@isi-ui7/bos7-shared 0.2.0

package/src/auth7/scope-guard.ts

@@ -0,0 +1,54 @@
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+
+export type ScopeLevel = 'read' | 'write' | 'approve'
+
+const SCOPE_PREFIX = 'bos7'
+
+// scopeFromRequest infers the required scope from HTTP method.
+// Routes matching */approve* always require 'approve'.
+export function scopeFromRequest(req: NextRequest): ScopeLevel {
+  const path = req.nextUrl.pathname.toLowerCase()
+  if (path.includes('/approve')) return 'approve'
+  if (req.method === 'GET' || req.method === 'HEAD') return 'read'
+  return 'write'
+}
+
+// getTokenScopes decodes the access_token cookie (JWT, no verification needed —
+// verification was done by auth7 upstream) and extracts the scope claim.
+function getTokenScopes(req: NextRequest): string[] {
+  const raw = req.cookies.get('access_token')?.value
+  if (!raw) return []
+  try {
+    const payload = raw.split('.')[1]
+    if (!payload) return []
+    const decoded = JSON.parse(
+      Buffer.from(payload.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf-8')
+    ) as { scope?: string }
+    return (decoded.scope ?? '').split(' ').filter(Boolean)
+  } catch {
+    return []
+  }
+}
+
+// requireScope returns a 403 NextResponse if the access_token does not carry
+// the required scope, or null if the request may proceed.
+export function requireScope(req: NextRequest, required: ScopeLevel): NextResponse | null {
+  const scopes = getTokenScopes(req)
+  const needed = `${SCOPE_PREFIX}:${required}`
+
+  // 'approve' implies 'write' and 'read'; 'write' implies 'read'.
+  const satisfies = (() => {
+    if (scopes.includes(`${SCOPE_PREFIX}:approve`)) return true
+    if (required === 'read' && scopes.includes(`${SCOPE_PREFIX}:write`)) return true
+    return scopes.includes(needed)
+  })()
+
+  if (!satisfies) {
+    return NextResponse.json(
+      { error: { code: 'INSUFFICIENT_SCOPE', message: `required scope: ${needed}` } },
+      { status: 403 },
+    )
+  }
+  return null
+}

package/src/auth7/service-account.ts

@@ -0,0 +1,71 @@
+// lib/auth7/service-account.ts — BFF service account (client_credentials M2M)
+// Server-side only. Obtains and caches M2M access tokens from auth7
+// for service-to-service calls (replaces the old mintJWT pattern).
+//
+// Usage:
+//
+//	const token = await getServiceToken();
+//	fetch('http://backend:8080/v1/data', {
+//	  headers: { Authorization: `Bearer ${token}` },
+//	});
+
+const AUTH7_CLIENT_SECRET = process.env.AUTH7_CLIENT_SECRET ?? '';
+
+interface TokenCache {
+	token: string;
+	expiresAt: number; // epoch ms
+}
+
+let cache: TokenCache | null = null;
+
+export async function getServiceToken(): Promise<string | null> {
+	const AUTH7_API_URL = process.env.AUTH7_API_URL;
+	const AUTH7_CLIENT_ID = process.env.AUTH7_CLIENT_ID;
+	if (!AUTH7_API_URL) throw new Error('[bos7] AUTH7_API_URL env var is required');
+	if (!AUTH7_CLIENT_ID) throw new Error('[bos7] AUTH7_CLIENT_ID env var is required');
+	if (!AUTH7_CLIENT_SECRET) return null;
+
+	const now = Date.now();
+	// Refresh when within 30s of expiry
+	if (cache && cache.expiresAt > now + 30_000) {
+		return cache.token;
+	}
+
+	try {
+		const body = new URLSearchParams({
+			grant_type: 'client_credentials',
+			...((process.env.AUTH7_SERVICE_SCOPE ?? 'openid profile') ? { scope: process.env.AUTH7_SERVICE_SCOPE ?? 'openid profile' } : {}),
+		});
+
+		const basicAuth = Buffer.from(`${AUTH7_CLIENT_ID}:${AUTH7_CLIENT_SECRET}`).toString('base64');
+
+		const res = await fetch(`${AUTH7_API_URL}/oauth2/token`, {
+			method: 'POST',
+			headers: {
+				'Content-Type': 'application/x-www-form-urlencoded',
+				Authorization: `Basic ${basicAuth}`,
+			},
+			body: body.toString(),
+		});
+
+		if (!res.ok) {
+			const err = await res.json().catch(() => ({}));
+			console.warn('[auth7:service-account] token request failed', res.status, err);
+			return null;
+		}
+
+		const data = await res.json() as { access_token: string; expires_in: number };
+		cache = {
+			token: data.access_token,
+			expiresAt: now + data.expires_in * 1000,
+		};
+		return cache.token;
+	} catch (err) {
+		console.warn('[auth7:service-account] token request error', err);
+		return null;
+	}
+}
+
+export function clearServiceTokenCache(): void {
+	cache = null;
+}

package/src/auth7/token-exchange.ts

@@ -0,0 +1,125 @@
+// lib/auth7/token-exchange.ts — RFC 8693 token exchange for BFF
+// Server-side only.
+
+import { createHash } from 'node:crypto';
+
+const AUTH7_API_URL = process.env.AUTH7_API_URL ?? 'http://localhost:8090';
+const AUTH7_CLIENT_ID = process.env.AUTH7_CLIENT_ID ?? 'bos7-portal';
+const AUTH7_CLIENT_SECRET = process.env.AUTH7_CLIENT_SECRET ?? '';
+
+export interface TokenExchangeResult {
+	accessToken: string;
+	expiresIn: number;
+	scope: string;
+}
+
+export interface ExchangeOptions {
+	failClosed?: boolean;
+}
+
+// --- In-memory LRU cache ---
+
+interface CacheEntry {
+	result: TokenExchangeResult;
+	expiresAt: number;
+}
+
+const MAX_CACHE_SIZE = 256;
+const exchangeCache = new Map<string, CacheEntry>();
+
+function cacheKey(userToken: string, audience: string): string {
+	return createHash('sha256').update(`${userToken}:${audience}`).digest('hex');
+}
+
+function pruneCache(): void {
+	const now = Date.now();
+	for (const [k, v] of exchangeCache) {
+		if (v.expiresAt <= now) exchangeCache.delete(k);
+	}
+	while (exchangeCache.size > MAX_CACHE_SIZE) {
+		const firstKey = exchangeCache.keys().next().value;
+		if (firstKey !== undefined) exchangeCache.delete(firstKey);
+	}
+}
+
+/** Clear the exchange cache. For use in tests. */
+export function clearExchangeCache(): void {
+	exchangeCache.clear();
+}
+
+// --- Token exchange ---
+
+export async function exchangeUserToken(
+	userToken: string,
+	audience: string,
+	scope?: string,
+	options: ExchangeOptions = {},
+): Promise<TokenExchangeResult> {
+	const { failClosed = false } = options;
+
+	const key = cacheKey(userToken, audience);
+	const cached = exchangeCache.get(key);
+	if (cached && cached.expiresAt > Date.now()) {
+		return cached.result;
+	}
+
+	if (!AUTH7_CLIENT_SECRET) {
+		if (failClosed) throw new Error('[auth7:token-exchange] AUTH7_CLIENT_SECRET not configured; fail-closed mode active');
+		return { accessToken: userToken, expiresIn: 900, scope: scope ?? '' };
+	}
+
+	const basicAuth = Buffer.from(`${AUTH7_CLIENT_ID}:${AUTH7_CLIENT_SECRET}`).toString('base64');
+
+	try {
+		const body = new URLSearchParams({
+			grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+			subject_token: userToken,
+			subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+			requested_token_type: 'urn:ietf:params:oauth:token-type:access_token',
+			audience,
+		});
+		if (scope) body.set('scope', scope);
+
+		const res = await fetch(`${AUTH7_API_URL}/oauth2/token`, {
+			method: 'POST',
+			headers: {
+				'Content-Type': 'application/x-www-form-urlencoded',
+				Authorization: `Basic ${basicAuth}`,
+			},
+			body: body.toString(),
+		});
+
+		if (res.status === 400) {
+			const err = await res.json().catch(() => ({}));
+			if ((err as { error?: string }).error === 'unsupported_grant_type') {
+				console.warn('[auth7:token-exchange] not supported by server — using pass-through');
+				if (failClosed) throw new Error('[auth7:token-exchange] grant_type not implemented; fail-closed mode active');
+				return { accessToken: userToken, expiresIn: 900, scope: scope ?? '' };
+			}
+			console.warn('[auth7:token-exchange] failed', res.status, err);
+			if (failClosed) throw new Error(`[auth7:token-exchange] HTTP 400: ${JSON.stringify(err)}`);
+			return { accessToken: userToken, expiresIn: 900, scope: scope ?? '' };
+		}
+
+		if (!res.ok) {
+			console.warn('[auth7:token-exchange] failed', res.status);
+			if (failClosed) throw new Error(`[auth7:token-exchange] HTTP ${res.status} error; fail-closed mode active`);
+			return { accessToken: userToken, expiresIn: 900, scope: scope ?? '' };
+		}
+
+		const data = await res.json() as { access_token: string; expires_in: number; scope: string };
+		const result: TokenExchangeResult = {
+			accessToken: data.access_token,
+			expiresIn: data.expires_in,
+			scope: data.scope ?? scope ?? '',
+		};
+
+		if (exchangeCache.size >= MAX_CACHE_SIZE) pruneCache();
+		exchangeCache.set(key, { result, expiresAt: Date.now() + (data.expires_in - 30) * 1000 });
+		return result;
+	} catch (err) {
+		console.warn('[auth7:token-exchange] error', err);
+		if (failClosed) throw err instanceof Error ? err : new Error(`[auth7:token-exchange] unexpected error`);
+		return { accessToken: userToken, expiresIn: 900, scope: scope ?? '' };
+	}
+}

package/src/auth7/types.ts

@@ -0,0 +1,72 @@
+// lib/auth7/types.ts — Auth7 types for frontend client
+
+export interface TokenSet {
+  access_token: string;
+  token_type: 'Bearer';
+  expires_in: number;
+  refresh_token?: string;
+  scope: string;
+  id_token?: string;
+}
+
+export interface StoredTokenInfo {
+  access_token: string;
+  refresh_token?: string;
+  expires_at: number;
+  scope: string;
+}
+
+export interface UserProfile {
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  locale?: string;
+  tenant_id?: string;
+  roles?: string[];
+  branch_id?: string | null;
+}
+
+export interface AuthState {
+  isAuthenticated: boolean;
+  isLoading: boolean;
+  user: UserProfile | null;
+  accessToken: string | null;
+  error: string | null;
+}
+
+export interface SessionInfo {
+  user: UserProfile;
+  accessToken: string;
+  expiresAt: number;
+  scope: string;
+}
+
+export const OAUTH2_COOKIE_NAMES = {
+  ACCESS_TOKEN: 'access_token',
+  REFRESH_TOKEN: 'refresh_token',
+  ID_TOKEN: 'id_token',
+  TOKEN_EXPIRES_AT: 'token_expires_at',
+  TOKEN_SCOPE: 'token_scope',
+  PKCE_VERIFIER: 'auth7_pkce_verifier',
+  OAUTH_STATE: 'auth7_oauth_state',
+  OAUTH_RETURN_URL: 'auth7_return_url',
+} as const;
+
+export const OAUTH2_ENDPOINTS = {
+  AUTHORIZE: '/oauth2/authorize',
+  TOKEN: '/oauth2/token',
+  REVOKE: '/oauth2/revoke',
+  LOGOUT: '/oauth2/logout',
+  USERINFO: '/oauth2/userinfo',
+} as const;
+
+export const AUTH7_SCOPES = {
+  OPENID: 'openid',
+  PROFILE: 'profile',
+  EMAIL: 'email',
+  ROLES: 'roles',
+} as const;

package/src/backend.ts

@@ -0,0 +1,96 @@
+// lib/backend.ts — server-side HTTP client untuk service7 backend
+// Hanya digunakan dari API routes (server-side). Tidak pernah diimport dari client components.
+//
+// Migration (Plan 11):
+//   - Untuk forwarding user identity ke backend: kirim accessToken
+//   - Untuk M2M service account: gunakan getServiceToken() dari lib/auth7/service-account
+//   - Fallback: legacy mintJWT dengan BACKEND_JWT_SECRET (untuk environment tanpa auth7)
+
+import { SignJWT } from 'jose';
+
+function getBackendUrl(): string {
+	const backendUrl = process.env.BACKEND_URL;
+	if (!backendUrl) throw new Error('[bos7] BACKEND_URL env var is required');
+	return backendUrl;
+}
+
+function getJwtSecret(): string {
+	return process.env.BACKEND_JWT_SECRET ?? '';
+}
+
+const SENTINEL_UUID = '00000000-0000-0000-0000-000000000001';
+
+async function mintJWT(): Promise<string> {
+	const jwtSecret = getJwtSecret();
+	if (!jwtSecret) {
+		throw new Error('[bos7] BACKEND_JWT_SECRET env var is required when accessToken is not provided');
+	}
+	const secret = new TextEncoder().encode(jwtSecret);
+	return new SignJWT({
+		branch_id: SENTINEL_UUID,
+		roles: ['service'],
+	})
+		.setProtectedHeader({ alg: 'HS256' })
+		.setSubject(SENTINEL_UUID)
+		.setJti(crypto.randomUUID())
+		.setExpirationTime('60s')
+		.setIssuedAt()
+		.sign(secret);
+}
+
+async function request<T>(
+	method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+	path: string,
+	options: { query?: Record<string, string>; body?: unknown; accessToken?: string } = {}
+): Promise<{ ok: boolean; data?: T; error?: string }> {
+	// Prefer real auth7 token (user or M2M), fall back to legacy minted JWT.
+	const token = options.accessToken ?? (await mintJWT());
+	const backendUrl = getBackendUrl();
+
+	let url = `${backendUrl}${path}`;
+	if (options.query && Object.keys(options.query).length > 0) {
+		url += '?' + new URLSearchParams(options.query).toString();
+	}
+
+	const res = await fetch(url, {
+		method,
+		headers: {
+			'Content-Type': 'application/json',
+			Authorization: `Bearer ${token}`,
+		},
+		...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
+	});
+
+	if (!res.ok) {
+		try {
+			const errBody = await res.json() as { error?: { message?: string; code?: string } };
+			const msg = errBody?.error?.message ?? errBody?.error?.code ?? `backend ${method} ${path} failed: ${res.status}`;
+			return { ok: false, error: msg };
+		} catch {
+			return { ok: false, error: `backend ${method} ${path} failed: ${res.status}` };
+		}
+	}
+
+	if (res.status === 204 || res.headers.get('content-length') === '0') {
+		return { ok: true };
+	}
+
+	const data = (await res.json()) as T;
+	return { ok: true, data };
+}
+
+export function backendGet<T>(path: string, query?: Record<string, string>, accessToken?: string) {
+	return request<T>('GET', path, { query, accessToken });
+}
+
+export function backendPost<T>(path: string, body: unknown, accessToken?: string) {
+	return request<T>('POST', path, { body, accessToken });
+}
+
+export function backendPut<T>(path: string, body: unknown, accessToken?: string) {
+	return request<T>('PUT', path, { body, accessToken });
+}
+
+export function backendDelete<T>(path: string, accessToken?: string) {
+	return request<T>('DELETE', path, { accessToken });
+}