@intelicity/gates-sdk 0.1.6 → 0.2.1

package/dist/services/auth-service.js

@@ -1,12 +1,11 @@
 import { jwtVerify, errors as joseErrors } from "jose";
 import { getJwks } from "../cache/jwks-cache.js";
-import { InvalidParameterError, MissingParameterError, TokenExpiredError, InvalidTokenError, UnauthorizedGroupError, } from "../errors/error.js";
-export class GatesAuthService {
+import { InvalidParameterError, MissingParameterError, TokenExpiredError, InvalidTokenError, } from "../errors/error.js";
+export class AuthService {
     region;
     userPoolId;
-    audience;
-    requiredGroup;
-    constructor(region, userPoolId, audience, requiredGroup) {
+    clientIds;
+    constructor(region, userPoolId, clientId) {
         if (!region || typeof region !== "string" || region.trim().length === 0) {
             throw new MissingParameterError("region");
         }
@@ -15,35 +14,18 @@ export class GatesAuthService {
             userPoolId.trim().length === 0) {
             throw new MissingParameterError("userPoolId");
         }
-        if (!audience ||
-            typeof audience !== "string" ||
-            audience.trim().length === 0) {
-            throw new MissingParameterError("audience");
-        }
-        // Validar formato do userPoolId (deve seguir padrão AWS)
         if (!/^[a-zA-Z0-9_-]+$/.test(userPoolId)) {
-            throw new InvalidParameterError("userPoolId", "deve seguir o formato AWS (apenas alfanuméricos, hífens e underscores)");
+            throw new InvalidParameterError("userPoolId", "must follow AWS format (alphanumeric, hyphens, and underscores only)");
         }
         this.region = region;
         this.userPoolId = userPoolId;
-        this.audience = audience;
-        this.requiredGroup = requiredGroup;
+        this.clientIds = clientId
+            ? Array.isArray(clientId) ? clientId : [clientId]
+            : [];
     }
     get issuer() {
         return `https://cognito-idp.${this.region}.amazonaws.com/${this.userPoolId}`;
     }
-    isMemberOf(groups = []) {
-        if (!Array.isArray(groups)) {
-            return false;
-        }
-        if (!this.requiredGroup) {
-            return true;
-        }
-        const requiredGroups = Array.isArray(this.requiredGroup)
-            ? this.requiredGroup
-            : [this.requiredGroup];
-        return groups.some((g) => requiredGroups.includes(g));
-    }
     async verifyToken(token) {
         if (!token) {
             throw new MissingParameterError("token");
@@ -52,47 +34,50 @@ export class GatesAuthService {
             const jwks = getJwks(this.region, this.userPoolId);
             const { payload } = await jwtVerify(token, jwks, {
                 issuer: this.issuer,
-                audience: this.audience,
             });
-            if (this.requiredGroup) {
-                const userGroups = payload["cognito:groups"];
-                const requiredGroups = Array.isArray(this.requiredGroup)
-                    ? this.requiredGroup
-                    : [this.requiredGroup];
-                if (!userGroups || !Array.isArray(userGroups)) {
-                    throw new UnauthorizedGroupError("Usuário não pertence a nenhum grupo obrigatório", requiredGroups);
+            const tokenUse = payload.token_use;
+            if (tokenUse !== "access" && tokenUse !== "id") {
+                throw new InvalidTokenError(`Unsupported token_use: expected "access" or "id", got "${tokenUse}"`);
+            }
+            if (this.clientIds.length > 0) {
+                if (tokenUse === "access") {
+                    const clientId = payload.client_id;
+                    if (!clientId || !this.clientIds.includes(clientId)) {
+                        throw new InvalidTokenError("Token client_id does not match any expected clientId");
+                    }
                 }
-                // Verifica se o usuário tem pelo menos um dos grupos obrigatórios
-                const hasRequiredGroup = requiredGroups.some((group) => userGroups.includes(group));
-                if (!hasRequiredGroup) {
-                    throw new UnauthorizedGroupError(`Usuário deve ser membro de um dos seguintes grupos: ${requiredGroups.join(", ")}`, requiredGroups);
+                else {
+                    const aud = payload.aud;
+                    const audValue = Array.isArray(aud) ? aud[0] : aud;
+                    if (!audValue || !this.clientIds.includes(audValue)) {
+                        throw new InvalidTokenError("Token audience does not match any expected clientId");
+                    }
                 }
             }
-            // Mapear o payload do Cognito para o formato do GatesUser
+            const groups = payload["cognito:groups"] ?? [];
             const user = {
                 user_id: payload.sub,
                 email: payload.email,
                 name: payload.name,
                 role: payload["custom:general_role"],
+                groups,
+                token_use: tokenUse,
                 exp: payload.exp,
                 iat: payload.iat,
             };
             return user;
         }
         catch (error) {
-            // Re-throw known errors
-            if (error instanceof UnauthorizedGroupError ||
+            if (error instanceof InvalidTokenError ||
                 error instanceof MissingParameterError) {
                 throw error;
             }
-            // Handle jose-specific errors
             if (error instanceof joseErrors.JWTExpired) {
-                throw new TokenExpiredError("Token expirado");
+                throw new TokenExpiredError();
             }
             if (error instanceof joseErrors.JWTInvalid) {
-                throw new InvalidTokenError("Token inválido ou malformado");
+                throw new InvalidTokenError("Invalid or malformed token");
             }
-            // Handle other jose errors
             if (error instanceof Error) {
                 if (error.message.includes("expired")) {
                     throw new TokenExpiredError(error.message);
@@ -101,9 +86,9 @@ export class GatesAuthService {
                     error.message.includes("invalid")) {
                     throw new InvalidTokenError(error.message);
                 }
-                throw new InvalidTokenError(`Falha na verificação do token: ${error.message}`);
+                throw new InvalidTokenError(`Token verification failed: ${error.message}`);
             }
-            throw new InvalidTokenError("Falha na verificação do token");
+            throw new InvalidTokenError("Token verification failed");
         }
     }
 }

package/dist/services/client-auth.d.ts

@@ -0,0 +1,22 @@
+export type ClientCredentialsConfig = {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+};
+export type ClientToken = {
+    access_token: string;
+    expires_in: number;
+    token_type: string;
+};
+export declare class GatesClientAuth {
+    private readonly tokenEndpoint;
+    private readonly clientId;
+    private readonly clientSecret;
+    private readonly scopes;
+    private cachedToken;
+    constructor(config: ClientCredentialsConfig);
+    getAccessToken(): Promise<string>;
+    clearCache(): void;
+}
+//# sourceMappingURL=client-auth.d.ts.map

package/dist/services/client-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-auth.d.ts","sourceRoot":"","sources":["../../src/services/client-auth.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,WAAW,CAAqD;gBAE5D,MAAM,EAAE,uBAAuB;IAkBrC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAiEvC,UAAU,IAAI,IAAI;CAGnB"}

package/dist/services/client-auth.js

@@ -0,0 +1,75 @@
+import { MissingParameterError, ClientCredentialsError, } from "../errors/error.js";
+export class GatesClientAuth {
+    tokenEndpoint;
+    clientId;
+    clientSecret;
+    scopes;
+    cachedToken = null;
+    constructor(config) {
+        if (!config.domain || config.domain.trim().length === 0) {
+            throw new MissingParameterError("domain");
+        }
+        if (!config.clientId || config.clientId.trim().length === 0) {
+            throw new MissingParameterError("clientId");
+        }
+        if (!config.clientSecret || config.clientSecret.trim().length === 0) {
+            throw new MissingParameterError("clientSecret");
+        }
+        const domain = config.domain.replace(/\/$/, "");
+        this.tokenEndpoint = `https://${domain}/oauth2/token`;
+        this.clientId = config.clientId;
+        this.clientSecret = config.clientSecret;
+        this.scopes = config.scopes ?? [];
+    }
+    async getAccessToken() {
+        if (this.cachedToken && Date.now() < this.cachedToken.expiresAt) {
+            return this.cachedToken.token;
+        }
+        const body = new URLSearchParams({
+            grant_type: "client_credentials",
+        });
+        if (this.scopes.length > 0) {
+            body.set("scope", this.scopes.join(" "));
+        }
+        const credentials = Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64");
+        let response;
+        try {
+            response = await fetch(this.tokenEndpoint, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/x-www-form-urlencoded",
+                    Authorization: `Basic ${credentials}`,
+                },
+                body: body.toString(),
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Unknown network error";
+            throw new ClientCredentialsError(`Failed to reach token endpoint: ${message}`);
+        }
+        if (!response.ok) {
+            let detail;
+            try {
+                const errorBody = (await response.json());
+                detail = errorBody.error ?? response.statusText;
+            }
+            catch {
+                detail = response.statusText;
+            }
+            throw new ClientCredentialsError(`Token request failed (${response.status}): ${detail}`);
+        }
+        const data = (await response.json());
+        if (!data.access_token) {
+            throw new ClientCredentialsError("Token response missing access_token field");
+        }
+        const bufferMs = 30_000;
+        this.cachedToken = {
+            token: data.access_token,
+            expiresAt: Date.now() + data.expires_in * 1000 - bufferMs,
+        };
+        return data.access_token;
+    }
+    clearCache() {
+        this.cachedToken = null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intelicity/gates-sdk",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "description": "Simple SDK for authenticating users with AWS Cognito JWT tokens",
   "type": "module",
   "exports": "./dist/index.js",
@@ -18,6 +18,8 @@
   "scripts": {
     "build": "tsc && tsc-alias",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "test:token": "tsx scripts/test-token.ts",
     "prepublishOnly": "npm run build"
   },
@@ -37,7 +39,8 @@
     "@types/node": "^24.1.0",
     "tsc-alias": "^1.8.16",
     "tsx": "^4.20.3",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^4.1.0"
   },
   "dependencies": {
     "jose": "^6.1.1"