@happyvertical/auth 0.80.0 → 0.80.2

package/dist/index.js

@@ -1,499 +1,217 @@
-import { loadEnvConfig, ValidationError } from "@happyvertical/utils";
-var AuthErrorCode = /* @__PURE__ */ ((AuthErrorCode2) => {
-  AuthErrorCode2["INVALID_CREDENTIALS"] = "INVALID_CREDENTIALS";
-  AuthErrorCode2["INVALID_TOKEN"] = "INVALID_TOKEN";
-  AuthErrorCode2["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
-  AuthErrorCode2["INVALID_REFRESH_TOKEN"] = "INVALID_REFRESH_TOKEN";
-  AuthErrorCode2["SESSION_EXPIRED"] = "SESSION_EXPIRED";
-  AuthErrorCode2["MFA_REQUIRED"] = "MFA_REQUIRED";
-  AuthErrorCode2["INVALID_MFA_CODE"] = "INVALID_MFA_CODE";
-  AuthErrorCode2["ACCESS_DENIED"] = "ACCESS_DENIED";
-  AuthErrorCode2["INSUFFICIENT_SCOPE"] = "INSUFFICIENT_SCOPE";
-  AuthErrorCode2["INVALID_ROLE"] = "INVALID_ROLE";
-  AuthErrorCode2["USER_NOT_FOUND"] = "USER_NOT_FOUND";
-  AuthErrorCode2["USER_ALREADY_EXISTS"] = "USER_ALREADY_EXISTS";
-  AuthErrorCode2["USER_DISABLED"] = "USER_DISABLED";
-  AuthErrorCode2["PROVIDER_ERROR"] = "PROVIDER_ERROR";
-  AuthErrorCode2["CONFIGURATION_ERROR"] = "CONFIGURATION_ERROR";
-  AuthErrorCode2["NETWORK_ERROR"] = "NETWORK_ERROR";
-  AuthErrorCode2["INVALID_STATE"] = "INVALID_STATE";
-  AuthErrorCode2["INVALID_NONCE"] = "INVALID_NONCE";
-  AuthErrorCode2["INVALID_GRANT"] = "INVALID_GRANT";
-  AuthErrorCode2["INVALID_CLIENT"] = "INVALID_CLIENT";
-  AuthErrorCode2["INVALID_REDIRECT_URI"] = "INVALID_REDIRECT_URI";
-  AuthErrorCode2["INVALID_SIGNATURE"] = "INVALID_SIGNATURE";
-  AuthErrorCode2["RELAY_ERROR"] = "RELAY_ERROR";
-  AuthErrorCode2["CHALLENGE_EXPIRED"] = "CHALLENGE_EXPIRED";
-  AuthErrorCode2["EXTENSION_NOT_FOUND"] = "EXTENSION_NOT_FOUND";
-  AuthErrorCode2["INVALID_KEY"] = "INVALID_KEY";
-  AuthErrorCode2["NOT_IMPLEMENTED"] = "NOT_IMPLEMENTED";
-  AuthErrorCode2["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
-  return AuthErrorCode2;
-})(AuthErrorCode || {});
-class AuthError extends Error {
-  code;
-  provider;
-  context;
-  constructor(message, code, provider, context) {
-    super(message);
-    this.name = "AuthError";
-    this.code = code;
-    this.provider = provider;
-    this.context = context;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, AuthError);
-    }
-  }
-  /**
-   * Convert error to JSON for logging/serialization.
-   */
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      code: this.code,
-      provider: this.provider,
-      context: this.context,
-      stack: this.stack
-    };
-  }
-}
-class InvalidCredentialsError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid credentials",
-      "INVALID_CREDENTIALS",
-      provider,
-      context
-    );
-    this.name = "InvalidCredentialsError";
-  }
-}
-class InvalidTokenError extends AuthError {
-  constructor(message, provider, context) {
-    super(
-      message || "Invalid token",
-      "INVALID_TOKEN",
-      provider,
-      context
-    );
-    this.name = "InvalidTokenError";
-  }
-}
-class TokenExpiredError extends AuthError {
-  expiredAt;
-  constructor(provider, expiredAt, context) {
-    super("Token has expired", "TOKEN_EXPIRED", provider, context);
-    this.name = "TokenExpiredError";
-    this.expiredAt = expiredAt;
-  }
-}
-class InvalidRefreshTokenError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid or expired refresh token",
-      "INVALID_REFRESH_TOKEN",
-      provider,
-      context
-    );
-    this.name = "InvalidRefreshTokenError";
-  }
-}
-class SessionExpiredError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Session has expired",
-      "SESSION_EXPIRED",
-      provider,
-      context
-    );
-    this.name = "SessionExpiredError";
-  }
-}
-class MfaRequiredError extends AuthError {
-  mfaMethods;
-  constructor(provider, mfaMethods, context) {
-    super(
-      "Multi-factor authentication required",
-      "MFA_REQUIRED",
-      provider,
-      context
-    );
-    this.name = "MfaRequiredError";
-    this.mfaMethods = mfaMethods;
-  }
-}
-class InvalidMfaCodeError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid MFA code",
-      "INVALID_MFA_CODE",
-      provider,
-      context
-    );
-    this.name = "InvalidMfaCodeError";
-  }
-}
-class AccessDeniedError extends AuthError {
-  constructor(message, provider, context) {
-    super(
-      message || "Access denied",
-      "ACCESS_DENIED",
-      provider,
-      context
-    );
-    this.name = "AccessDeniedError";
-  }
-}
-class InsufficientScopeError extends AuthError {
-  requiredScopes;
-  grantedScopes;
-  constructor(requiredScopes, grantedScopes, provider, context) {
-    super(
-      `Insufficient scope. Required: ${requiredScopes?.join(", ") || "unknown"}`,
-      "INSUFFICIENT_SCOPE",
-      provider,
-      context
-    );
-    this.name = "InsufficientScopeError";
-    this.requiredScopes = requiredScopes;
-    this.grantedScopes = grantedScopes;
-  }
-}
-class UserNotFoundError extends AuthError {
-  userId;
-  constructor(userId, provider, context) {
-    super(
-      userId ? `User not found: ${userId}` : "User not found",
-      "USER_NOT_FOUND",
-      provider,
-      context
-    );
-    this.name = "UserNotFoundError";
-    this.userId = userId;
-  }
-}
-class UserAlreadyExistsError extends AuthError {
-  constructor(identifier, provider, context) {
-    super(
-      identifier ? `User already exists: ${identifier}` : "User already exists",
-      "USER_ALREADY_EXISTS",
-      provider,
-      context
-    );
-    this.name = "UserAlreadyExistsError";
-  }
-}
-class UserDisabledError extends AuthError {
-  constructor(userId, provider, context) {
-    super(
-      userId ? `User is disabled: ${userId}` : "User is disabled",
-      "USER_DISABLED",
-      provider,
-      context
-    );
-    this.name = "UserDisabledError";
-  }
-}
-class ProviderError extends AuthError {
-  originalError;
-  constructor(message, provider, originalError, context) {
-    super(message, "PROVIDER_ERROR", provider, context);
-    this.name = "ProviderError";
-    this.originalError = originalError;
-  }
-}
-class ConfigurationError extends AuthError {
-  constructor(message, provider, context) {
-    super(message, "CONFIGURATION_ERROR", provider, context);
-    this.name = "ConfigurationError";
-  }
-}
-class NetworkError extends AuthError {
-  originalError;
-  constructor(message, provider, originalError, context) {
-    super(
-      message || "Network error",
-      "NETWORK_ERROR",
-      provider,
-      context
-    );
-    this.name = "NetworkError";
-    this.originalError = originalError;
-  }
-}
-class InvalidStateError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid or mismatched state parameter",
-      "INVALID_STATE",
-      provider,
-      context
-    );
-    this.name = "InvalidStateError";
-  }
-}
-class InvalidNonceError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid or mismatched nonce",
-      "INVALID_NONCE",
-      provider,
-      context
-    );
-    this.name = "InvalidNonceError";
-  }
-}
-class InvalidGrantError extends AuthError {
-  constructor(message, provider, context) {
-    super(
-      message || "Invalid grant",
-      "INVALID_GRANT",
-      provider,
-      context
-    );
-    this.name = "InvalidGrantError";
-  }
-}
-class InvalidClientError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid client credentials",
-      "INVALID_CLIENT",
-      provider,
-      context
-    );
-    this.name = "InvalidClientError";
-  }
-}
-class InvalidRedirectUriError extends AuthError {
-  constructor(provider, context) {
-    super(
-      "Invalid or mismatched redirect URI",
-      "INVALID_REDIRECT_URI",
-      provider,
-      context
-    );
-    this.name = "InvalidRedirectUriError";
-  }
-}
-class InvalidSignatureError extends AuthError {
-  constructor(message, context) {
-    super(
-      message || "Invalid event signature",
-      "INVALID_SIGNATURE",
-      "nostr",
-      context
-    );
-    this.name = "InvalidSignatureError";
-  }
-}
-class RelayError extends AuthError {
-  relayUrl;
-  originalError;
-  constructor(message, relayUrl, originalError, context) {
-    super(message, "RELAY_ERROR", "nostr", {
-      ...context,
-      relayUrl
-    });
-    this.name = "RelayError";
-    this.relayUrl = relayUrl;
-    this.originalError = originalError;
-  }
-}
-class ChallengeExpiredError extends AuthError {
-  constructor(context) {
-    super(
-      "Authentication challenge has expired",
-      "CHALLENGE_EXPIRED",
-      "nostr",
-      context
-    );
-    this.name = "ChallengeExpiredError";
-  }
-}
-class ExtensionNotFoundError extends AuthError {
-  constructor(context) {
-    super(
-      "NIP-07 browser extension not found. Install nos2x, Alby, or similar.",
-      "EXTENSION_NOT_FOUND",
-      "nostr",
-      context
-    );
-    this.name = "ExtensionNotFoundError";
-  }
-}
-class InvalidKeyError extends AuthError {
-  constructor(message, context) {
-    super(
-      message || "Invalid key format",
-      "INVALID_KEY",
-      "nostr",
-      context
-    );
-    this.name = "InvalidKeyError";
-  }
-}
-class NotImplementedError extends AuthError {
-  operation;
-  constructor(operation, provider, context) {
-    super(
-      `Operation '${operation}' is not supported by this provider`,
-      "NOT_IMPLEMENTED",
-      provider,
-      context
-    );
-    this.name = "NotImplementedError";
-    this.operation = operation;
-  }
-}
-function isAuthError(error) {
-  return error instanceof AuthError;
-}
-function hasErrorCode(error, code) {
-  return isAuthError(error) && error.code === code;
-}
+import { A as isAuthError, C as RelayError, D as UserDisabledError, E as UserAlreadyExistsError, O as UserNotFoundError, S as ProviderError, T as TokenExpiredError, _ as InvalidStateError, a as ConfigurationError, b as NetworkError, c as InvalidClientError, d as InvalidKeyError, f as InvalidMfaCodeError, g as InvalidSignatureError, h as InvalidRefreshTokenError, i as ChallengeExpiredError, k as hasErrorCode, l as InvalidCredentialsError, m as InvalidRedirectUriError, n as AuthError, o as ExtensionNotFoundError, p as InvalidNonceError, r as AuthErrorCode, s as InsufficientScopeError, t as AccessDeniedError, u as InvalidGrantError, v as InvalidTokenError, w as SessionExpiredError, x as NotImplementedError, y as MfaRequiredError } from "./chunks/errors-RgVH84_1.js";
+import { ValidationError, loadEnvConfig } from "@happyvertical/utils";
+//#region src/shared/factory.ts
+/**
+* @happyvertical/auth - Factory Functions
+*
+* Creates authentication provider instances based on configuration.
+* Supports Keycloak, AWS Cognito, and Nostr providers.
+*/
+/**
+* Checks if the options are for Keycloak provider.
+*/
 function isKeycloakOptions(options) {
-  return options.type === "keycloak";
+	return options.type === "keycloak";
 }
+/**
+* Checks if the options are for Cognito provider.
+*/
 function isCognitoOptions(options) {
-  return options.type === "cognito";
+	return options.type === "cognito";
 }
+/**
+* Checks if the options are for Nostr provider.
+*/
 function isNostrOptions(options) {
-  return options.type === "nostr";
+	return options.type === "nostr";
 }
+/**
+* Checks if the options are for Kanidm provider.
+*/
 function isKanidmOptions(options) {
-  return options.type === "kanidm";
+	return options.type === "kanidm";
 }
+/**
+* Checks if the options are for Google provider.
+*/
 function isGoogleOptions(options) {
-  return options.type === "google";
+	return options.type === "google";
 }
+/**
+* Checks if the options are for GitHub provider.
+*/
 function isGitHubOptions(options) {
-  return options.type === "github";
-}
+	return options.type === "github";
+}
+/**
+* Creates an authentication provider instance based on the provided options.
+*
+* Supports environment variable configuration using the pattern:
+* - HAVE_AUTH_TYPE → provider type ('keycloak' | 'cognito' | 'nostr')
+* - HAVE_AUTH_SERVER_URL → serverUrl (Keycloak)
+* - HAVE_AUTH_REALM → realm (Keycloak)
+* - HAVE_AUTH_CLIENT_ID → clientId
+* - HAVE_AUTH_CLIENT_SECRET → clientSecret
+* - HAVE_AUTH_REDIRECT_URI → redirectUri
+* - HAVE_AUTH_REGION → region (Cognito)
+* - HAVE_AUTH_USER_POOL_ID → userPoolId (Cognito)
+* - HAVE_AUTH_DOMAIN → domain (Cognito)
+* - HAVE_AUTH_RELAYS → relays (Nostr, comma-separated)
+* - HAVE_AUTH_TIMEOUT → timeout (number)
+* - HAVE_AUTH_MAX_RETRIES → maxRetries (number)
+*
+* User-provided options always take precedence over environment variables.
+*
+* @param options - Configuration options for the auth provider
+* @returns Promise resolving to an AuthInterface implementation
+* @throws {ValidationError} When the provider type is unsupported or invalid
+*
+* @example
+* ```typescript
+* // Create Keycloak client
+* const auth = await getAuth({
+*   type: 'keycloak',
+*   serverUrl: 'https://auth.example.com',
+*   realm: 'my-realm',
+*   clientId: 'my-app'
+* });
+*
+* // Create Cognito client
+* const auth = await getAuth({
+*   type: 'cognito',
+*   region: 'us-east-1',
+*   userPoolId: 'us-east-1_xxx',
+*   clientId: 'xxx'
+* });
+*
+* // Create Nostr client
+* const auth = await getAuth({
+*   type: 'nostr',
+*   relays: ['wss://relay.damus.io', 'wss://nos.lol']
+* });
+*
+* // Use environment variables
+* // Set: HAVE_AUTH_TYPE=keycloak, HAVE_AUTH_SERVER_URL=..., etc.
+* const auth = await getAuth({} as GetAuthOptions);
+* ```
+*/
 async function getAuth(options) {
-  const configuredOptions = loadEnvConfig(
-    options,
-    {
-      packageName: "auth",
-      schema: {
-        type: "string",
-        serverUrl: "string",
-        realm: "string",
-        clientId: "string",
-        clientSecret: "string",
-        redirectUri: "string",
-        scopes: "string",
-        // Will be comma-separated
-        region: "string",
-        userPoolId: "string",
-        domain: "string",
-        relays: "string",
-        // Will be comma-separated
-        privateKey: "string",
-        challengeExpiration: "number",
-        relayTimeout: "number",
-        timeout: "number",
-        maxRetries: "number",
-        // Kanidm-specific
-        adminUsername: "string",
-        adminPassword: "string"
-      },
-      transform: {
-        // Transform comma-separated strings to arrays
-        relays: (value) => value.split(",").map((r) => r.trim()).filter(Boolean),
-        scopes: (value) => value.split(",").map((s) => s.trim()).filter(Boolean)
-      }
-    }
-  );
-  options = configuredOptions;
-  if (isKeycloakOptions(options)) {
-    const { KeycloakProvider } = await import("./chunks/keycloak-t6JEUeOz.js");
-    return new KeycloakProvider(options);
-  }
-  if (isCognitoOptions(options)) {
-    const { CognitoProvider } = await import("./chunks/cognito-dmypylFX.js");
-    return new CognitoProvider(options);
-  }
-  if (isNostrOptions(options)) {
-    const { NostrProvider } = await import("./chunks/index-BpsMhFXS.js");
-    return new NostrProvider(options);
-  }
-  if (isKanidmOptions(options)) {
-    const { KanidmProvider } = await import("./chunks/kanidm-hkw-YPVF.js");
-    return new KanidmProvider(options);
-  }
-  if (isGoogleOptions(options)) {
-    const { GoogleProvider } = await import("./chunks/google-HXk2ctYR.js");
-    return new GoogleProvider(options);
-  }
-  if (isGitHubOptions(options)) {
-    const { GitHubProvider } = await import("./chunks/github-NSZp5tVm.js");
-    return new GitHubProvider(options);
-  }
-  throw new ValidationError("Unsupported auth provider type", {
-    supportedTypes: [
-      "keycloak",
-      "cognito",
-      "nostr",
-      "kanidm",
-      "google",
-      "github"
-    ],
-    providedType: options.type
-  });
-}
+	options = loadEnvConfig(options, {
+		packageName: "auth",
+		schema: {
+			type: "string",
+			serverUrl: "string",
+			realm: "string",
+			clientId: "string",
+			clientSecret: "string",
+			redirectUri: "string",
+			scopes: "string",
+			region: "string",
+			userPoolId: "string",
+			domain: "string",
+			relays: "string",
+			privateKey: "string",
+			challengeExpiration: "number",
+			relayTimeout: "number",
+			timeout: "number",
+			maxRetries: "number",
+			adminUsername: "string",
+			adminPassword: "string"
+		},
+		transform: {
+			relays: (value) => value.split(",").map((r) => r.trim()).filter(Boolean),
+			scopes: (value) => value.split(",").map((s) => s.trim()).filter(Boolean)
+		}
+	});
+	if (isKeycloakOptions(options)) {
+		const { KeycloakProvider } = await import("./chunks/keycloak-CzPHgI2z.js");
+		return new KeycloakProvider(options);
+	}
+	if (isCognitoOptions(options)) {
+		const { CognitoProvider } = await import("./chunks/cognito-thQmKf7L.js");
+		return new CognitoProvider(options);
+	}
+	if (isNostrOptions(options)) {
+		const { NostrProvider } = await import("./chunks/nostr-zrMaYMU-.js");
+		return new NostrProvider(options);
+	}
+	if (isKanidmOptions(options)) {
+		const { KanidmProvider } = await import("./chunks/kanidm-DTcc6ufi.js");
+		return new KanidmProvider(options);
+	}
+	if (isGoogleOptions(options)) {
+		const { GoogleProvider } = await import("./chunks/google-C_p8rExJ.js");
+		return new GoogleProvider(options);
+	}
+	if (isGitHubOptions(options)) {
+		const { GitHubProvider } = await import("./chunks/github-uNnnVjFZ.js");
+		return new GitHubProvider(options);
+	}
+	throw new ValidationError("Unsupported auth provider type", {
+		supportedTypes: [
+			"keycloak",
+			"cognito",
+			"nostr",
+			"kanidm",
+			"google",
+			"github"
+		],
+		providedType: options.type
+	});
+}
+/**
+* Auto-detect provider based on available configuration.
+*
+* @param options - Configuration options that may contain provider-specific settings
+* @returns Promise resolving to an AuthInterface based on detected configuration
+* @throws {ValidationError} When no provider can be detected
+*
+* @example
+* ```typescript
+* // Auto-detect Keycloak from serverUrl and realm
+* const auth = await getAuthAuto({
+*   serverUrl: 'https://auth.example.com',
+*   realm: 'my-realm',
+*   clientId: 'my-app'
+* });
+*
+* // Auto-detect Cognito from region and userPoolId
+* const auth = await getAuthAuto({
+*   region: 'us-east-1',
+*   userPoolId: 'us-east-1_xxx',
+*   clientId: 'xxx'
+* });
+*
+* // Auto-detect Nostr from relays
+* const auth = await getAuthAuto({
+*   relays: ['wss://relay.damus.io']
+* });
+* ```
+*/
 async function getAuthAuto(options) {
-  if (options.serverUrl && options.realm) {
-    return getAuth({ ...options, type: "keycloak" });
-  }
-  if (options.region && options.userPoolId) {
-    return getAuth({ ...options, type: "cognito" });
-  }
-  if (options.relays && Array.isArray(options.relays) && options.relays.length > 0) {
-    return getAuth({ ...options, type: "nostr" });
-  }
-  throw new ValidationError(
-    "Could not auto-detect auth provider from options",
-    {
-      hint: 'Please specify a "type" field or provide provider-specific configuration',
-      supportedTypes: ["keycloak", "cognito", "nostr"],
-      providedOptions: Object.keys(options)
-    }
-  );
-}
-export {
-  AccessDeniedError,
-  AuthError,
-  AuthErrorCode,
-  ChallengeExpiredError,
-  ConfigurationError,
-  ExtensionNotFoundError,
-  InsufficientScopeError,
-  InvalidClientError,
-  InvalidCredentialsError,
-  InvalidGrantError,
-  InvalidKeyError,
-  InvalidMfaCodeError,
-  InvalidNonceError,
-  InvalidRedirectUriError,
-  InvalidRefreshTokenError,
-  InvalidSignatureError,
-  InvalidStateError,
-  InvalidTokenError,
-  MfaRequiredError,
-  NetworkError,
-  NotImplementedError,
-  ProviderError,
-  RelayError,
-  SessionExpiredError,
-  TokenExpiredError,
-  UserAlreadyExistsError,
-  UserDisabledError,
-  UserNotFoundError,
-  getAuth,
-  getAuthAuto,
-  hasErrorCode,
-  isAuthError
-};
-//# sourceMappingURL=index.js.map
+	if (options.serverUrl && options.realm) return getAuth({
+		...options,
+		type: "keycloak"
+	});
+	if (options.region && options.userPoolId) return getAuth({
+		...options,
+		type: "cognito"
+	});
+	if (options.relays && Array.isArray(options.relays) && options.relays.length > 0) return getAuth({
+		...options,
+		type: "nostr"
+	});
+	throw new ValidationError("Could not auto-detect auth provider from options", {
+		hint: "Please specify a \"type\" field or provide provider-specific configuration",
+		supportedTypes: [
+			"keycloak",
+			"cognito",
+			"nostr"
+		],
+		providedOptions: Object.keys(options)
+	});
+}
+//#endregion
+export { AccessDeniedError, AuthError, AuthErrorCode, ChallengeExpiredError, ConfigurationError, ExtensionNotFoundError, InsufficientScopeError, InvalidClientError, InvalidCredentialsError, InvalidGrantError, InvalidKeyError, InvalidMfaCodeError, InvalidNonceError, InvalidRedirectUriError, InvalidRefreshTokenError, InvalidSignatureError, InvalidStateError, InvalidTokenError, MfaRequiredError, NetworkError, NotImplementedError, ProviderError, RelayError, SessionExpiredError, TokenExpiredError, UserAlreadyExistsError, UserDisabledError, UserNotFoundError, getAuth, getAuthAuto, hasErrorCode, isAuthError };
+
+//# sourceMappingURL=index.js.map