+    "jwt",
+    "jwks",
+    "hono",
+    "react",
+    "cookies",
+    "es256",
+    "eva",
+    "security",
+    "oauth",
+    "session"
+  ],
+  "homepage": "https://github.com/eva-solutions-org/auth-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/eva-solutions-org/auth-sdk/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/eva-solutions-org/auth-sdk.git",
+    "directory": "packages/auth-sdk"
+  },
+  "license": "MIT",
+  "author": "EVA Solutions <arturo.rodas.gonzales@gmail.com>",
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/eva-solutions-org"
+  },
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./hono": {
+      "import": {
+        "types": "./dist/hono/index.d.ts",
+        "default": "./dist/hono/index.js"
+      },
+      "require": {
+        "types": "./dist/hono/index.d.cts",
+        "default": "./dist/hono/index.cjs"
+      }
+    },
+    "./generic": {
+      "import": {
+        "types": "./dist/generic/index.d.ts",
+        "default": "./dist/generic/index.js"
+      },
+      "require": {
+        "types": "./dist/generic/index.d.cts",
+        "default": "./dist/generic/index.cjs"
+      }
+    },
+    "./react": {
+      "import": {
+        "types": "./dist/react/index.d.ts",
+        "default": "./dist/react/index.js"
+      },
+      "require": {
+        "types": "./dist/react/index.d.cts",
+        "default": "./dist/react/index.cjs"
+      }
+    },
+    "./hono-openapi": {
+      "import": {
+        "types": "./dist/hono-openapi/index.d.ts",
+        "default": "./dist/hono-openapi/index.js"
+      },
+      "require": {
+        "types": "./dist/hono-openapi/index.d.cts",
+        "default": "./dist/hono-openapi/index.cjs"
+      }
+    },
+    "./webhooks": {
+      "import": {
+        "types": "./dist/webhooks/index.d.ts",
+        "default": "./dist/webhooks/index.js"
+      },
+      "require": {
+        "types": "./dist/webhooks/index.d.cts",
+        "default": "./dist/webhooks/index.cjs"
+      }
+    },
+    "./admin": {
+      "import": {
+        "types": "./dist/admin/index.d.ts",
+        "default": "./dist/admin/index.js"
+      },
+      "require": {
+        "types": "./dist/admin/index.d.cts",
+        "default": "./dist/admin/index.cjs"
+      }
+    },
+    "./s2s": {
+      "import": {
+        "types": "./dist/s2s/index.d.ts",
+        "default": "./dist/s2s/index.js"
+      },
+      "require": {
+        "types": "./dist/s2s/index.d.cts",
+        "default": "./dist/s2s/index.cjs"
+      }
+    },
+    "./contracts": {
+      "import": {
+        "types": "./dist/contracts/index.d.ts",
+        "default": "./dist/contracts/index.js"
+      },
+      "require": {
+        "types": "./dist/contracts/index.d.cts",
+        "default": "./dist/contracts/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "peerDependencies": {
+    "@hono/zod-openapi": ">=1.4.0",
+    "hono": ">=4.12.19",
+    "react": ">=19.2.6"
+  },
+  "peerDependenciesMeta": {
+    "hono": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "@hono/zod-openapi": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "bowser": "^2.15.0",
+    "jose": "~6.2.14",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@eva_solutions/auth-contracts": "0.1.0",
+    "@hono/zod-openapi": "^1.6.3",
+    "@types/node": "^25.9.9",
+    "@types/react": "^19.3.0",
+    "@typhonjs-typedoc/typedoc-theme-dmt": "^0.4.0",
+    "expect-type": "^1.4.0",
+    "hono": "^4.13.14",
+    "react": "^19.3.1",
+    "tsdown": "^0.22.14",
+    "typedoc": "^0.28.20",
+    "typescript": "^6.0.3",
+    "unrun": "^0.3.1",
+    "vitest": "^4.1.12"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "node scripts/build-with-maps.mjs",
+    "dev": "tsdown --watch",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "test:types": "vitest run --typecheck.only",
+    "type-check": "tsc --noEmit && tsc -p tests/tsconfig.json",
+    "docs": "typedoc",
+    "attw": "attw --pack . --ignore-rules no-resolution",
+    "check:self-contained": "node scripts/check-self-contained.mjs dist",
+    "check:react-closure": "node scripts/react-closure-size.mjs dist --max 11800 --max-cjs 12380 --forbid \"\\.meta\\(\""
+  }
 }