@hanzo/cms-auth-iam 1.0.0

package/LICENSE.md

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2018-2025 Payload CMS, Inc. <info@payloadcms.com>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+import type { Field } from '@hanzo/cms';
+export { hanzoIAMStrategy } from './strategy.js';
+export type { HanzoIAMStrategyConfig, IAMClaims } from './types.js';
+/**
+ * Fields the IAM strategy needs on the auth collection to map + dedupe users.
+ * Spread these into your users collection `fields`.
+ *
+ *   fields: [...iamAuthFields, ...yourFields]
+ */
+export declare const iamAuthFields: Field[];
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,KAAK,EA6BhC,CAAA"}

package/dist/index.js

@@ -0,0 +1,44 @@
+export { hanzoIAMStrategy } from './strategy.js';
+/**
+ * Fields the IAM strategy needs on the auth collection to map + dedupe users.
+ * Spread these into your users collection `fields`.
+ *
+ *   fields: [...iamAuthFields, ...yourFields]
+ */ export const iamAuthFields = [
+    {
+        // Auth collections with `disableLocalStrategy: true` do NOT get the email
+        // field auto-added (that comes from the local strategy), so add it here.
+        name: 'email',
+        type: 'email',
+        index: true,
+        label: 'Email'
+    },
+    {
+        name: 'iamSub',
+        type: 'text',
+        admin: {
+            description: 'Hanzo IAM subject (user id).',
+            readOnly: true
+        },
+        index: true,
+        label: 'IAM Subject',
+        unique: true
+    },
+    {
+        name: 'iamOrg',
+        type: 'text',
+        admin: {
+            description: 'Hanzo IAM org slug (== tenant).',
+            readOnly: true
+        },
+        index: true,
+        label: 'IAM Org'
+    },
+    {
+        name: 'username',
+        type: 'text',
+        label: 'Username'
+    }
+];
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Field } from '@hanzo/cms'\n\nexport { hanzoIAMStrategy } from './strategy.js'\nexport type { HanzoIAMStrategyConfig, IAMClaims } from './types.js'\n\n/**\n * Fields the IAM strategy needs on the auth collection to map + dedupe users.\n * Spread these into your users collection `fields`.\n *\n *   fields: [...iamAuthFields, ...yourFields]\n */\nexport const iamAuthFields: Field[] = [\n  {\n    // Auth collections with `disableLocalStrategy: true` do NOT get the email\n    // field auto-added (that comes from the local strategy), so add it here.\n    name: 'email',\n    type: 'email',\n    index: true,\n    label: 'Email',\n  },\n  {\n    name: 'iamSub',\n    type: 'text',\n    admin: { description: 'Hanzo IAM subject (user id).', readOnly: true },\n    index: true,\n    label: 'IAM Subject',\n    unique: true,\n  },\n  {\n    name: 'iamOrg',\n    type: 'text',\n    admin: { description: 'Hanzo IAM org slug (== tenant).', readOnly: true },\n    index: true,\n    label: 'IAM Org',\n  },\n  {\n    name: 'username',\n    type: 'text',\n    label: 'Username',\n  },\n]\n"],"names":["hanzoIAMStrategy","iamAuthFields","name","type","index","label","admin","description","readOnly","unique"],"mappings":"AAEA,SAASA,gBAAgB,QAAQ,gBAAe;AAGhD;;;;;CAKC,GACD,OAAO,MAAMC,gBAAyB;IACpC;QACE,0EAA0E;QAC1E,yEAAyE;QACzEC,MAAM;QACNC,MAAM;QACNC,OAAO;QACPC,OAAO;IACT;IACA;QACEH,MAAM;QACNC,MAAM;QACNG,OAAO;YAAEC,aAAa;YAAgCC,UAAU;QAAK;QACrEJ,OAAO;QACPC,OAAO;QACPI,QAAQ;IACV;IACA;QACEP,MAAM;QACNC,MAAM;QACNG,OAAO;YAAEC,aAAa;YAAmCC,UAAU;QAAK;QACxEJ,OAAO;QACPC,OAAO;IACT;IACA;QACEH,MAAM;QACNC,MAAM;QACNE,OAAO;IACT;CACD,CAAA"}

package/dist/strategy.d.ts

@@ -0,0 +1,16 @@
+import type { AuthStrategy } from '@hanzo/cms';
+import type { HanzoIAMStrategyConfig } from './types.js';
+/**
+ * The Hanzo IAM SSO auth strategy.
+ *
+ * Validates a Bearer access token issued by Hanzo IAM (Casdoor, RS256) against
+ * the published JWKS — no shared secret, no per-request round-trip to IAM. Maps
+ * the verified claims to a CMS user (find-or-provision by IAM `sub`), links
+ * the user to the tenant derived from the IAM `owner` org (org == tenant), and
+ * sets the `cms-tenant` cookie so the multi-tenant plugin scopes every
+ * subsequent query to that org.
+ *
+ * IAM is the sole identity authority: there is no separate CMS login.
+ */
+export declare const hanzoIAMStrategy: (config?: HanzoIAMStrategyConfig) => AuthStrategy;
+//# sourceMappingURL=strategy.d.ts.map

package/dist/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAqD,MAAM,YAAY,CAAA;AAIjG,OAAO,KAAK,EAAE,sBAAsB,EAAa,MAAM,YAAY,CAAA;AAoEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,YAAY,sBAAsB,KAAQ,YAyFtE,CAAA"}

package/dist/strategy.js

@@ -0,0 +1,164 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+const DEFAULT_ISSUER = 'https://hanzo.id';
+const DEFAULT_JWKS = 'https://hanzo.id/v1/iam/.well-known/jwks';
+/** Lazily-built, per-JWKS-URL cached remote key set (jose caches internally). */ const jwksCache = new Map();
+const getJWKS = (uri)=>{
+    let set = jwksCache.get(uri);
+    if (!set) {
+        set = createRemoteJWKSet(new URL(uri));
+        jwksCache.set(uri, set);
+    }
+    return set;
+};
+const getBearer = (headers)=>{
+    const raw = headers.get('authorization') || headers.get('Authorization');
+    if (!raw) {
+        return null;
+    }
+    const [scheme, token] = raw.split(' ');
+    if (!scheme || !token || scheme.toLowerCase() !== 'bearer') {
+        return null;
+    }
+    return token.trim();
+};
+/**
+ * Provision-or-refresh the tenant doc for an IAM org (org == tenant), returning
+ * its id. Idempotent: keyed on the org slug.
+ */ const ensureTenant = async (args)=>{
+    const { claims, cms, tenantsSlug } = args;
+    const slug = claims.owner;
+    if (!slug) {
+        return undefined;
+    }
+    // Only touch the collection if it actually exists in this config.
+    if (!cms.collections?.[tenantsSlug]) {
+        return undefined;
+    }
+    const existing = await cms.find({
+        collection: tenantsSlug,
+        depth: 0,
+        limit: 1,
+        where: {
+            slug: {
+                equals: slug
+            }
+        }
+    });
+    const existingDoc = existing.docs[0];
+    if (existingDoc) {
+        return existingDoc.id;
+    }
+    const created = await cms.create({
+        collection: tenantsSlug,
+        data: {
+            name: slug,
+            slug
+        }
+    });
+    return created.id;
+};
+/**
+ * The Hanzo IAM SSO auth strategy.
+ *
+ * Validates a Bearer access token issued by Hanzo IAM (Casdoor, RS256) against
+ * the published JWKS — no shared secret, no per-request round-trip to IAM. Maps
+ * the verified claims to a CMS user (find-or-provision by IAM `sub`), links
+ * the user to the tenant derived from the IAM `owner` org (org == tenant), and
+ * sets the `cms-tenant` cookie so the multi-tenant plugin scopes every
+ * subsequent query to that org.
+ *
+ * IAM is the sole identity authority: there is no separate CMS login.
+ */ export const hanzoIAMStrategy = (config = {})=>{
+    const name = config.name || 'hanzo-iam';
+    const authSlug = config.authSlug || 'users';
+    const tenantsSlug = config.tenantsSlug || 'tenants';
+    const tenantsArrayField = config.tenantsArrayField || 'tenants';
+    const issuer = config.issuer || process.env.HANZO_IAM_ISSUER || DEFAULT_ISSUER;
+    const jwksUri = config.jwksUri || process.env.HANZO_IAM_JWKS_URI || DEFAULT_JWKS;
+    return {
+        name,
+        authenticate: async ({ canSetHeaders, headers, cms })=>{
+            const token = getBearer(headers);
+            if (!token) {
+                return {
+                    user: null
+                };
+            }
+            let claims;
+            try {
+                const { payload: verified } = await jwtVerify(token, getJWKS(jwksUri), {
+                    issuer
+                });
+                claims = verified;
+            } catch  {
+                // invalid / expired / wrong-issuer token → anonymous
+                return {
+                    user: null
+                };
+            }
+            if (!claims.sub) {
+                return {
+                    user: null
+                };
+            }
+            const tenantID = await ensureTenant({
+                claims,
+                cms,
+                tenantsSlug
+            });
+            // find-or-provision the user by IAM subject
+            const found = await cms.find({
+                collection: authSlug,
+                depth: 0,
+                limit: 1,
+                where: {
+                    iamSub: {
+                        equals: claims.sub
+                    }
+                }
+            });
+            const baseData = {
+                email: claims.email || `${claims.sub}@iam.local`,
+                iamOrg: claims.owner,
+                iamSub: claims.sub,
+                username: claims.name,
+                ...config.claimsToUser ? config.claimsToUser(claims) : {},
+                ...tenantID !== undefined ? {
+                    [tenantsArrayField]: [
+                        {
+                            tenant: tenantID
+                        }
+                    ]
+                } : {}
+            };
+            let userDoc;
+            const foundUser = found.docs[0];
+            if (foundUser) {
+                userDoc = await cms.update({
+                    id: foundUser.id,
+                    collection: authSlug,
+                    data: baseData
+                });
+            } else {
+                userDoc = await cms.create({
+                    collection: authSlug,
+                    data: baseData
+                });
+            }
+            const responseHeaders = new Headers();
+            if (canSetHeaders && tenantID !== undefined) {
+                responseHeaders.append('Set-Cookie', `cms-tenant=${encodeURIComponent(String(tenantID))}; Path=/; SameSite=Lax; HttpOnly`);
+            }
+            return {
+                responseHeaders: canSetHeaders ? responseHeaders : undefined,
+                user: {
+                    ...userDoc,
+                    _strategy: name,
+                    collection: authSlug
+                }
+            };
+        }
+    };
+};
+
+//# sourceMappingURL=strategy.js.map

package/dist/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/strategy.ts"],"sourcesContent":["import type { AuthStrategy, AuthStrategyFunctionArgs, AuthStrategyResult, CMS } from '@hanzo/cms'\n\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\n\nimport type { HanzoIAMStrategyConfig, IAMClaims } from './types.js'\n\nconst DEFAULT_ISSUER = 'https://hanzo.id'\nconst DEFAULT_JWKS = 'https://hanzo.id/v1/iam/.well-known/jwks'\n\n/** Lazily-built, per-JWKS-URL cached remote key set (jose caches internally). */\nconst jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getJWKS = (uri: string) => {\n  let set = jwksCache.get(uri)\n  if (!set) {\n    set = createRemoteJWKSet(new URL(uri))\n    jwksCache.set(uri, set)\n  }\n  return set\n}\n\nconst getBearer = (headers: AuthStrategyFunctionArgs['headers']): null | string => {\n  const raw = headers.get('authorization') || headers.get('Authorization')\n  if (!raw) {\n    return null\n  }\n  const [scheme, token] = raw.split(' ')\n  if (!scheme || !token || scheme.toLowerCase() !== 'bearer') {\n    return null\n  }\n  return token.trim()\n}\n\n/**\n * Provision-or-refresh the tenant doc for an IAM org (org == tenant), returning\n * its id. Idempotent: keyed on the org slug.\n */\nconst ensureTenant = async (args: {\n  claims: IAMClaims\n  cms: CMS\n  tenantsSlug: string\n}): Promise<number | string | undefined> => {\n  const { claims, cms, tenantsSlug } = args\n  const slug = claims.owner\n  if (!slug) {\n    return undefined\n  }\n\n  // Only touch the collection if it actually exists in this config.\n  if (!cms.collections?.[tenantsSlug]) {\n    return undefined\n  }\n\n  const existing = await cms.find({\n    collection: tenantsSlug,\n    depth: 0,\n    limit: 1,\n    where: { slug: { equals: slug } },\n  })\n\n  const existingDoc = existing.docs[0]\n  if (existingDoc) {\n    return existingDoc.id as number | string\n  }\n\n  const created = await cms.create({\n    collection: tenantsSlug,\n    data: { name: slug, slug },\n  })\n  return created.id as number | string\n}\n\n/**\n * The Hanzo IAM SSO auth strategy.\n *\n * Validates a Bearer access token issued by Hanzo IAM (Casdoor, RS256) against\n * the published JWKS — no shared secret, no per-request round-trip to IAM. Maps\n * the verified claims to a CMS user (find-or-provision by IAM `sub`), links\n * the user to the tenant derived from the IAM `owner` org (org == tenant), and\n * sets the `cms-tenant` cookie so the multi-tenant plugin scopes every\n * subsequent query to that org.\n *\n * IAM is the sole identity authority: there is no separate CMS login.\n */\nexport const hanzoIAMStrategy = (config: HanzoIAMStrategyConfig = {}): AuthStrategy => {\n  const name = config.name || 'hanzo-iam'\n  const authSlug = config.authSlug || 'users'\n  const tenantsSlug = config.tenantsSlug || 'tenants'\n  const tenantsArrayField = config.tenantsArrayField || 'tenants'\n  const issuer = config.issuer || process.env.HANZO_IAM_ISSUER || DEFAULT_ISSUER\n  const jwksUri = config.jwksUri || process.env.HANZO_IAM_JWKS_URI || DEFAULT_JWKS\n\n  return {\n    name,\n    authenticate: async ({\n      canSetHeaders,\n      headers,\n      cms,\n    }: AuthStrategyFunctionArgs): Promise<AuthStrategyResult> => {\n      const token = getBearer(headers)\n      if (!token) {\n        return { user: null }\n      }\n\n      let claims: IAMClaims\n      try {\n        const { payload: verified } = await jwtVerify(token, getJWKS(jwksUri), {\n          issuer,\n        })\n        claims = verified as IAMClaims\n      } catch {\n        // invalid / expired / wrong-issuer token → anonymous\n        return { user: null }\n      }\n\n      if (!claims.sub) {\n        return { user: null }\n      }\n\n      const tenantID = await ensureTenant({ claims, cms, tenantsSlug })\n\n      // find-or-provision the user by IAM subject\n      const found = await cms.find({\n        collection: authSlug,\n        depth: 0,\n        limit: 1,\n        where: { iamSub: { equals: claims.sub } },\n      })\n\n      const baseData = {\n        email: claims.email || `${claims.sub}@iam.local`,\n        iamOrg: claims.owner,\n        iamSub: claims.sub,\n        username: claims.name,\n        ...(config.claimsToUser ? config.claimsToUser(claims) : {}),\n        ...(tenantID !== undefined\n          ? { [tenantsArrayField]: [{ tenant: tenantID }] }\n          : {}),\n      }\n\n      let userDoc\n      const foundUser = found.docs[0]\n      if (foundUser) {\n        userDoc = await cms.update({\n          id: foundUser.id,\n          collection: authSlug,\n          data: baseData,\n        })\n      } else {\n        userDoc = await cms.create({\n          collection: authSlug,\n          data: baseData,\n        })\n      }\n\n      const responseHeaders = new Headers()\n      if (canSetHeaders && tenantID !== undefined) {\n        responseHeaders.append(\n          'Set-Cookie',\n          `cms-tenant=${encodeURIComponent(String(tenantID))}; Path=/; SameSite=Lax; HttpOnly`,\n        )\n      }\n\n      return {\n        responseHeaders: canSetHeaders ? responseHeaders : undefined,\n        user: {\n          ...userDoc,\n          _strategy: name,\n          collection: authSlug,\n        },\n      }\n    },\n  }\n}\n"],"names":["createRemoteJWKSet","jwtVerify","DEFAULT_ISSUER","DEFAULT_JWKS","jwksCache","Map","getJWKS","uri","set","get","URL","getBearer","headers","raw","scheme","token","split","toLowerCase","trim","ensureTenant","args","claims","cms","tenantsSlug","slug","owner","undefined","collections","existing","find","collection","depth","limit","where","equals","existingDoc","docs","id","created","create","data","name","hanzoIAMStrategy","config","authSlug","tenantsArrayField","issuer","process","env","HANZO_IAM_ISSUER","jwksUri","HANZO_IAM_JWKS_URI","authenticate","canSetHeaders","user","payload","verified","sub","tenantID","found","iamSub","baseData","email","iamOrg","username","claimsToUser","tenant","userDoc","foundUser","update","responseHeaders","Headers","append","encodeURIComponent","String","_strategy"],"mappings":"AAEA,SAASA,kBAAkB,EAAEC,SAAS,QAAQ,OAAM;AAIpD,MAAMC,iBAAiB;AACvB,MAAMC,eAAe;AAErB,+EAA+E,GAC/E,MAAMC,YAAY,IAAIC;AAEtB,MAAMC,UAAU,CAACC;IACf,IAAIC,MAAMJ,UAAUK,GAAG,CAACF;IACxB,IAAI,CAACC,KAAK;QACRA,MAAMR,mBAAmB,IAAIU,IAAIH;QACjCH,UAAUI,GAAG,CAACD,KAAKC;IACrB;IACA,OAAOA;AACT;AAEA,MAAMG,YAAY,CAACC;IACjB,MAAMC,MAAMD,QAAQH,GAAG,CAAC,oBAAoBG,QAAQH,GAAG,CAAC;IACxD,IAAI,CAACI,KAAK;QACR,OAAO;IACT;IACA,MAAM,CAACC,QAAQC,MAAM,GAAGF,IAAIG,KAAK,CAAC;IAClC,IAAI,CAACF,UAAU,CAACC,SAASD,OAAOG,WAAW,OAAO,UAAU;QAC1D,OAAO;IACT;IACA,OAAOF,MAAMG,IAAI;AACnB;AAEA;;;CAGC,GACD,MAAMC,eAAe,OAAOC;IAK1B,MAAM,EAAEC,MAAM,EAAEC,GAAG,EAAEC,WAAW,EAAE,GAAGH;IACrC,MAAMI,OAAOH,OAAOI,KAAK;IACzB,IAAI,CAACD,MAAM;QACT,OAAOE;IACT;IAEA,kEAAkE;IAClE,IAAI,CAACJ,IAAIK,WAAW,EAAE,CAACJ,YAAY,EAAE;QACnC,OAAOG;IACT;IAEA,MAAME,WAAW,MAAMN,IAAIO,IAAI,CAAC;QAC9BC,YAAYP;QACZQ,OAAO;QACPC,OAAO;QACPC,OAAO;YAAET,MAAM;gBAAEU,QAAQV;YAAK;QAAE;IAClC;IAEA,MAAMW,cAAcP,SAASQ,IAAI,CAAC,EAAE;IACpC,IAAID,aAAa;QACf,OAAOA,YAAYE,EAAE;IACvB;IAEA,MAAMC,UAAU,MAAMhB,IAAIiB,MAAM,CAAC;QAC/BT,YAAYP;QACZiB,MAAM;YAAEC,MAAMjB;YAAMA;QAAK;IAC3B;IACA,OAAOc,QAAQD,EAAE;AACnB;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,MAAMK,mBAAmB,CAACC,SAAiC,CAAC,CAAC;IAClE,MAAMF,OAAOE,OAAOF,IAAI,IAAI;IAC5B,MAAMG,WAAWD,OAAOC,QAAQ,IAAI;IACpC,MAAMrB,cAAcoB,OAAOpB,WAAW,IAAI;IAC1C,MAAMsB,oBAAoBF,OAAOE,iBAAiB,IAAI;IACtD,MAAMC,SAASH,OAAOG,MAAM,IAAIC,QAAQC,GAAG,CAACC,gBAAgB,IAAI/C;IAChE,MAAMgD,UAAUP,OAAOO,OAAO,IAAIH,QAAQC,GAAG,CAACG,kBAAkB,IAAIhD;IAEpE,OAAO;QACLsC;QACAW,cAAc,OAAO,EACnBC,aAAa,EACbzC,OAAO,EACPU,GAAG,EACsB;YACzB,MAAMP,QAAQJ,UAAUC;YACxB,IAAI,CAACG,OAAO;gBACV,OAAO;oBAAEuC,MAAM;gBAAK;YACtB;YAEA,IAAIjC;YACJ,IAAI;gBACF,MAAM,EAAEkC,SAASC,QAAQ,EAAE,GAAG,MAAMvD,UAAUc,OAAOT,QAAQ4C,UAAU;oBACrEJ;gBACF;gBACAzB,SAASmC;YACX,EAAE,OAAM;gBACN,qDAAqD;gBACrD,OAAO;oBAAEF,MAAM;gBAAK;YACtB;YAEA,IAAI,CAACjC,OAAOoC,GAAG,EAAE;gBACf,OAAO;oBAAEH,MAAM;gBAAK;YACtB;YAEA,MAAMI,WAAW,MAAMvC,aAAa;gBAAEE;gBAAQC;gBAAKC;YAAY;YAE/D,4CAA4C;YAC5C,MAAMoC,QAAQ,MAAMrC,IAAIO,IAAI,CAAC;gBAC3BC,YAAYc;gBACZb,OAAO;gBACPC,OAAO;gBACPC,OAAO;oBAAE2B,QAAQ;wBAAE1B,QAAQb,OAAOoC,GAAG;oBAAC;gBAAE;YAC1C;YAEA,MAAMI,WAAW;gBACfC,OAAOzC,OAAOyC,KAAK,IAAI,GAAGzC,OAAOoC,GAAG,CAAC,UAAU,CAAC;gBAChDM,QAAQ1C,OAAOI,KAAK;gBACpBmC,QAAQvC,OAAOoC,GAAG;gBAClBO,UAAU3C,OAAOoB,IAAI;gBACrB,GAAIE,OAAOsB,YAAY,GAAGtB,OAAOsB,YAAY,CAAC5C,UAAU,CAAC,CAAC;gBAC1D,GAAIqC,aAAahC,YACb;oBAAE,CAACmB,kBAAkB,EAAE;wBAAC;4BAAEqB,QAAQR;wBAAS;qBAAE;gBAAC,IAC9C,CAAC,CAAC;YACR;YAEA,IAAIS;YACJ,MAAMC,YAAYT,MAAMvB,IAAI,CAAC,EAAE;YAC/B,IAAIgC,WAAW;gBACbD,UAAU,MAAM7C,IAAI+C,MAAM,CAAC;oBACzBhC,IAAI+B,UAAU/B,EAAE;oBAChBP,YAAYc;oBACZJ,MAAMqB;gBACR;YACF,OAAO;gBACLM,UAAU,MAAM7C,IAAIiB,MAAM,CAAC;oBACzBT,YAAYc;oBACZJ,MAAMqB;gBACR;YACF;YAEA,MAAMS,kBAAkB,IAAIC;YAC5B,IAAIlB,iBAAiBK,aAAahC,WAAW;gBAC3C4C,gBAAgBE,MAAM,CACpB,cACA,CAAC,WAAW,EAAEC,mBAAmBC,OAAOhB,WAAW,gCAAgC,CAAC;YAExF;YAEA,OAAO;gBACLY,iBAAiBjB,gBAAgBiB,kBAAkB5C;gBACnD4B,MAAM;oBACJ,GAAGa,OAAO;oBACVQ,WAAWlC;oBACXX,YAAYc;gBACd;YACF;QACF;IACF;AACF,EAAC"}

package/dist/types.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Claims we rely on from a Hanzo IAM (Casdoor) access token.
+ * `owner` is the org slug — in Hanzo, org == tenant. There is no separate CMS
+ * tenant concept; the IAM org IS the tenancy boundary.
+ */
+export type IAMClaims = {
+    aud?: string | string[];
+    email?: string;
+    exp?: number;
+    iss?: string;
+    /** username */
+    name?: string;
+    /** org slug — the tenant */
+    owner?: string;
+    /** user id (uuid) */
+    sub?: string;
+};
+export type HanzoIAMStrategyConfig = {
+    /**
+     * Slug of the CMS auth collection users are mapped into (e.g. 'users').
+     */
+    authSlug?: string;
+    /**
+     * Extra fields to set/refresh on the mapped user each login. Receives the
+     * verified claims; returns a partial user document.
+     */
+    claimsToUser?: (claims: IAMClaims) => Record<string, unknown>;
+    /**
+     * Expected token issuer. Defaults to HANZO_IAM_ISSUER or https://hanzo.id.
+     */
+    issuer?: string;
+    /**
+     * JWKS URL. Defaults to HANZO_IAM_JWKS_URI or
+     * https://hanzo.id/v1/iam/.well-known/jwks.
+     */
+    jwksUri?: string;
+    /**
+     * Strategy name surfaced to CMS. Defaults to 'hanzo-iam'.
+     */
+    name?: string;
+    /**
+     * Name of the tenant field on the user (link user -> tenant). When the
+     * multi-tenant plugin is wired, this is the array field it manages.
+     * Defaults to 'tenants'.
+     */
+    tenantsArrayField?: string;
+    /**
+     * Slug of the tenants collection (org == tenant). Defaults to 'tenants'.
+     * A tenant doc is provisioned per IAM org on first login.
+     */
+    tenantsSlug?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,eAAe;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACnC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7D;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA"}

package/dist/types.js

@@ -0,0 +1,7 @@
+/**
+ * Claims we rely on from a Hanzo IAM (Casdoor) access token.
+ * `owner` is the org slug — in Hanzo, org == tenant. There is no separate CMS
+ * tenant concept; the IAM org IS the tenancy boundary.
+ */ export { };
+
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["/**\n * Claims we rely on from a Hanzo IAM (Casdoor) access token.\n * `owner` is the org slug — in Hanzo, org == tenant. There is no separate CMS\n * tenant concept; the IAM org IS the tenancy boundary.\n */\nexport type IAMClaims = {\n  aud?: string | string[]\n  email?: string\n  exp?: number\n  iss?: string\n  /** username */\n  name?: string\n  /** org slug — the tenant */\n  owner?: string\n  /** user id (uuid) */\n  sub?: string\n}\n\nexport type HanzoIAMStrategyConfig = {\n  /**\n   * Slug of the CMS auth collection users are mapped into (e.g. 'users').\n   */\n  authSlug?: string\n  /**\n   * Extra fields to set/refresh on the mapped user each login. Receives the\n   * verified claims; returns a partial user document.\n   */\n  claimsToUser?: (claims: IAMClaims) => Record<string, unknown>\n  /**\n   * Expected token issuer. Defaults to HANZO_IAM_ISSUER or https://hanzo.id.\n   */\n  issuer?: string\n  /**\n   * JWKS URL. Defaults to HANZO_IAM_JWKS_URI or\n   * https://hanzo.id/v1/iam/.well-known/jwks.\n   */\n  jwksUri?: string\n  /**\n   * Strategy name surfaced to CMS. Defaults to 'hanzo-iam'.\n   */\n  name?: string\n  /**\n   * Name of the tenant field on the user (link user -> tenant). When the\n   * multi-tenant plugin is wired, this is the array field it manages.\n   * Defaults to 'tenants'.\n   */\n  tenantsArrayField?: string\n  /**\n   * Slug of the tenants collection (org == tenant). Defaults to 'tenants'.\n   * A tenant doc is provisioned per IAM org on first login.\n   */\n  tenantsSlug?: string\n}\n"],"names":[],"mappings":"AAAA;;;;CAIC,GAcD,WAkCC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@hanzo/cms-auth-iam",
+  "version": "1.0.0",
+  "description": "Hanzo IAM SSO auth strategy for Hanzo CMS. Verifies IAM (Casdoor) access tokens via JWKS; org == tenant. No separate CMS login.",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "jose": "5.10.0",
+    "@hanzo/cms": "3.85.2"
+  },
+  "devDependencies": {
+    "@hanzo/cms-eslint-config": "3.28.0"
+  },
+  "scripts": {
+    "build": "pnpm copyfiles && pnpm build:types && pnpm build:swc",
+    "build:debug": "pnpm build",
+    "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
+    "build:types": "tsc --emitDeclarationOnly --outDir dist",
+    "clean": "rimraf -g {dist,*.tsbuildinfo}",
+    "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
+  }
+}