@jazzmind/busibox-app 3.0.18

package/dist/lib/authz/user-management.d.ts

@@ -0,0 +1,106 @@
+/**
+ * User Management Client
+ *
+ * Zero Trust Architecture:
+ * All user CRUD operations go through authz. Authentication is handled via:
+ * - User operations: Pass the user's session JWT (exchanged for access token)
+ * - Login flows: Authz endpoints are unauthenticated (they ARE the authentication)
+ *
+ * There are NO admin tokens or client credentials. All operations are either:
+ * 1. User-initiated (with user's JWT) - user's scopes determine access
+ * 2. Service account (with service account JWT) - for background operations
+ */
+import { type RbacUser, type UserListResponse, type CreateUserParams, type UpdateUserParams, type ListUsersParams } from '@jazzmind/busibox-app';
+/**
+ * AuthzUser type - the user type returned by the authz service.
+ * This is explicitly named to avoid conflict with busibox-portal's local User type.
+ */
+export type AuthzUser = RbacUser;
+export type { UserListResponse, CreateUserParams, UpdateUserParams, ListUsersParams };
+/**
+ * Exchange a session JWT for an authz-api access token.
+ * Use this at the API route level before calling user management functions.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * the scopes parameter. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - User's session JWT
+ * @returns Access token for authz-api
+ */
+export declare function getAuthzAccessToken(sessionJwt: string): Promise<string>;
+/**
+ * Create a new user in authz
+ */
+export declare function createUser(params: {
+    email: string;
+    roleIds?: string[];
+    status?: 'PENDING' | 'ACTIVE' | 'DEACTIVATED';
+    assignedBy?: string;
+}, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Update a user in authz
+ */
+export declare function updateUser(userId: string, updates: UpdateUserParams, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Delete a user from authz
+ */
+export declare function deleteUser(userId: string, accessToken?: string): Promise<void>;
+/**
+ * Activate a pending user
+ */
+export declare function activateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Deactivate an active user
+ */
+export declare function deactivateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * Reactivate a deactivated user
+ */
+export declare function reactivateUser(userId: string, accessToken?: string): Promise<AuthzUser>;
+/**
+ * List users with pagination
+ */
+export declare function listUsers(params?: ListUsersParams, accessToken?: string): Promise<UserListResponse>;
+/**
+ * Get a single user by ID
+ */
+export declare function getUser(userId: string, accessToken?: string): Promise<AuthzUser | null>;
+/**
+ * Get a user by email address
+ * Returns null if user not found
+ */
+export declare function getUserByEmail(email: string, accessToken?: string): Promise<AuthzUser | null>;
+/**
+ * Add a role to a user
+ */
+export declare function addUserRole(userId: string, roleId: string, accessToken?: string): Promise<void>;
+/**
+ * Remove a role from a user
+ */
+export declare function removeUserRole(userId: string, roleId: string, accessToken?: string): Promise<void>;
+/**
+ * Check if user is active.
+ *
+ * Fetches the user from authz and checks their status field.
+ *
+ * @param userId - User ID to check
+ * @param accessToken - Access token (JWT) for the authz call
+ */
+export declare function isUserActive(userId: string, accessToken?: string): Promise<boolean>;
+/**
+ * Get user with roles from authz service, returned in a
+ * presentation-friendly shape with Date objects.
+ *
+ * @param userId - User ID (UUID)
+ * @param accessToken - Access token (JWT) for the authz call
+ */
+export declare function getUserWithRoles(userId: string, accessToken?: string): Promise<{
+    id: string;
+    email: string;
+    status: string | undefined;
+    lastLoginAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+    roles: import("@jazzmind/busibox-app").Role[];
+} | null>;
+//# sourceMappingURL=user-management.d.ts.map

package/dist/lib/authz/user-management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/user-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAYL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EAGrB,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;AAGjC,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AA0BtF;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc7E;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IACN,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAWpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGpF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG3F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG7F;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAG7F;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,MAAM,CAAC,EAAE,eAAe,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAgBD;;GAEG;AACH,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAI7F;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAGnG;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAMD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQzF;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;;;;;;;;UAuB1E"}

package/dist/lib/authz/user-management.js

@@ -0,0 +1,205 @@
+/**
+ * User Management Client
+ *
+ * Zero Trust Architecture:
+ * All user CRUD operations go through authz. Authentication is handled via:
+ * - User operations: Pass the user's session JWT (exchanged for access token)
+ * - Login flows: Authz endpoints are unauthenticated (they ARE the authentication)
+ *
+ * There are NO admin tokens or client credentials. All operations are either:
+ * 1. User-initiated (with user's JWT) - user's scopes determine access
+ * 2. Service account (with service account JWT) - for background operations
+ */
+import { createUser as authzCreateUser, updateUser as authzUpdateUser, deleteUser as authzDeleteUser, activateUser as authzActivateUser, deactivateUser as authzDeactivateUser, reactivateUser as authzReactivateUser, listUsers as authzListUsers, getUser as authzGetUser, getUserByEmail as authzGetUserByEmail, addUserRole as authzAddUserRole, removeUserRole as authzRemoveUserRole, exchangeTokenZeroTrust, } from '@jazzmind/busibox-app';
+// Import getAuthzBaseUrl for consistent URL handling
+import { getAuthzBaseUrl } from './next-client';
+/**
+ * Get auth options for user management operations.
+ * Zero Trust: All operations require an access token (JWT).
+ *
+ * @param accessToken - Access token (JWT) with appropriate scopes
+ * @returns AdminAuthOptions for rbac client
+ */
+function getAuthOptions(accessToken) {
+    // Get URL at call time, not module load time (important for Next.js)
+    const authzUrl = getAuthzBaseUrl();
+    if (!accessToken) {
+        throw new Error('Zero Trust: accessToken is required for user management operations');
+    }
+    return {
+        accessToken,
+        authzUrl,
+    };
+}
+/**
+ * Exchange a session JWT for an authz-api access token.
+ * Use this at the API route level before calling user management functions.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * the scopes parameter. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - User's session JWT
+ * @returns Access token for authz-api
+ */
+export async function getAuthzAccessToken(sessionJwt) {
+    // Get URL at call time, not module load time (important for Next.js)
+    const authzUrl = getAuthzBaseUrl();
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt,
+        audience: 'authz-api',
+        purpose: 'user-management',
+    }, {
+        authzBaseUrl: authzUrl,
+        verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
+    });
+    return result.accessToken;
+}
+/**
+ * Create a new user in authz
+ */
+export async function createUser(params, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzCreateUser({
+        email: params.email,
+        role_ids: params.roleIds,
+        status: params.status || 'PENDING',
+        assigned_by: params.assignedBy,
+    }, options);
+}
+/**
+ * Update a user in authz
+ */
+export async function updateUser(userId, updates, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzUpdateUser(userId, updates, options);
+}
+/**
+ * Delete a user from authz
+ */
+export async function deleteUser(userId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzDeleteUser(userId, options);
+}
+/**
+ * Activate a pending user
+ */
+export async function activateUser(userId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzActivateUser(userId, options);
+}
+/**
+ * Deactivate an active user
+ */
+export async function deactivateUser(userId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzDeactivateUser(userId, options);
+}
+/**
+ * Reactivate a deactivated user
+ */
+export async function reactivateUser(userId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzReactivateUser(userId, options);
+}
+/**
+ * List users with pagination
+ */
+export async function listUsers(params, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzListUsers(params || {}, options);
+}
+/**
+ * Validate that a string is a valid UUID format
+ */
+function validateUserId(userId) {
+    if (!userId) {
+        throw new Error('User ID is required');
+    }
+    const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    if (!uuidRegex.test(userId)) {
+        throw new Error(`Invalid user ID format: ${userId}`);
+    }
+    return userId;
+}
+/**
+ * Get a single user by ID
+ */
+export async function getUser(userId, accessToken) {
+    const validatedUserId = validateUserId(userId);
+    const options = getAuthOptions(accessToken);
+    return authzGetUser(validatedUserId, options);
+}
+/**
+ * Get a user by email address
+ * Returns null if user not found
+ */
+export async function getUserByEmail(email, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzGetUserByEmail(email, options);
+}
+/**
+ * Add a role to a user
+ */
+export async function addUserRole(userId, roleId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzAddUserRole(userId, roleId, options);
+}
+/**
+ * Remove a role from a user
+ */
+export async function removeUserRole(userId, roleId, accessToken) {
+    const options = getAuthOptions(accessToken);
+    return authzRemoveUserRole(userId, roleId, options);
+}
+// ============================================================================
+// Convenience Helpers
+// ============================================================================
+/**
+ * Check if user is active.
+ *
+ * Fetches the user from authz and checks their status field.
+ *
+ * @param userId - User ID to check
+ * @param accessToken - Access token (JWT) for the authz call
+ */
+export async function isUserActive(userId, accessToken) {
+    try {
+        const user = await getUser(userId, accessToken);
+        return user?.status === 'ACTIVE';
+    }
+    catch (error) {
+        console.error('[USER-MGMT] Error checking user status:', error);
+        return false;
+    }
+}
+/**
+ * Get user with roles from authz service, returned in a
+ * presentation-friendly shape with Date objects.
+ *
+ * @param userId - User ID (UUID)
+ * @param accessToken - Access token (JWT) for the authz call
+ */
+export async function getUserWithRoles(userId, accessToken) {
+    try {
+        const validatedId = validateUserId(userId);
+        const user = await getUser(validatedId, accessToken);
+        if (!user) {
+            console.warn(`[USER-MGMT] getUser returned null for userId: ${userId}`);
+            return null;
+        }
+        return {
+            id: userId,
+            email: user.email,
+            status: user.status,
+            lastLoginAt: user.last_login_at ? new Date(user.last_login_at) : null,
+            createdAt: new Date(user.created_at),
+            updatedAt: new Date(user.updated_at),
+            roles: user.roles || [],
+        };
+    }
+    catch (error) {
+        console.error(`[USER-MGMT] Error getting user with roles for userId ${userId}:`, error);
+        return null;
+    }
+}
+//# sourceMappingURL=user-management.js.map

package/dist/lib/authz/user-management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-management.js","sourceRoot":"","sources":["../../../src/lib/authz/user-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,UAAU,IAAI,eAAe,EAC7B,UAAU,IAAI,eAAe,EAC7B,UAAU,IAAI,eAAe,EAC7B,YAAY,IAAI,iBAAiB,EACjC,cAAc,IAAI,mBAAmB,EACrC,cAAc,IAAI,mBAAmB,EACrC,SAAS,IAAI,cAAc,EAC3B,OAAO,IAAI,YAAY,EACvB,cAAc,IAAI,mBAAmB,EACrC,WAAW,IAAI,gBAAgB,EAC/B,cAAc,IAAI,mBAAmB,EAOrC,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAW/B,qDAAqD;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,WAAoB;IAC1C,qEAAqE;IACrE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,OAAO;QACL,WAAW;QACX,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,qEAAqE;IACrE,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;QAC1C,UAAU;QACV,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,iBAAiB;KAC3B,EAAE;QACD,YAAY,EAAE,QAAQ;QACtB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;KACtD,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAKC,EACD,WAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CACpB;QACE,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,OAAyB,EACzB,WAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,WAAoB;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAoB;IACrE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAoB;IACvE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,WAAoB;IACvE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAwB,EACxB,WAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,cAAc,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAiC;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,SAAS,GAAG,iEAAiE,CAAC;IACpF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,WAAoB;IAChE,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,WAAoB;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,MAAc,EACd,WAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,MAAc,EACd,WAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,WAAoB;IACrE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,WAAoB;IACzE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;SACxB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/authz/zero-trust.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Zero Trust Token Exchange for Server-Side Applications
+ *
+ * This module provides server-side token exchange using the Zero Trust pattern:
+ * - Uses session JWT as subject_token (cryptographic proof of user identity)
+ * - NO client credentials required for user operations
+ * - Follows RFC 8693 token exchange grant type
+ *
+ * Architecture:
+ * 1. User authenticates with authz service, receives session JWT
+ * 2. Frontend apps (portal, busibox-agents) call this to exchange for downstream tokens
+ * 3. No client secrets needed - the session JWT proves user identity
+ *
+ * Usage:
+ * ```typescript
+ * import { exchangeTokenZeroTrust, createZeroTrustClient } from '@jazzmind/busibox-app/lib/authz';
+ *
+ * // Direct function call
+ * const token = await exchangeTokenZeroTrust({
+ *   sessionJwt: 'eyJ...',
+ *   audience: 'agent-api',
+ *   scopes: ['agents:read'],
+ * });
+ *
+ * // Or create a client instance
+ * const authzClient = createZeroTrustClient({
+ *   authzBaseUrl: 'http://authz-api:8010',
+ * });
+ * const token = await authzClient.exchangeToken({ sessionJwt, audience: 'agent-api' });
+ * ```
+ */
+/**
+ * Error thrown when token exchange fails due to an invalid or expired session.
+ * This indicates the user should be logged out and redirected to login.
+ */
+export declare class InvalidSessionError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly shouldLogout: boolean;
+    constructor(message: string, code: string, status?: number);
+}
+/**
+ * Check if an error indicates the user should be logged out.
+ */
+export declare function isInvalidSessionError(error: unknown): error is InvalidSessionError;
+export type AuthzAudience = 'data-api' | 'search-api' | 'agent-api' | (string & {});
+export interface ZeroTrustExchangeRequest {
+    /** The user's session JWT from authz (proves user identity) */
+    sessionJwt: string;
+    /** Target service audience (e.g., 'agent-api', 'data-api') */
+    audience: AuthzAudience;
+    /** OAuth2 scopes to request (optional) */
+    scopes?: string[];
+    /** Purpose label for audit (optional) */
+    purpose?: string;
+    /**
+     * App resource ID (UUID) for app-scoped tokens.
+     * When provided, authz verifies user has access to this app via RBAC bindings.
+     * The issued token will include app_id claim and only roles that grant app access.
+     */
+    resourceId?: string;
+}
+export interface ZeroTrustExchangeResponse {
+    accessToken: string;
+    tokenType: 'bearer';
+    expiresIn: number;
+    scope: string;
+    /** When the token expires (timestamp in ms) */
+    expiresAt: number;
+}
+export interface ZeroTrustClientConfig {
+    /** AuthZ service base URL (e.g., 'http://authz-api:8010') */
+    authzBaseUrl?: string;
+    /** Enable verbose logging (default: false) */
+    verbose?: boolean;
+    /** Token expiry buffer in seconds (default: 60) */
+    expiryBufferSeconds?: number;
+}
+export interface ZeroTrustClient {
+    /** Exchange session JWT for downstream access token */
+    exchangeToken(request: ZeroTrustExchangeRequest): Promise<ZeroTrustExchangeResponse>;
+    /** Get authorization header (Bearer token) */
+    getAuthHeader(request: ZeroTrustExchangeRequest): Promise<string>;
+    /** Clear cached token for audience/scopes */
+    invalidateToken(audience: string, scopes?: string[]): void;
+    /** Clear all cached tokens */
+    invalidateAllTokens(): void;
+}
+interface JwtClaims {
+    sub: string;
+    exp: number;
+    iat?: number;
+    typ?: string;
+    [key: string]: unknown;
+}
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the core function that implements RFC 8693 token exchange:
+ * - Uses subject_token (the session JWT) to prove user identity
+ * - NO client credentials required
+ * - The session JWT cryptographically proves who the user is
+ *
+ * @param request - Token exchange request
+ * @param config - Optional configuration overrides
+ * @returns Token exchange response with access token
+ */
+export declare function exchangeTokenZeroTrust(request: ZeroTrustExchangeRequest, config?: ZeroTrustClientConfig): Promise<ZeroTrustExchangeResponse>;
+/**
+ * Get an authorization header (Bearer token) using Zero Trust exchange.
+ *
+ * @param request - Token exchange request
+ * @param config - Optional configuration
+ * @returns Authorization header string (e.g., "Bearer eyJ...")
+ */
+export declare function getAuthHeaderZeroTrust(request: ZeroTrustExchangeRequest, config?: ZeroTrustClientConfig): Promise<string>;
+/**
+ * Create a Zero Trust client instance with fixed configuration.
+ *
+ * This is useful when you want to reuse the same config across multiple calls.
+ *
+ * @param config - Client configuration
+ * @returns Zero Trust client instance
+ */
+export declare function createZeroTrustClient(config?: ZeroTrustClientConfig): ZeroTrustClient;
+/**
+ * Invalidate a cached token for a specific user/audience/scopes combination.
+ *
+ * @param userId - User ID
+ * @param audience - Target audience
+ * @param scopes - Scopes (optional)
+ */
+export declare function invalidateZeroTrustToken(userId: string, audience: string, scopes?: string[]): void;
+/**
+ * Clear all cached Zero Trust tokens.
+ */
+export declare function clearZeroTrustTokenCache(): void;
+/**
+ * Check if a token string is in JWT format.
+ */
+export declare function isValidJwtFormat(token: string): boolean;
+/**
+ * Parse JWT claims without verification.
+ * Use for extracting user ID, expiry, etc. - actual verification is done by authz.
+ */
+export declare function parseJwtClaimsUnsafe(token: string): JwtClaims | null;
+/**
+ * Extract user ID from a session JWT (server-only, checks "sub" only).
+ *
+ * For isomorphic code that also handles legacy tokens with "user_id" claim,
+ * see getUserIdFromToken in auth-helper.ts.
+ */
+export declare function getUserIdFromSessionJwt(sessionJwt: string): string | null;
+export {};
+//# sourceMappingURL=zero-trust.d.ts.map

package/dist/lib/authz/zero-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zero-trust.d.ts","sourceRoot":"","sources":["../../../src/lib/authz/zero-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAUH;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,YAAY,EAAE,OAAO,CAAC;gBAE1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAY;CAchE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAMD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,aAAa,CAAC;IACxB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mDAAmD;IACnD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,aAAa,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACrF,8CAA8C;IAC9C,aAAa,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,6CAA6C;IAC7C,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3D,8BAA8B;IAC9B,mBAAmB,IAAI,IAAI,CAAC;CAC7B;AAmED,UAAU,SAAS;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,EACjC,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CA0JpC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,wBAAwB,EACjC,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAwBrF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAM,EAAO,GACpB,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAMD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGzE"}