@fluojs/passport 1.0.0-beta.1

package/dist/adapters/passport-js.d.ts

@@ -0,0 +1,77 @@
+import type { Token } from '@fluojs/core';
+import type { GuardContext, Principal } from '@fluojs/http';
+import type { Provider } from '@fluojs/di';
+import type { AuthHandledResult, AuthStrategy, AuthStrategyRegistration } from '../types.js';
+/**
+ * Represents a Passport.js strategy-like object that implements
+ * the `authenticate` method.
+ */
+export interface PassportJsStrategyLike {
+    /**
+     * Performs authentication for the given request and options.
+     *
+     * @param request - The raw request object from the underlying framework.
+     * @param options - Strategy-specific authentication options.
+     * @returns An execution result or a promise resolving to one.
+     */
+    authenticate(request: unknown, options?: unknown): unknown;
+}
+/**
+ * Input for the principal mapper that converts Passport.js user data
+ * into a fluo {@link Principal}.
+ */
+export interface PassportJsPrincipalMapperInput {
+    /** The guard context for the current request. */
+    context: GuardContext;
+    /** Optional information returned by the Passport strategy. */
+    info?: unknown;
+    /** The user object returned by the Passport strategy. */
+    user: unknown;
+}
+/**
+ * A function type that maps Passport.js user data to a fluo {@link Principal}.
+ */
+export type PassportJsPrincipalMapper = (input: PassportJsPrincipalMapperInput) => Principal;
+/**
+ * Configuration options for the Passport.js authentication strategy.
+ */
+export interface PassportJsAuthStrategyOptions {
+    /** Optional options to pass to the Passport strategy's `authenticate` method. */
+    authenticateOptions?: Readonly<Record<string, unknown>>;
+    /** Optional custom mapper for converting user data to a principal. */
+    mapPrincipal?: PassportJsPrincipalMapper;
+}
+/**
+ * Bridge interface containing DI providers and strategy registration for Passport.js.
+ */
+export interface PassportJsStrategyBridge {
+    /** DI providers required for the adapter and its configuration. */
+    providers: Provider[];
+    /** Canonical strategy registration for the fluo auth guard. */
+    strategy: AuthStrategyRegistration;
+}
+/**
+ * A bridge strategy that allows using Passport.js strategies within the fluo
+ * authentication framework.
+ */
+export declare class PassportJsAuthStrategy implements AuthStrategy {
+    private readonly strategyTemplate;
+    private readonly options;
+    private readonly requestState;
+    constructor(strategyTemplate: PassportJsStrategyLike, options?: PassportJsAuthStrategyOptions);
+    authenticate(context: GuardContext): Promise<Principal | AuthHandledResult>;
+    private createExecutableStrategy;
+    private settle;
+    private bindStrategyActions;
+    private createFailureError;
+}
+/**
+ * Creates a DI-aware bridge for a Passport.js strategy.
+ *
+ * @param name Unique name for the strategy.
+ * @param strategyToken Token representing the Passport.js strategy implementation.
+ * @param options Configuration for principal mapping and authentication options.
+ * @returns A bridge object containing providers and the strategy registration.
+ */
+export declare function createPassportJsStrategyBridge(name: string, strategyToken: Token<PassportJsStrategyLike>, options?: PassportJsAuthStrategyOptions): PassportJsStrategyBridge;
+//# sourceMappingURL=passport-js.d.ts.map

package/dist/adapters/passport-js.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport-js.d.ts","sourceRoot":"","sources":["../../src/adapters/passport-js.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAU7F;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5D;AAaD;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,8BAA8B,KAAK,SAAS,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,sEAAsE;IACtE,YAAY,CAAC,EAAE,yBAAyB,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,EAAE,wBAAwB,CAAC;CACpC;AA2FD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,YAAY;IAIvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuE;gBAGjF,gBAAgB,EAAE,sBAAsB,EACxC,OAAO,GAAE,6BAAkC;IAG9D,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC;IA0B3E,OAAO,CAAC,wBAAwB;IAmBhC,OAAO,CAAC,MAAM;IAgBd,OAAO,CAAC,mBAAmB;IAqC3B,OAAO,CAAC,kBAAkB;CAS3B;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAC5C,OAAO,GAAE,6BAAkC,GAC1C,wBAAwB,CAwB1B"}

package/dist/adapters/passport-js.js

@@ -0,0 +1,230 @@
+import { AuthenticationFailedError, AuthenticationRequiredError } from '../errors.js';
+import { normalizePrincipalScopes } from '../scope.js';
+
+/**
+ * Represents a Passport.js strategy-like object that implements
+ * the `authenticate` method.
+ */
+
+/**
+ * Input for the principal mapper that converts Passport.js user data
+ * into a fluo {@link Principal}.
+ */
+
+/**
+ * A function type that maps Passport.js user data to a fluo {@link Principal}.
+ */
+
+/**
+ * Configuration options for the Passport.js authentication strategy.
+ */
+
+/**
+ * Bridge interface containing DI providers and strategy registration for Passport.js.
+ */
+
+function toStringArray(value) {
+  if (!Array.isArray(value)) {
+    return undefined;
+  }
+  const items = value.filter(item => typeof item === 'string');
+  return items.length > 0 ? items : undefined;
+}
+function extractSubject(user) {
+  if (typeof user.sub === 'string' && user.sub.length > 0) {
+    return user.sub;
+  }
+  if (typeof user.id === 'string' && user.id.length > 0) {
+    return user.id;
+  }
+  if (typeof user.id === 'number') {
+    return String(user.id);
+  }
+  if (typeof user.userId === 'string' && user.userId.length > 0) {
+    return user.userId;
+  }
+  return undefined;
+}
+function defaultPrincipalMapper(input) {
+  if (typeof input.user !== 'object' || input.user === null) {
+    throw new AuthenticationFailedError('Passport strategy returned an invalid user payload.');
+  }
+  const claims = {
+    ...input.user
+  };
+  const subject = extractSubject(claims);
+  if (!subject) {
+    throw new AuthenticationFailedError('Passport strategy returned a user payload without a subject or id.');
+  }
+  const issuer = typeof claims.iss === 'string' ? claims.iss : undefined;
+  const audience = typeof claims.aud === 'string' || Array.isArray(claims.aud) ? claims.aud : undefined;
+  return {
+    audience,
+    claims,
+    issuer,
+    roles: toStringArray(claims.roles),
+    scopes: normalizePrincipalScopes(claims),
+    subject
+  };
+}
+function extractChallengeMessage(challenge) {
+  if (typeof challenge === 'string' && challenge.length > 0) {
+    return challenge;
+  }
+  if (typeof challenge === 'object' && challenge !== null) {
+    const message = challenge.message;
+    if (typeof message === 'string' && message.length > 0) {
+      return message;
+    }
+  }
+  return undefined;
+}
+function cloneStrategyStateValue(value) {
+  if (Array.isArray(value)) {
+    return value.slice();
+  }
+  if (value && typeof value === 'object') {
+    try {
+      return structuredClone(value);
+    } catch {
+      return value;
+    }
+  }
+  return value;
+}
+
+/**
+ * A bridge strategy that allows using Passport.js strategies within the fluo
+ * authentication framework.
+ */
+export class PassportJsAuthStrategy {
+  requestState = new WeakMap();
+  constructor(strategyTemplate, options = {}) {
+    this.strategyTemplate = strategyTemplate;
+    this.options = options;
+  }
+  authenticate(context) {
+    const response = context.requestContext.response;
+    const request = context.requestContext.request.raw ?? context.requestContext.request;
+    const strategy = this.createExecutableStrategy();
+    const mapPrincipal = this.options.mapPrincipal ?? defaultPrincipalMapper;
+    return new Promise((resolve, reject) => {
+      this.requestState.set(strategy, {
+        context,
+        mapPrincipal,
+        reject,
+        resolve,
+        response,
+        settled: false
+      });
+      this.bindStrategyActions(strategy);
+      try {
+        strategy.authenticate(request, this.options.authenticateOptions);
+      } catch (error) {
+        this.settle(strategy, () => reject(error));
+      }
+    });
+  }
+  createExecutableStrategy() {
+    const template = this.strategyTemplate;
+    const strategy = Object.create(Object.getPrototypeOf(this.strategyTemplate));
+    for (const key of Reflect.ownKeys(template)) {
+      const value = Reflect.get(template, key);
+      if (typeof value === 'function') {
+        strategy[key] = value.bind(strategy);
+        continue;
+      }
+      strategy[key] = cloneStrategyStateValue(value);
+    }
+    return strategy;
+  }
+  settle(strategy, handler) {
+    const state = this.requestState.get(strategy);
+    if (!state || state.settled) {
+      return;
+    }
+    state.settled = true;
+    try {
+      handler(state);
+    } finally {
+      this.requestState.delete(strategy);
+    }
+  }
+  bindStrategyActions(strategy) {
+    strategy.success = (user, info) => {
+      this.settle(strategy, state => {
+        try {
+          state.resolve(state.mapPrincipal({
+            context: state.context,
+            info,
+            user
+          }));
+        } catch (error) {
+          state.reject(error);
+        }
+      });
+    };
+    strategy.fail = (challenge, status) => {
+      this.settle(strategy, state => {
+        state.reject(this.createFailureError(challenge, status));
+      });
+    };
+    strategy.redirect = (url, status = 302) => {
+      this.settle(strategy, state => {
+        state.response.redirect(status, url);
+        state.resolve({
+          handled: true
+        });
+      });
+    };
+    strategy.pass = () => {
+      this.settle(strategy, state => {
+        state.reject(new AuthenticationRequiredError());
+      });
+    };
+    strategy.error = error => {
+      this.settle(strategy, state => {
+        state.reject(error);
+      });
+    };
+  }
+  createFailureError(challenge, status) {
+    const message = extractChallengeMessage(challenge) ?? 'Authentication required.';
+    if (status === 401 || status === undefined) {
+      return new AuthenticationRequiredError(message);
+    }
+    return new AuthenticationFailedError(message);
+  }
+}
+
+/**
+ * Creates a DI-aware bridge for a Passport.js strategy.
+ *
+ * @param name Unique name for the strategy.
+ * @param strategyToken Token representing the Passport.js strategy implementation.
+ * @param options Configuration for principal mapping and authentication options.
+ * @returns A bridge object containing providers and the strategy registration.
+ */
+export function createPassportJsStrategyBridge(name, strategyToken, options = {}) {
+  const adapterToken = Symbol.for(`fluo.passport.passport-js.adapter.${name}`);
+  const optionsToken = Symbol.for(`fluo.passport.passport-js.options.${name}`);
+  return {
+    providers: [{
+      provide: optionsToken,
+      useValue: {
+        ...options
+      }
+    }, {
+      provide: adapterToken,
+      inject: [strategyToken, optionsToken],
+      useFactory: (...deps) => {
+        const [strategy, resolvedOptions] = deps;
+        return new PassportJsAuthStrategy(strategy, resolvedOptions);
+      }
+    }],
+    strategy: {
+      name,
+      token: adapterToken
+    }
+  };
+}

package/dist/cookie/cookie-auth-module.d.ts

@@ -0,0 +1,65 @@
+import type { Provider } from '@fluojs/di';
+import { type ModuleType } from '@fluojs/runtime';
+import { type CookieAuthOptions } from './cookie-auth.js';
+import { type CookieManagerConfig } from './cookie-manager.js';
+import type { AuthStrategyRegistration } from '../types.js';
+type CookieAuthModuleType = ModuleType;
+/**
+ * Configures the built-in cookie-auth strategy and cookie manager preset.
+ */
+export interface CookieAuthPresetConfig {
+    cookieAuth?: CookieAuthOptions;
+    cookieManager?: CookieManagerConfig;
+}
+/**
+ * Creates the passport strategy registration for the built-in cookie preset.
+ *
+ * @returns The named strategy registration consumed by `PassportModule.forRoot(...)`.
+ */
+export declare function createCookieAuthStrategyRegistration(): AuthStrategyRegistration;
+/**
+ * Creates a compatibility preset bundle for manual provider composition.
+ *
+ * @param config Optional cookie strategy and cookie manager configuration.
+ * @returns The preset providers plus the matching cookie strategy registration.
+ */
+export declare function createCookieAuthPreset(config?: CookieAuthPresetConfig): {
+    providers: Provider[];
+    strategy: AuthStrategyRegistration;
+};
+/**
+ * Canonical module-first entrypoint for the built-in cookie-auth preset.
+ */
+export declare class CookieAuthModule {
+    /**
+     * Registers the cookie-auth strategy and `CookieManager` preset as a module.
+     *
+     * @param config Optional cookie strategy and cookie manager configuration.
+     * @returns A module definition that exports `CookieAuthStrategy` and `CookieManager`.
+     *
+     * @example
+     * ```ts
+     * import { Module } from '@fluojs/core';
+     * import {
+     *   CookieAuthModule,
+     *   CookieAuthStrategy,
+     *   COOKIE_AUTH_STRATEGY_NAME,
+     *   PassportModule,
+     * } from '@fluojs/passport';
+     *
+     * @Module({
+     *   imports: [
+     *     CookieAuthModule.forRoot(),
+     *     PassportModule.forRoot(
+     *       { defaultStrategy: COOKIE_AUTH_STRATEGY_NAME },
+     *       [{ name: COOKIE_AUTH_STRATEGY_NAME, token: CookieAuthStrategy }],
+     *     ),
+     *   ],
+     * })
+     * export class AuthModule {}
+     * ```
+     */
+    static forRoot(config?: CookieAuthPresetConfig): CookieAuthModuleType;
+}
+export {};
+//# sourceMappingURL=cookie-auth-module.d.ts.map

package/dist/cookie/cookie-auth-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-auth-module.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,KAAK,oBAAoB,GAAG,UAAU,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAiBD;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,wBAAwB,CAK/E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG;IACvE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,wBAAwB,CAAC;CACpC,CAKA;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,oBAAoB;CAQtE"}

package/dist/cookie/cookie-auth-module.js

@@ -0,0 +1,84 @@
+import { defineModule } from '@fluojs/runtime';
+import { COOKIE_AUTH_OPTIONS, COOKIE_AUTH_STRATEGY_NAME, CookieAuthStrategy } from './cookie-auth.js';
+import { CookieManager } from './cookie-manager.js';
+
+/**
+ * Configures the built-in cookie-auth strategy and cookie manager preset.
+ */
+
+function createCookieAuthPresetProviders(config) {
+  return [{
+    provide: COOKIE_AUTH_OPTIONS,
+    useValue: config?.cookieAuth ?? {}
+  }, CookieAuthStrategy, {
+    inject: [],
+    provide: CookieManager,
+    useFactory: () => new CookieManager(config?.cookieManager)
+  }];
+}
+
+/**
+ * Creates the passport strategy registration for the built-in cookie preset.
+ *
+ * @returns The named strategy registration consumed by `PassportModule.forRoot(...)`.
+ */
+export function createCookieAuthStrategyRegistration() {
+  return {
+    name: COOKIE_AUTH_STRATEGY_NAME,
+    token: CookieAuthStrategy
+  };
+}
+
+/**
+ * Creates a compatibility preset bundle for manual provider composition.
+ *
+ * @param config Optional cookie strategy and cookie manager configuration.
+ * @returns The preset providers plus the matching cookie strategy registration.
+ */
+export function createCookieAuthPreset(config) {
+  return {
+    providers: createCookieAuthPresetProviders(config),
+    strategy: createCookieAuthStrategyRegistration()
+  };
+}
+
+/**
+ * Canonical module-first entrypoint for the built-in cookie-auth preset.
+ */
+export class CookieAuthModule {
+  /**
+   * Registers the cookie-auth strategy and `CookieManager` preset as a module.
+   *
+   * @param config Optional cookie strategy and cookie manager configuration.
+   * @returns A module definition that exports `CookieAuthStrategy` and `CookieManager`.
+   *
+   * @example
+   * ```ts
+   * import { Module } from '@fluojs/core';
+   * import {
+   *   CookieAuthModule,
+   *   CookieAuthStrategy,
+   *   COOKIE_AUTH_STRATEGY_NAME,
+   *   PassportModule,
+   * } from '@fluojs/passport';
+   *
+   * @Module({
+   *   imports: [
+   *     CookieAuthModule.forRoot(),
+   *     PassportModule.forRoot(
+   *       { defaultStrategy: COOKIE_AUTH_STRATEGY_NAME },
+   *       [{ name: COOKIE_AUTH_STRATEGY_NAME, token: CookieAuthStrategy }],
+   *     ),
+   *   ],
+   * })
+   * export class AuthModule {}
+   * ```
+   */
+  static forRoot(config) {
+    class CookieAuthRuntimeModule extends CookieAuthModule {}
+    return defineModule(CookieAuthRuntimeModule, {
+      exports: [CookieAuthStrategy, CookieManager],
+      providers: createCookieAuthPresetProviders(config)
+    });
+  }
+}

package/dist/cookie/cookie-auth.d.ts

@@ -0,0 +1,40 @@
+import type { GuardContext } from '@fluojs/http';
+import { DefaultJwtVerifier } from '@fluojs/jwt';
+import type { AuthStrategy, AuthStrategyResult } from '../types.js';
+/**
+ * Provides cookie-auth strategy options through dependency injection.
+ */
+export declare const COOKIE_AUTH_OPTIONS: unique symbol;
+/**
+ * Configures cookie names and fallback behavior for cookie-based authentication.
+ */
+export interface CookieAuthOptions {
+    accessTokenCookieName?: string;
+    refreshTokenCookieName?: string;
+    requireAccessToken?: boolean;
+}
+/**
+ * Supplies the default cookie names and access-token requirement for cookie auth.
+ */
+export declare const DEFAULT_COOKIE_AUTH_OPTIONS: Required<CookieAuthOptions>;
+/**
+ * Normalizes optional cookie-auth settings into a fully populated options object.
+ *
+ * @param options Partial cookie-auth configuration supplied by the caller.
+ * @returns Cookie-auth options with defaults applied.
+ */
+export declare function normalizeCookieAuthOptions(options?: CookieAuthOptions): Required<CookieAuthOptions>;
+/**
+ * Authenticates requests by reading and verifying JWTs from HTTP cookies.
+ */
+export declare class CookieAuthStrategy implements AuthStrategy {
+    private readonly verifier;
+    private readonly options;
+    constructor(verifier: DefaultJwtVerifier, options?: CookieAuthOptions);
+    authenticate(context: GuardContext): Promise<AuthStrategyResult>;
+}
+/**
+ * Identifies the built-in cookie authentication strategy.
+ */
+export declare const COOKIE_AUTH_STRATEGY_NAME = "cookie";
+//# sourceMappingURL=cookie-auth.d.ts.map

package/dist/cookie/cookie-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-auth.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,iBAAiB,CAInE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAMnG;AAED;;GAEG;AACH,qBACa,kBAAmB,YAAW,YAAY;IAInD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAGnC,QAAQ,EAAE,kBAAkB,EAC7C,OAAO,CAAC,EAAE,iBAAiB;IAKvB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA6CvE;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAW,CAAC"}

package/dist/cookie/cookie-auth.js

@@ -0,0 +1,101 @@
+let _initClass;
+function _applyDecs(e, t, n, r, o, i) { var a, c, u, s, f, l, p, d = Symbol.metadata || Symbol.for("Symbol.metadata"), m = Object.defineProperty, h = Object.create, y = [h(null), h(null)], v = t.length; function g(t, n, r) { return function (o, i) { n && (i = o, o = e); for (var a = 0; a < t.length; a++) i = t[a].apply(o, r ? [i] : []); return r ? i : o; }; } function b(e, t, n, r) { if ("function" != typeof e && (r || void 0 !== e)) throw new TypeError(t + " must " + (n || "be") + " a function" + (r ? "" : " or undefined")); return e; } function applyDec(e, t, n, r, o, i, u, s, f, l, p) { function d(e) { if (!p(e)) throw new TypeError("Attempted to access private element on non-instance"); } var h = [].concat(t[0]), v = t[3], w = !u, D = 1 === o, S = 3 === o, j = 4 === o, E = 2 === o; function I(t, n, r) { return function (o, i) { return n && (i = o, o = e), r && r(o), P[t].call(o, i); }; } if (!w) { var P = {}, k = [], F = S ? "get" : j || D ? "set" : "value"; if (f ? (l || D ? P = { get: _setFunctionName(function () { return v(this); }, r, "get"), set: function (e) { t[4](this, e); } } : P[F] = v, l || _setFunctionName(P[F], r, E ? "" : F)) : l || (P = Object.getOwnPropertyDescriptor(e, r)), !l && !f) { if ((c = y[+s][r]) && 7 !== (c ^ o)) throw Error("Decorating two elements with the same name (" + P[F].name + ") is not supported yet"); y[+s][r] = o < 3 ? 1 : o; } } for (var N = e, O = h.length - 1; O >= 0; O -= n ? 2 : 1) { var T = b(h[O], "A decorator", "be", !0), z = n ? h[O - 1] : void 0, A = {}, H = { kind: ["field", "accessor", "method", "getter", "setter", "class"][o], name: r, metadata: a, addInitializer: function (e, t) { if (e.v) throw new TypeError("attempted to call addInitializer after decoration was finished"); b(t, "An initializer", "be", !0), i.push(t); }.bind(null, A) }; if (w) c = T.call(z, N, H), A.v = 1, b(c, "class decorators", "return") && (N = c);else if (H.static = s, H.private = f, c = H.access = { has: f ? p.bind() : function (e) { return r in e; } }, j || (c.get = f ? E ? function (e) { return d(e), P.value; } : I("get", 0, d) : function (e) { return e[r]; }), E || S || (c.set = f ? I("set", 0, d) : function (e, t) { e[r] = t; }), N = T.call(z, D ? { get: P.get, set: P.set } : P[F], H), A.v = 1, D) { if ("object" == typeof N && N) (c = b(N.get, "accessor.get")) && (P.get = c), (c = b(N.set, "accessor.set")) && (P.set = c), (c = b(N.init, "accessor.init")) && k.unshift(c);else if (void 0 !== N) throw new TypeError("accessor decorators must return an object with get, set, or init properties or undefined"); } else b(N, (l ? "field" : "method") + " decorators", "return") && (l ? k.unshift(N) : P[F] = N); } return o < 2 && u.push(g(k, s, 1), g(i, s, 0)), l || w || (f ? D ? u.splice(-1, 0, I("get", s), I("set", s)) : u.push(E ? P[F] : b.call.bind(P[F])) : m(e, r, P)), N; } function w(e) { return m(e, d, { configurable: !0, enumerable: !0, value: a }); } return void 0 !== i && (a = i[d]), a = h(null == a ? null : a), f = [], l = function (e) { e && f.push(g(e)); }, p = function (t, r) { for (var i = 0; i < n.length; i++) { var a = n[i], c = a[1], l = 7 & c; if ((8 & c) == t && !l == r) { var p = a[2], d = !!a[3], m = 16 & c; applyDec(t ? e : e.prototype, a, m, d ? "#" + p : _toPropertyKey(p), l, l < 2 ? [] : t ? s = s || [] : u = u || [], f, !!t, d, r, t && d ? function (t) { return _checkInRHS(t) === e; } : o); } } }, p(8, 0), p(0, 0), p(8, 1), p(0, 1), l(u), l(s), c = f, v || w(e), { e: c, get c() { var n = []; return v && [w(e = applyDec(e, [t], r, e.name, 5, n)), g(n, 1)]; } }; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
+function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+function _setFunctionName(e, t, n) { "symbol" == typeof t && (t = (t = t.description) ? "[" + t + "]" : ""); try { Object.defineProperty(e, "name", { configurable: !0, value: n ? n + " " + t : t }); } catch (e) {} return e; }
+function _checkInRHS(e) { if (Object(e) !== e) throw TypeError("right-hand side of 'in' should be an object, got " + (null !== e ? typeof e : "null")); return e; }
+import { Inject } from '@fluojs/core';
+import { DefaultJwtVerifier } from '@fluojs/jwt';
+import { AuthenticationRequiredError } from '../errors.js';
+/**
+ * Provides cookie-auth strategy options through dependency injection.
+ */
+export const COOKIE_AUTH_OPTIONS = Symbol.for('fluo.passport.cookie-auth-options');
+
+/**
+ * Configures cookie names and fallback behavior for cookie-based authentication.
+ */
+
+/**
+ * Supplies the default cookie names and access-token requirement for cookie auth.
+ */
+export const DEFAULT_COOKIE_AUTH_OPTIONS = {
+  accessTokenCookieName: 'access_token',
+  refreshTokenCookieName: 'refresh_token',
+  requireAccessToken: true
+};
+
+/**
+ * Normalizes optional cookie-auth settings into a fully populated options object.
+ *
+ * @param options Partial cookie-auth configuration supplied by the caller.
+ * @returns Cookie-auth options with defaults applied.
+ */
+export function normalizeCookieAuthOptions(options) {
+  return {
+    accessTokenCookieName: options?.accessTokenCookieName ?? DEFAULT_COOKIE_AUTH_OPTIONS.accessTokenCookieName,
+    refreshTokenCookieName: options?.refreshTokenCookieName ?? DEFAULT_COOKIE_AUTH_OPTIONS.refreshTokenCookieName,
+    requireAccessToken: options?.requireAccessToken ?? DEFAULT_COOKIE_AUTH_OPTIONS.requireAccessToken
+  };
+}
+
+/**
+ * Authenticates requests by reading and verifying JWTs from HTTP cookies.
+ */
+let _CookieAuthStrategy;
+class CookieAuthStrategy {
+  static {
+    [_CookieAuthStrategy, _initClass] = _applyDecs(this, [Inject(DefaultJwtVerifier, COOKIE_AUTH_OPTIONS)], []).c;
+  }
+  options;
+  constructor(verifier, options) {
+    this.verifier = verifier;
+    this.options = normalizeCookieAuthOptions(options);
+  }
+  async authenticate(context) {
+    const request = context.requestContext.request;
+    const cookies = request.cookies;
+    if (!cookies || typeof cookies !== 'object') {
+      if (this.options.requireAccessToken) {
+        throw new AuthenticationRequiredError('Access token cookie is required.');
+      }
+      return {
+        claims: {},
+        subject: 'anonymous'
+      };
+    }
+    const accessToken = cookies[this.options.accessTokenCookieName];
+    if (!accessToken) {
+      if (this.options.requireAccessToken) {
+        throw new AuthenticationRequiredError('Access token cookie is required.');
+      }
+      return {
+        claims: {},
+        subject: 'anonymous'
+      };
+    }
+    try {
+      const principal = await this.verifier.verifyAccessToken(accessToken);
+      return {
+        claims: principal.claims,
+        roles: principal.roles,
+        scopes: principal.scopes,
+        subject: principal.subject
+      };
+    } catch (error) {
+      if (error instanceof Error) {
+        throw new AuthenticationRequiredError(error.message);
+      }
+      throw new AuthenticationRequiredError('Access token verification failed.');
+    }
+  }
+  static {
+    _initClass();
+  }
+}
+
+/**
+ * Identifies the built-in cookie authentication strategy.
+ */
+export { _CookieAuthStrategy as CookieAuthStrategy };
+export const COOKIE_AUTH_STRATEGY_NAME = 'cookie';

package/dist/cookie/cookie-manager.d.ts

@@ -0,0 +1,34 @@
+import type { FrameworkResponse } from '@fluojs/http';
+import { type CookieAuthOptions } from './cookie-auth.js';
+export interface CookieOptions {
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    path?: string;
+    domain?: string;
+    maxAge?: number;
+}
+export interface SetCookieOptions extends CookieOptions {
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+}
+export interface CookieManagerConfig extends CookieAuthOptions {
+    cookieOptions?: CookieOptions;
+}
+type NormalizedCookieOptions = Omit<Required<CookieOptions>, 'domain' | 'maxAge'> & Pick<CookieOptions, 'domain' | 'maxAge'>;
+export declare const DEFAULT_COOKIE_OPTIONS: NormalizedCookieOptions;
+export declare class CookieManager {
+    private readonly options;
+    private readonly cookieOptions;
+    constructor(config?: CookieManagerConfig);
+    setAccessTokenCookie(response: FrameworkResponse, token: string, ttlSeconds?: number): void;
+    setRefreshTokenCookie(response: FrameworkResponse, token: string, ttlSeconds?: number): void;
+    clearAccessTokenCookie(response: FrameworkResponse): void;
+    clearRefreshTokenCookie(response: FrameworkResponse): void;
+    clearAllCookies(response: FrameworkResponse): void;
+    setAuthCookies(response: FrameworkResponse, accessToken: string, accessTokenTtlSeconds?: number, refreshToken?: string, refreshTokenTtlSeconds?: number): void;
+    private appendSetCookie;
+}
+export declare function createCookieManager(config?: CookieManagerConfig): CookieManager;
+export {};
+//# sourceMappingURL=cookie-manager.d.ts.map

package/dist/cookie/cookie-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-manager.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAA+B,KAAK,iBAAiB,EAA8B,MAAM,kBAAkB,CAAC;AAEnH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,KAAK,uBAAuB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAC/E,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAE3C,eAAO,MAAM,sBAAsB,EAAE,uBAOpC,CAAC;AAuCF,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;gBAE5C,MAAM,CAAC,EAAE,mBAAmB;IAYxC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa3F,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa5F,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IASzD,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAS1D,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAKlD,cAAc,CACZ,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,MAAM,EACnB,qBAAqB,CAAC,EAAE,MAAM,EAC9B,YAAY,CAAC,EAAE,MAAM,EACrB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,IAAI;IAQP,OAAO,CAAC,eAAe;CAWxB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAE/E"}