@hamak/auth 0.5.1

package/dist/api/types/config.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Auth Configuration Types
+ * Configuration options for the auth system
+ */
+/**
+ * Supported authentication strategy types
+ */
+export type AuthStrategyType = 'password' | 'oauth2' | 'keycloak' | 'oidc' | 'custom';
+/**
+ * Token storage options
+ */
+export type TokenStorageType = 'localStorage' | 'sessionStorage' | 'memory' | 'cookie';
+/**
+ * Password strategy configuration
+ */
+export interface PasswordStrategyConfig {
+    /** Endpoint for login requests */
+    loginEndpoint: string;
+    /** Endpoint for token refresh */
+    refreshEndpoint: string;
+    /** Endpoint for logout */
+    logoutEndpoint: string;
+    /** Endpoint for user info (optional, if not in login response) */
+    userInfoEndpoint?: string;
+    /** Additional headers for auth requests */
+    headers?: Record<string, string>;
+}
+/**
+ * OAuth2 strategy configuration
+ */
+export interface OAuth2StrategyConfig {
+    /** OAuth client ID */
+    clientId: string;
+    /** Client secret (only for server-side flows, not recommended for SPA) */
+    clientSecret?: string;
+    /** Authorization endpoint URL */
+    authorizationUrl: string;
+    /** Token endpoint URL */
+    tokenUrl: string;
+    /** User info endpoint URL */
+    userInfoUrl?: string;
+    /** Redirect URI after authorization */
+    redirectUri: string;
+    /** OAuth scopes to request */
+    scope: string[];
+    /** Whether to use PKCE (recommended for public clients) */
+    usePkce?: boolean;
+    /** Response type (default: 'code') */
+    responseType?: 'code' | 'token';
+    /** Additional authorization params */
+    additionalParams?: Record<string, string>;
+}
+/**
+ * Keycloak-specific configuration
+ */
+export interface KeycloakStrategyConfig {
+    /** Keycloak realm name */
+    realm: string;
+    /** Keycloak server URL */
+    serverUrl: string;
+    /** Client ID in Keycloak */
+    clientId: string;
+    /** Redirect URI after login */
+    redirectUri: string;
+    /** OAuth scopes (defaults to ['openid', 'profile', 'email']) */
+    scope?: string[];
+    /** Whether to use PKCE (default: true) */
+    usePkce?: boolean;
+    /** Enable direct grant (password login) if allowed in Keycloak */
+    enableDirectGrant?: boolean;
+    /** Keycloak realm public key for token validation (optional) */
+    realmPublicKey?: string;
+}
+/**
+ * Auto-refresh configuration
+ */
+export interface AutoRefreshConfig {
+    /** Enable auto-refresh of tokens */
+    enabled: boolean;
+    /** Time before expiry to trigger refresh (in ms, default: 60000) */
+    threshold?: number;
+    /** Interval to check for token expiry (in ms, default: 30000) */
+    checkInterval?: number;
+}
+/**
+ * Session configuration
+ */
+export interface SessionConfig {
+    /** Session timeout in ms (for inactivity) */
+    timeout?: number;
+    /** Warn user before session expires (in ms before timeout) */
+    warnBefore?: number;
+    /** Extend session on activity */
+    extendOnActivity?: boolean;
+}
+/**
+ * Main auth plugin configuration
+ */
+export interface AuthPluginConfig {
+    /** Primary authentication strategy */
+    strategy: AuthStrategyType;
+    /** Password strategy config (when strategy is 'password' or as fallback) */
+    password?: PasswordStrategyConfig;
+    /** OAuth2 strategy config */
+    oauth2?: OAuth2StrategyConfig;
+    /** Keycloak strategy config */
+    keycloak?: KeycloakStrategyConfig;
+    /** Token storage type (default: 'localStorage') */
+    tokenStorage?: TokenStorageType;
+    /** Storage key prefix (default: '@hamak/auth') */
+    storageKeyPrefix?: string;
+    /** Auto-refresh configuration */
+    autoRefresh?: AutoRefreshConfig;
+    /** Session configuration */
+    session?: SessionConfig;
+    /** Routes configuration */
+    routes?: {
+        /** Path to redirect to after login */
+        afterLogin?: string;
+        /** Path to redirect to after logout */
+        afterLogout?: string;
+        /** Login page path */
+        login?: string;
+        /** Unauthorized page path */
+        unauthorized?: string;
+    };
+    /** Enable debug logging */
+    debug?: boolean;
+}
+//# sourceMappingURL=config.d.ts.map

package/dist/api/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/api/types/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAE3B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAElC,6BAA6B;IAC7B,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAE9B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAElC,mDAAmD;IACnD,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAEhC,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,iCAAiC;IACjC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC,4BAA4B;IAC5B,OAAO,CAAC,EAAE,aAAa,CAAC;IAExB,2BAA2B;IAC3B,MAAM,CAAC,EAAE;QACP,sCAAsC;QACtC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,uCAAuC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,sBAAsB;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,6BAA6B;QAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB"}

package/dist/api/types/config.js

@@ -0,0 +1,5 @@
+/**
+ * Auth Configuration Types
+ * Configuration options for the auth system
+ */
+export {};

package/dist/api/types/credentials.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Credentials Types
+ * Types for various authentication credentials
+ */
+/**
+ * Password-based login credentials
+ */
+export interface PasswordCredentials {
+    type: 'password';
+    username: string;
+    password: string;
+    /** Optional remember me flag for persistent sessions */
+    rememberMe?: boolean;
+}
+/**
+ * OAuth authorization code credentials
+ */
+export interface OAuthCredentials {
+    type: 'oauth';
+    /** The authorization code received from OAuth provider */
+    code: string;
+    /** The state parameter for CSRF protection */
+    state?: string;
+    /** The OAuth provider name */
+    provider?: string;
+}
+/**
+ * Token-based credentials (for refresh or API key auth)
+ */
+export interface TokenCredentials {
+    type: 'token';
+    token: string;
+    tokenType?: 'bearer' | 'api-key' | 'refresh';
+}
+/**
+ * Union type for all credential types
+ */
+export type LoginCredentials = PasswordCredentials | OAuthCredentials | TokenCredentials;
+/**
+ * OAuth callback parameters received from the provider
+ */
+export interface OAuthCallbackParams {
+    /** Authorization code */
+    code: string;
+    /** State parameter for CSRF validation */
+    state?: string;
+    /** Error code if authorization failed */
+    error?: string;
+    /** Error description */
+    errorDescription?: string;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/api/types/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/api/types/credentials.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/api/types/credentials.js

@@ -0,0 +1,5 @@
+/**
+ * Credentials Types
+ * Types for various authentication credentials
+ */
+export {};

package/dist/api/types/index.d.ts

@@ -0,0 +1,5 @@
+export * from './user';
+export * from './credentials';
+export * from './auth-result';
+export * from './config';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC"}

package/dist/api/types/index.js

@@ -0,0 +1,4 @@
+export * from './user';
+export * from './credentials';
+export * from './auth-result';
+export * from './config';

package/dist/api/types/user.d.ts

@@ -0,0 +1,39 @@
+/**
+ * User Types
+ * Core user-related type definitions
+ */
+/**
+ * Represents an authenticated user
+ */
+export interface User {
+    /** Unique user identifier */
+    id: string;
+    /** User's email address */
+    email: string;
+    /** User's display name */
+    name?: string;
+    /** User's username (for login) */
+    username?: string;
+    /** URL to user's avatar image */
+    avatar?: string;
+    /** User's assigned roles */
+    roles: string[];
+    /** User's specific permissions */
+    permissions: string[];
+    /** Additional user metadata */
+    metadata?: Record<string, unknown>;
+    /** When the user was created */
+    createdAt?: string;
+    /** When the user was last updated */
+    updatedAt?: string;
+}
+/**
+ * Minimal user info for display purposes
+ */
+export interface UserInfo {
+    id: string;
+    name?: string;
+    email: string;
+    avatar?: string;
+}
+//# sourceMappingURL=user.d.ts.map

package/dist/api/types/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/api/types/user.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IAEX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IAEd,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC,gCAAgC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/api/types/user.js

@@ -0,0 +1,5 @@
+/**
+ * User Types
+ * Core user-related type definitions
+ */
+export {};

package/dist/impl/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @hamak/auth (impl)
+ *
+ * Core implementation of the authentication system.
+ * Provides strategies, services, and plugin integration.
+ */
+export * from '../api';
+export * from '../spi';
+export * from './plugin';
+export * from './services';
+export * from './strategies';
+export * from './storage';
+export * from './store';
+export * from './utils';
+//# sourceMappingURL=index.d.ts.map

package/dist/impl/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/impl/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC;AAGvB,cAAc,UAAU,CAAC;AAGzB,cAAc,YAAY,CAAC;AAG3B,cAAc,cAAc,CAAC;AAG7B,cAAc,WAAW,CAAC;AAG1B,cAAc,SAAS,CAAC;AAGxB,cAAc,SAAS,CAAC"}

package/dist/impl/index.js

@@ -0,0 +1,21 @@
+/**
+ * @hamak/auth (impl)
+ *
+ * Core implementation of the authentication system.
+ * Provides strategies, services, and plugin integration.
+ */
+// Re-export API and SPI types for convenience
+export * from '../api';
+export * from '../spi';
+// Plugin factory
+export * from './plugin';
+// Services
+export * from './services';
+// Strategies
+export * from './strategies';
+// Storage
+export * from './storage';
+// Store
+export * from './store';
+// Utilities
+export * from './utils';

package/dist/impl/plugin/auth-plugin-factory.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Auth Plugin Factory
+ * Creates the authentication plugin for the microkernel
+ */
+import type { PluginModule } from '@hamak/microkernel-spi';
+import type { AuthPluginConfig, IAuthService } from '../../api';
+/**
+ * Create the auth plugin
+ *
+ * @param config The auth plugin configuration
+ * @param axiosModule The axios module (optional, for custom HTTP client)
+ */
+export declare function createAuthPlugin(config: AuthPluginConfig, axiosModule?: typeof import('axios').default): PluginModule;
+/**
+ * Get the auth service from the plugin context
+ */
+export declare function getAuthService(ctx: {
+    resolve: (token: symbol) => unknown;
+}): IAuthService;
+//# sourceMappingURL=auth-plugin-factory.d.ts.map

package/dist/impl/plugin/auth-plugin-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-plugin-factory.d.ts","sourceRoot":"","sources":["../../../src/impl/plugin/auth-plugin-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAsFhE;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,EACxB,WAAW,CAAC,EAAE,cAAc,OAAO,EAAE,OAAO,GAC3C,YAAY,CAuLd;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;CAAE,GAAG,YAAY,CAEzF"}

package/dist/impl/plugin/auth-plugin-factory.js

@@ -0,0 +1,226 @@
+/**
+ * Auth Plugin Factory
+ * Creates the authentication plugin for the microkernel
+ */
+import { AUTH_SERVICE_TOKEN, AUTH_STRATEGY_REGISTRY_TOKEN, TOKEN_STORAGE_TOKEN } from '../../api';
+import { AuthService } from '../services/AuthService';
+import { StrategyRegistry } from '../strategies/StrategyRegistry';
+import { PasswordStrategy } from '../strategies/PasswordStrategy';
+import { OAuth2Strategy } from '../strategies/OAuth2Strategy';
+import { KeycloakStrategy } from '../strategies/KeycloakStrategy';
+import { createTokenStorage } from '../storage';
+import { authReducer } from '../store/auth-reducer';
+/**
+ * Store extensions registry token (from ui-store)
+ */
+const STORE_EXTENSIONS_TOKEN = Symbol.for('@hamak/ui-store:StoreExtensionsRegistry');
+/**
+ * Axios-based HTTP client adapter
+ */
+function createAxiosHttpClient(axios) {
+    const instance = axios.create();
+    return {
+        async get(url, config) {
+            const response = await instance.get(url, {
+                headers: config?.headers,
+                params: config?.params,
+                timeout: config?.timeout
+            });
+            return {
+                data: response.data,
+                status: response.status,
+                headers: response.headers
+            };
+        },
+        async post(url, data, config) {
+            const response = await instance.post(url, data, {
+                headers: config?.headers,
+                params: config?.params,
+                timeout: config?.timeout
+            });
+            return {
+                data: response.data,
+                status: response.status,
+                headers: response.headers
+            };
+        },
+        async put(url, data, config) {
+            const response = await instance.put(url, data, {
+                headers: config?.headers,
+                params: config?.params,
+                timeout: config?.timeout
+            });
+            return {
+                data: response.data,
+                status: response.status,
+                headers: response.headers
+            };
+        },
+        async delete(url, config) {
+            const response = await instance.delete(url, {
+                headers: config?.headers,
+                params: config?.params,
+                timeout: config?.timeout
+            });
+            return {
+                data: response.data,
+                status: response.status,
+                headers: response.headers
+            };
+        }
+    };
+}
+/**
+ * Create the auth plugin
+ *
+ * @param config The auth plugin configuration
+ * @param axiosModule The axios module (optional, for custom HTTP client)
+ */
+export function createAuthPlugin(config, axiosModule) {
+    let authService;
+    let strategyRegistry;
+    let tokenStorage;
+    let refreshInterval = null;
+    return {
+        async initialize(ctx) {
+            // Create HTTP client
+            const axios = axiosModule || (await import('axios')).default;
+            const httpClient = createAxiosHttpClient(axios);
+            // Create token storage
+            tokenStorage = createTokenStorage(config.tokenStorage || 'localStorage', { keyPrefix: config.storageKeyPrefix });
+            // Create strategy registry
+            strategyRegistry = new StrategyRegistry();
+            // Register strategies based on config
+            if (config.strategy === 'password' && config.password) {
+                const passwordStrategy = new PasswordStrategy(config.password, httpClient, 'password');
+                strategyRegistry.register(passwordStrategy);
+            }
+            if (config.strategy === 'oauth2' && config.oauth2) {
+                const oauth2Strategy = new OAuth2Strategy(config.oauth2, httpClient, 'oauth2');
+                strategyRegistry.register(oauth2Strategy);
+            }
+            if (config.strategy === 'keycloak' && config.keycloak) {
+                const keycloakStrategy = new KeycloakStrategy(config.keycloak, httpClient, 'keycloak');
+                strategyRegistry.register(keycloakStrategy);
+            }
+            // Create auth service
+            authService = new AuthService(strategyRegistry, tokenStorage);
+            // Provide services via DI container
+            ctx.provide({ provide: AUTH_SERVICE_TOKEN, useValue: authService });
+            ctx.provide({ provide: AUTH_STRATEGY_REGISTRY_TOKEN, useValue: strategyRegistry });
+            ctx.provide({ provide: TOKEN_STORAGE_TOKEN, useValue: tokenStorage });
+            // Register auth reducer with store if available
+            try {
+                const storeExtensions = ctx.resolve(STORE_EXTENSIONS_TOKEN);
+                if (storeExtensions) {
+                    storeExtensions.register('auth', {
+                        reducers: { auth: authReducer }
+                    });
+                }
+            }
+            catch {
+                // Store not available, that's fine
+                if (config.debug) {
+                    console.log('[Auth] Store extensions not available, skipping reducer registration');
+                }
+            }
+            // Register commands
+            ctx.commands.register('auth.login', async (credentials) => {
+                return authService.login(credentials);
+            });
+            ctx.commands.register('auth.logout', async () => {
+                return authService.logout();
+            });
+            ctx.commands.register('auth.refresh', async () => {
+                return authService.refreshToken();
+            });
+            ctx.commands.register('auth.isAuthenticated', () => {
+                return authService.isAuthenticated();
+            });
+            ctx.commands.register('auth.getCurrentUser', () => {
+                return authService.getCurrentUser();
+            });
+            ctx.commands.register('auth.getAccessToken', () => {
+                return authService.getAccessToken();
+            });
+            ctx.commands.register('auth.hasRole', (role) => {
+                return authService.hasRole(role);
+            });
+            ctx.commands.register('auth.hasPermission', (permission) => {
+                return authService.hasPermission(permission);
+            });
+            ctx.commands.register('auth.initiateOAuth', (provider) => {
+                authService.initiateOAuth(provider);
+            });
+            ctx.commands.register('auth.handleOAuthCallback', async (params) => {
+                return authService.handleOAuthCallback(params);
+            });
+            if (config.debug) {
+                console.log('[Auth] Plugin initialized with strategy:', config.strategy);
+            }
+        },
+        async activate(ctx) {
+            // Initialize auth service (restore session)
+            await authService.initialize();
+            // Setup auto-refresh if enabled
+            if (config.autoRefresh?.enabled) {
+                const threshold = config.autoRefresh.threshold || 60000;
+                const checkInterval = config.autoRefresh.checkInterval || 30000;
+                refreshInterval = setInterval(async () => {
+                    if (authService.isAuthenticated() && tokenStorage.isTokenExpiringSoon(threshold)) {
+                        if (config.debug) {
+                            console.log('[Auth] Token expiring soon, refreshing...');
+                        }
+                        const result = await authService.refreshToken();
+                        if (result.success) {
+                            ctx.hooks.emit('auth:token-refresh', { success: true });
+                        }
+                        else {
+                            ctx.hooks.emit('auth:token-refresh-failed', { error: result.error });
+                        }
+                    }
+                }, checkInterval);
+            }
+            // Subscribe to auth state changes and emit hooks
+            authService.onAuthStateChange((isAuthenticated, user, changeType) => {
+                switch (changeType) {
+                    case 'login':
+                        ctx.hooks.emit('auth:login-success', { user });
+                        break;
+                    case 'logout':
+                        ctx.hooks.emit('auth:logout', {});
+                        break;
+                    case 'session_expired':
+                        ctx.hooks.emit('auth:session-expired', {});
+                        break;
+                    case 'token_refresh':
+                        ctx.hooks.emit('auth:token-refresh', { user });
+                        break;
+                }
+                // Always emit state change
+                ctx.hooks.emit('auth:state-change', { isAuthenticated, user, changeType });
+            });
+            // Emit ready event
+            ctx.hooks.emit('auth:ready', {
+                authenticated: authService.isAuthenticated(),
+                user: authService.getCurrentUser()
+            });
+            if (config.debug) {
+                console.log('[Auth] Plugin activated, authenticated:', authService.isAuthenticated());
+            }
+        },
+        deactivate() {
+            if (refreshInterval) {
+                clearInterval(refreshInterval);
+                refreshInterval = null;
+            }
+            authService.destroy();
+        }
+    };
+}
+/**
+ * Get the auth service from the plugin context
+ */
+export function getAuthService(ctx) {
+    return ctx.resolve(AUTH_SERVICE_TOKEN);
+}

package/dist/impl/plugin/index.d.ts

@@ -0,0 +1,2 @@
+export * from './auth-plugin-factory';
+//# sourceMappingURL=index.d.ts.map

package/dist/impl/plugin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/impl/plugin/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC"}

package/dist/impl/plugin/index.js

@@ -0,0 +1 @@
+export * from './auth-plugin-factory';

package/dist/impl/services/AuthService.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Auth Service Implementation
+ * Core authentication service that orchestrates strategies and storage
+ */
+import type { AuthResult, AuthStateCallback, IAuthService, LoginCredentials, OAuthCallbackParams, User } from '../../api';
+import type { IStrategyRegistry, ITokenStorage } from '../../spi';
+/**
+ * Auth service implementation
+ *
+ * Provides a unified authentication API that delegates to registered
+ * strategies and manages token storage and state.
+ */
+export declare class AuthService implements IAuthService {
+    private readonly strategyRegistry;
+    private readonly tokenStorage;
+    private user;
+    private listeners;
+    private initialized;
+    constructor(strategyRegistry: IStrategyRegistry, tokenStorage: ITokenStorage);
+    initialize(): Promise<void>;
+    destroy(): void;
+    isAuthenticated(): boolean;
+    getCurrentUser(): User | null;
+    getAccessToken(): string | null;
+    getPermissions(): string[];
+    getRoles(): string[];
+    hasPermission(permission: string): boolean;
+    hasRole(role: string): boolean;
+    hasAnyRole(roles: string[]): boolean;
+    hasAllRoles(roles: string[]): boolean;
+    login(credentials: LoginCredentials): Promise<AuthResult>;
+    logout(): Promise<void>;
+    refreshToken(): Promise<AuthResult>;
+    initiateOAuth(provider?: string): void;
+    handleOAuthCallback(params: OAuthCallbackParams): Promise<AuthResult>;
+    getAuthorizationUrl(provider?: string): string | null;
+    onAuthStateChange(callback: AuthStateCallback): () => void;
+    private handleAuthSuccess;
+    private notifyListeners;
+    private getStrategyForCredentials;
+    private getOAuthStrategy;
+    private isOAuthStrategy;
+}
+//# sourceMappingURL=AuthService.d.ts.map

package/dist/impl/services/AuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.d.ts","sourceRoot":"","sources":["../../../src/impl/services/AuthService.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAEjB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,IAAI,EACL,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAGV,iBAAiB,EACjB,aAAa,EACd,MAAM,WAAW,CAAC;AAEnB;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,YAAY;IAM5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAN/B,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,SAAS,CAAgC;IACjD,OAAO,CAAC,WAAW,CAAS;gBAGT,gBAAgB,EAAE,iBAAiB,EACnC,YAAY,EAAE,aAAa;IAOxC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjC,OAAO,IAAI,IAAI;IASf,eAAe,IAAI,OAAO;IAI1B,cAAc,IAAI,IAAI,GAAG,IAAI;IAI7B,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,cAAc,IAAI,MAAM,EAAE;IAI1B,QAAQ,IAAI,MAAM,EAAE;IAIpB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAI1C,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;IAKpC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;IAS/B,KAAK,CAAC,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAqBzD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBvB,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC;IAyCzC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAahC,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC;IAsC3E,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoBrD,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,IAAI;IAS1D,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAWvB,OAAO,CAAC,yBAAyB;IAqBjC,OAAO,CAAC,gBAAgB;IAexB,OAAO,CAAC,eAAe;CAGxB"}