@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/next-client.js

@@ -0,0 +1,156 @@
+/**
+ * AuthZ client (server-side only)
+ *
+ * Zero Trust Authentication Architecture:
+ * - AuthZ issues RS256-signed session JWTs
+ * - busibox-portal exchanges session JWTs for downstream access tokens
+ * - NO client credentials required for user operations
+ *
+ * This module uses the shared Zero Trust functions from busibox-app.
+ */
+import { exchangeTokenZeroTrust, getAuthHeaderZeroTrust, invalidateZeroTrustToken, clearZeroTrustTokenCache, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, } from '@jazzmind/busibox-app';
+// Re-export error utilities for use in middleware/routes
+export { InvalidSessionError, isInvalidSessionError };
+// Verbose logging toggle
+const VERBOSE_AUTHZ_LOGGING = process.env.VERBOSE_AUTHZ_LOGGING === 'true';
+function authzLog(...args) {
+    if (VERBOSE_AUTHZ_LOGGING) {
+        console.log(...args);
+    }
+}
+import { getAuthzBaseUrl } from './authz-url';
+// Re-export so existing consumers don't break
+export { getAuthzBaseUrl };
+/**
+ * Get standard RBAC client options for authz service calls.
+ * Zero Trust: Only authzUrl is needed - no admin tokens or client credentials.
+ *
+ * Import this instead of duplicating getAuthzOptions() in every route file.
+ */
+export function getAuthzOptions() {
+    return {
+        authzUrl: getAuthzBaseUrl(),
+    };
+}
+/**
+ * Get RBAC client options with an exchanged access token for admin operations.
+ *
+ * Use this for admin routes that need to access user management or RBAC APIs.
+ * Exchanges the session JWT for an authz-api access token.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * this request. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - The admin user's session JWT from requireAdminAuth()
+ * @returns Options object with authzUrl and accessToken for busibox-app RBAC functions
+ */
+export async function getAuthzOptionsWithToken(sessionJwt) {
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt,
+        audience: 'authz-api',
+        purpose: 'admin-operations',
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
+    });
+    return {
+        authzUrl: getAuthzBaseUrl(),
+        accessToken: result.accessToken,
+    };
+}
+/**
+ * Exchange session JWT for a downstream access token and return just the token string.
+ *
+ * Thin wrapper around exchangeTokenZeroTrust for the common case where you
+ * only need the access token, not the full response.
+ *
+ * @param sessionJwt - Session JWT from busibox-session cookie
+ * @param audience - Target service (e.g., 'agent-api', 'data-api')
+ * @param scopes - Optional scopes to request
+ * @returns Access token string
+ */
+export async function getApiToken(sessionJwt, audience, scopes) {
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt,
+        audience,
+        scopes,
+        purpose: process.env.APP_NAME || 'busibox-app',
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: VERBOSE_AUTHZ_LOGGING,
+    });
+    return result.accessToken;
+}
+// =============================================================================
+// Zero Trust Token Exchange (Preferred Method)
+// =============================================================================
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ * The session JWT cryptographically proves user identity.
+ *
+ * @param args.userId - Deprecated and ignored. User ID is extracted from the
+ *   session JWT by the authz service. Kept for backward compatibility.
+ */
+export async function exchangeWithSubjectToken(args) {
+    authzLog('[AUTHZ] Zero Trust token exchange:', {
+        userId: args.userId,
+        audience: args.audience,
+        scopes: args.scopes,
+    });
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt: args.sessionJwt,
+        audience: args.audience,
+        scopes: args.scopes,
+        purpose: args.purpose,
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: VERBOSE_AUTHZ_LOGGING,
+    });
+    return {
+        accessToken: result.accessToken,
+        tokenType: result.tokenType,
+        expiresIn: result.expiresIn,
+        scope: result.scope,
+    };
+}
+/**
+ * Get authorization header using session JWT (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ *
+ * @param args.userId - Deprecated and ignored. User ID is extracted from the
+ *   session JWT by the authz service. Kept for backward compatibility.
+ */
+export async function getAuthorizationHeaderWithSession(args) {
+    return getAuthHeaderZeroTrust({
+        sessionJwt: args.sessionJwt,
+        audience: args.audience,
+        scopes: args.scopes,
+        purpose: args.purpose,
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: VERBOSE_AUTHZ_LOGGING,
+    });
+}
+/**
+ * Invalidate a cached downstream token.
+ */
+export function invalidateDownstreamToken(userId, audience, scopes) {
+    invalidateZeroTrustToken(userId, audience, scopes || []);
+    authzLog('[AUTHZ] Token cache invalidated for:', { userId, audience });
+}
+/**
+ * Clear all cached tokens.
+ */
+export { clearZeroTrustTokenCache };
+// =============================================================================
+// Delegation Tokens (for background/scheduled tasks)
+// =============================================================================
+export { createDelegationToken, listDelegationTokens, revokeDelegationToken, } from './delegation';
+// =============================================================================
+// Utility Re-exports
+// =============================================================================
+export { getUserIdFromSessionJwt };
+//# sourceMappingURL=next-client.js.map

package/dist/lib/authz/next-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-client.js","sourceRoot":"","sources":["../../../src/lib/authz/next-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,uBAAuB,CAAC;AAE/B,yDAAyD;AACzD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AAKtD,yBAAyB;AACzB,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,CAAC;AAE3E,SAAS,QAAQ,CAAC,GAAG,IAAe;IAClC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,8CAA8C;AAC9C,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAC/D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,UAAU;QACV,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,kBAAkB;KAC5B,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;KACtD,CACF,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,QAAuB,EACvB,MAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,UAAU;QACV,QAAQ;QACR,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;KAC/C,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,qBAAqB;KAC/B,CACF,CAAC;IAEF,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAO9C;IACC,QAAQ,CAAC,oCAAoC,EAAE;QAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,qBAAqB;KAC/B,CACF,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAOvD;IACC,OAAO,sBAAsB,CAC3B;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,qBAAqB;KAC/B,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,QAAuB,EACvB,MAAiB;IAEjB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/lib/authz/passkey.d.ts

@@ -0,0 +1,78 @@
+/**
+ * WebAuthn / Passkey Utility Functions
+ *
+ * Implements passkey registration and authentication using the WebAuthn standard.
+ * Uses @simplewebauthn/server for server-side operations.
+ *
+ * NOTE: Passkey storage is now handled by the authz service.
+ * This module performs WebAuthn verification locally, then stores results via authz.
+ */
+import type { RegistrationResponseJSON, AuthenticationResponseJSON } from '@simplewebauthn/types';
+import { type Passkey } from './session-client';
+import { type AuthzUser } from './user-management';
+/**
+ * Generate registration options for a user to create a new passkey
+ * @param userId - User ID
+ * @param userEmail - User email
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export declare function generatePasskeyRegistrationOptions(userId: string, userEmail: string, sessionJwt: string): Promise<import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON>;
+/**
+ * Verify a registration response and store the new passkey
+ * @param userId - User ID
+ * @param response - Registration response from WebAuthn
+ * @param deviceName - Name for the passkey
+ * @param sessionJwt - Session JWT for authentication with authz service
+ */
+export declare function verifyPasskeyRegistration(userId: string, response: RegistrationResponseJSON, deviceName: string, sessionJwt: string): Promise<Passkey>;
+/**
+ * Generate authentication options for passkey login
+ *
+ * Note: We don't look up user by email here because:
+ * 1. During login, we don't have an access token yet
+ * 2. Modern browsers support "discoverable credentials" which auto-select the right passkey
+ * 3. Allowing any passkey is actually the correct UX for passkey authentication
+ */
+export declare function generatePasskeyAuthenticationOptions(_email?: string): Promise<import("@simplewebauthn/server").PublicKeyCredentialRequestOptionsJSON>;
+/**
+ * Verify an authentication response and return the user and session
+ */
+export declare function verifyPasskeyAuthentication(response: AuthenticationResponseJSON): Promise<{
+    passkey: Passkey & {
+        user_id: string;
+    };
+    user: AuthzUser;
+    session: {
+        token: string;
+        expires_at: string;
+    };
+}>;
+/**
+ * Get all passkeys for a user
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function getUserPasskeys(userId: string, sessionJwt?: string): Promise<Passkey[]>;
+/**
+ * Delete a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to delete
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function deletePasskey(userId: string, passkeyId: string, sessionJwt?: string): Promise<Passkey>;
+/**
+ * Rename a passkey
+ * @param userId - User ID (for ownership verification)
+ * @param passkeyId - Passkey ID to rename
+ * @param newName - New name for the passkey
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function renamePasskey(userId: string, passkeyId: string, newName: string, sessionJwt?: string): Promise<Passkey>;
+/**
+ * Check if user has any passkeys
+ * @param userId - User ID
+ * @param sessionJwt - Optional session JWT for self-service authentication
+ */
+export declare function userHasPasskeys(userId: string, sessionJwt?: string): Promise<boolean>;
+export declare function cleanupExpiredChallenges(): Promise<any>;
+//# sourceMappingURL=passkey.d.ts.map

package/dist/lib/authz/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/passkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,KAAK,EACV,wBAAwB,EACxB,0BAA0B,EAG3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAML,KAAK,OAAO,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA4HnD;;;;;GAKG;AACH,wBAAsB,kCAAkC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,oFA0C7G;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,oBAkDnB;AAMD;;;;;;;GAOG;AACH,wBAAsB,oCAAoC,CAAC,MAAM,CAAC,EAAE,MAAM,mFAmBzE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,0BAA0B,GAAG,OAAO,CAAC;IAC/F,OAAO,EAAE,OAAO,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD,CAAC,CAuID;AAMD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,sBAMxE;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBAgBzF;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkC7H;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3F;AAoBD,wBAAsB,wBAAwB,iBAgB7C"}