@jsango/auth 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JSango contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,29 @@
+# @jsango/auth
+
+> Authentication and authorization subsystem with Session, JWT, API Key strategies, Scrypt hashing, and object policies.
+
+Part of the **[jsango](https://github.com/jsango/jsango)** backend framework for TypeScript.
+
+## Installation
+
+```bash
+pnpm add @jsango/auth
+```
+
+## Usage
+
+```typescript
+import { AuthService, ScryptHasher, PolicyRegistry, definePolicy } from '@jsango/auth';
+
+const hasher = new ScryptHasher();
+const hash = await hasher.hash('secure-password');
+const valid = await hasher.verify('secure-password', hash);
+```
+
+## Documentation
+
+For full architecture documentation and guides, visit the [jsango documentation](https://github.com/jsango/jsango/tree/main/docs).
+
+## License
+
+MIT © jsango contributors

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './public/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from './public/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/internal/base64url.d.ts

@@ -0,0 +1,6 @@
+export declare class Base64Url {
+    static encode(input: string | Buffer): string;
+    static decode(input: string): string;
+    static decodeToBuffer(input: string): Buffer;
+}
+//# sourceMappingURL=base64url.d.ts.map

package/dist/internal/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAS;WACN,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;WAKtC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;WAQ7B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAOpD"}

package/dist/internal/base64url.js

@@ -0,0 +1,21 @@
+export class Base64Url {
+    static encode(input) {
+        const buf = typeof input === 'string' ? Buffer.from(input, 'utf8') : input;
+        return buf.toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    }
+    static decode(input) {
+        let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+        while (base64.length % 4 !== 0) {
+            base64 += '=';
+        }
+        return Buffer.from(base64, 'base64').toString('utf8');
+    }
+    static decodeToBuffer(input) {
+        let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+        while (base64.length % 4 !== 0) {
+            base64 += '=';
+        }
+        return Buffer.from(base64, 'base64');
+    }
+}
+//# sourceMappingURL=base64url.js.map

package/dist/internal/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/internal/base64url.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAS;IACb,MAAM,CAAC,MAAM,CAAC,KAAsB;QACzC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1F,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,KAAa;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAEM,MAAM,CAAC,cAAc,CAAC,KAAa;QACxC,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/internal/crypto-utils.d.ts

@@ -0,0 +1,11 @@
+export declare class CryptoUtils {
+    /**
+     * Generates a cryptographically secure random token string.
+     */
+    static generateSecureToken(byteLength?: number): string;
+    /**
+     * Hashes a value with SHA-256 (used for API key hashing and token identification).
+     */
+    static sha256(data: string): string;
+}
+//# sourceMappingURL=crypto-utils.d.ts.map

package/dist/internal/crypto-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.d.ts","sourceRoot":"","sources":["../../src/internal/crypto-utils.ts"],"names":[],"mappings":"AAEA,qBAAa,WAAW;IACtB;;OAEG;WACW,mBAAmB,CAAC,UAAU,SAAK,GAAG,MAAM;IAI1D;;OAEG;WACW,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG3C"}

package/dist/internal/crypto-utils.js

@@ -0,0 +1,16 @@
+import * as crypto from 'node:crypto';
+export class CryptoUtils {
+    /**
+     * Generates a cryptographically secure random token string.
+     */
+    static generateSecureToken(byteLength = 32) {
+        return crypto.randomBytes(byteLength).toString('hex');
+    }
+    /**
+     * Hashes a value with SHA-256 (used for API key hashing and token identification).
+     */
+    static sha256(data) {
+        return crypto.createHash('sha256').update(data, 'utf8').digest('hex');
+    }
+}
+//# sourceMappingURL=crypto-utils.js.map

package/dist/internal/crypto-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-utils.js","sourceRoot":"","sources":["../../src/internal/crypto-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,MAAM,OAAO,WAAW;IACtB;;OAEG;IACI,MAAM,CAAC,mBAAmB,CAAC,UAAU,GAAG,EAAE;QAC/C,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,IAAY;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;CACF"}

package/dist/internal/timing.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ */
+export declare function timingSafeEqualString(a: string, b: string): boolean;
+//# sourceMappingURL=timing.d.ts.map

package/dist/internal/timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../../src/internal/timing.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAWnE"}

package/dist/internal/timing.js

@@ -0,0 +1,15 @@
+import * as crypto from 'node:crypto';
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ */
+export function timingSafeEqualString(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length) {
+        // Perform dummy timing-safe comparison on identical buffer to equalize execution time
+        crypto.timingSafeEqual(bufA, bufA);
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=timing.js.map

package/dist/internal/timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.js","sourceRoot":"","sources":["../../src/internal/timing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,sFAAsF;QACtF,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/public/authentication/api-key.d.ts

@@ -0,0 +1,17 @@
+import type { HttpRequest, RequestContext } from '@jsango/http';
+import type { AuthenticationResult, IAuthenticationStrategy, Identity } from '../types.js';
+export interface IApiKeyVerifier {
+    verifyApiKey(hashedKey: string, rawKey: string): Promise<Identity | undefined>;
+}
+export interface ApiKeyAuthStrategyOptions {
+    readonly verifier: IApiKeyVerifier;
+    readonly headerName?: string | undefined;
+}
+export declare class ApiKeyAuthenticationStrategy implements IAuthenticationStrategy {
+    readonly name = "api_key";
+    readonly verifier: IApiKeyVerifier;
+    readonly headerName: string;
+    constructor(options: ApiKeyAuthStrategyOptions);
+    authenticate(request: HttpRequest, _context: RequestContext): Promise<AuthenticationResult>;
+}
+//# sourceMappingURL=api-key.d.ts.map

package/dist/public/authentication/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE3F,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,4BAA6B,YAAW,uBAAuB;IAC1E,SAAgB,IAAI,aAAa;IACjC,SAAgB,QAAQ,EAAE,eAAe,CAAC;IAC1C,SAAgB,UAAU,EAAE,MAAM,CAAC;gBAEhB,OAAO,EAAE,yBAAyB;IAKxC,YAAY,CACvB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,oBAAoB,CAAC;CAiDjC"}

package/dist/public/authentication/api-key.js

@@ -0,0 +1,57 @@
+import { CryptoUtils } from '../../internal/crypto-utils.js';
+import { AnonymousIdentity } from '../identity.js';
+export class ApiKeyAuthenticationStrategy {
+    name = 'api_key';
+    verifier;
+    headerName;
+    constructor(options) {
+        this.verifier = options.verifier;
+        this.headerName = (options.headerName ?? 'x-api-key').toLowerCase();
+    }
+    async authenticate(request, _context) {
+        let rawKey = request.headers.get(this.headerName);
+        // Also check Authorization: ApiKey <key>
+        if (!rawKey) {
+            const authHeader = request.headers.get('authorization');
+            if (authHeader) {
+                const match = /^ApiKey\s+(.+)$/i.exec(authHeader);
+                if (match && match[1]) {
+                    rawKey = match[1].trim();
+                }
+            }
+        }
+        if (!rawKey) {
+            return {
+                status: 'unauthenticated',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        const hashedKey = CryptoUtils.sha256(rawKey);
+        try {
+            const identity = await this.verifier.verifyApiKey(hashedKey, rawKey);
+            if (!identity) {
+                return {
+                    status: 'invalid_credentials',
+                    identity: new AnonymousIdentity(),
+                    strategy: this.name,
+                };
+            }
+            return {
+                status: 'authenticated',
+                identity,
+                strategy: this.name,
+                metadata: { hashedKeyPrefix: hashedKey.slice(0, 8) },
+            };
+        }
+        catch (err) {
+            return {
+                status: 'invalid_credentials',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+                error: err instanceof Error ? err : new Error(String(err)),
+            };
+        }
+    }
+}
+//# sourceMappingURL=api-key.js.map

package/dist/public/authentication/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/public/authentication/api-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD,MAAM,OAAO,4BAA4B;IACvB,IAAI,GAAG,SAAS,CAAC;IACjB,QAAQ,CAAkB;IAC1B,UAAU,CAAS;IAEnC,YAAmB,OAAkC;QACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,OAAoB,EACpB,QAAwB;QAExB,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAElD,yCAAyC;QACzC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;oBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;iBACpB,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,QAAQ,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;aACrD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/public/authentication/bearer.d.ts

@@ -0,0 +1,27 @@
+import type { HttpRequest, RequestContext } from '@jsango/http';
+import type { AuthenticationResult, IAuthenticationStrategy, Identity } from '../types.js';
+import type { JwtService, JwtPayload } from './jwt.js';
+export interface ITokenVerifier {
+    verifyToken(token: string): Promise<Identity | undefined>;
+}
+export declare class JwtTokenVerifier implements ITokenVerifier {
+    private readonly jwt;
+    private readonly identityResolver?;
+    constructor(options: {
+        jwt: JwtService;
+        identityResolver?: (payload: JwtPayload) => Promise<Identity> | Identity;
+    });
+    verifyToken(token: string): Promise<Identity | undefined>;
+}
+export interface BearerAuthStrategyOptions {
+    readonly verifier: ITokenVerifier;
+    readonly realm?: string | undefined;
+}
+export declare class BearerTokenAuthenticationStrategy implements IAuthenticationStrategy {
+    readonly name = "bearer";
+    readonly verifier: ITokenVerifier;
+    readonly realm: string;
+    constructor(options: BearerAuthStrategyOptions);
+    authenticate(request: HttpRequest, _context: RequestContext): Promise<AuthenticationResult>;
+}
+//# sourceMappingURL=bearer.d.ts.map

package/dist/public/authentication/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGvD,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED,qBAAa,gBAAiB,YAAW,cAAc;IACrD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACoC;gBAEnD,OAAO,EAAE;QAC1B,GAAG,EAAE,UAAU,CAAC;QAChB,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;KAC1E;IAKY,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;CAsBvE;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,qBAAa,iCAAkC,YAAW,uBAAuB;IAC/E,SAAgB,IAAI,YAAY;IAChC,SAAgB,QAAQ,EAAE,cAAc,CAAC;IACzC,SAAgB,KAAK,EAAE,MAAM,CAAC;gBAEX,OAAO,EAAE,yBAAyB;IAKxC,YAAY,CACvB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,oBAAoB,CAAC;CA+DjC"}

package/dist/public/authentication/bearer.js

@@ -0,0 +1,97 @@
+import { AnonymousIdentity, UserIdentity } from '../identity.js';
+import { TokenExpiredError } from '../errors.js';
+export class JwtTokenVerifier {
+    jwt;
+    identityResolver;
+    constructor(options) {
+        this.jwt = options.jwt;
+        this.identityResolver = options.identityResolver;
+    }
+    async verifyToken(token) {
+        const payload = await this.jwt.verify(token);
+        if (this.identityResolver) {
+            return this.identityResolver(payload);
+        }
+        const sub = payload.sub ?? payload['id'] ?? 'anonymous';
+        const roles = Array.isArray(payload['roles']) ? payload['roles'] : [];
+        const permissions = Array.isArray(payload['permissions'])
+            ? payload['permissions']
+            : [];
+        const tenantId = typeof payload['tenantId'] === 'string' ? payload['tenantId'] : undefined;
+        return new UserIdentity({
+            id: sub,
+            roles,
+            permissions,
+            tenantId,
+            metadata: payload,
+        });
+    }
+}
+export class BearerTokenAuthenticationStrategy {
+    name = 'bearer';
+    verifier;
+    realm;
+    constructor(options) {
+        this.verifier = options.verifier;
+        this.realm = options.realm ?? 'Application';
+    }
+    async authenticate(request, _context) {
+        const authHeader = request.headers.get('authorization');
+        if (!authHeader) {
+            return {
+                status: 'unauthenticated',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        const parts = authHeader.trim().split(/\s+/);
+        const scheme = parts[0]?.toLowerCase();
+        if (scheme !== 'bearer') {
+            return {
+                status: 'unauthenticated',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        if (parts.length < 2 || !parts[1] || parts[1].trim().length === 0) {
+            return {
+                status: 'malformed_credentials',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+            };
+        }
+        const token = parts[1].trim();
+        try {
+            const identity = await this.verifier.verifyToken(token);
+            if (!identity) {
+                return {
+                    status: 'invalid_credentials',
+                    identity: new AnonymousIdentity(),
+                    strategy: this.name,
+                };
+            }
+            return {
+                status: 'authenticated',
+                identity,
+                strategy: this.name,
+            };
+        }
+        catch (err) {
+            if (err instanceof TokenExpiredError) {
+                return {
+                    status: 'expired_credentials',
+                    identity: new AnonymousIdentity(),
+                    strategy: this.name,
+                    error: err,
+                };
+            }
+            return {
+                status: 'invalid_credentials',
+                identity: new AnonymousIdentity(),
+                strategy: this.name,
+                error: err instanceof Error ? err : new Error(String(err)),
+            };
+        }
+    }
+}
+//# sourceMappingURL=bearer.js.map

package/dist/public/authentication/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../../src/public/authentication/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAMjD,MAAM,OAAO,gBAAgB;IACV,GAAG,CAAa;IAChB,gBAAgB,CACqC;IAEtE,YAAmB,OAGlB;QACC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,KAAa;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAK,OAAO,CAAC,IAAI,CAAwB,IAAI,WAAW,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACvD,CAAC,CAAE,OAAO,CAAC,aAAa,CAAc;YACtC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE3F,OAAO,IAAI,YAAY,CAAC;YACtB,EAAE,EAAE,GAAG;YACP,KAAK;YACL,WAAW;YACX,QAAQ;YACR,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;CACF;AAOD,MAAM,OAAO,iCAAiC;IAC5B,IAAI,GAAG,QAAQ,CAAC;IAChB,QAAQ,CAAiB;IACzB,KAAK,CAAS;IAE9B,YAAmB,OAAkC;QACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,OAAoB,EACpB,QAAwB;QAExB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,OAAO;gBACL,MAAM,EAAE,uBAAuB;gBAC/B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;oBACL,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;oBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;iBACpB,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,eAAe;gBACvB,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO;oBACL,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;oBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,KAAK,EAAE,GAAG;iBACX,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,IAAI,iBAAiB,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aAC3D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/public/authentication/jwt.d.ts

@@ -0,0 +1,60 @@
+export type JwtAlgorithm = 'HS256' | 'HS384' | 'HS512';
+export interface JwtHeader {
+    readonly alg: JwtAlgorithm;
+    readonly typ: 'JWT';
+    readonly kid?: string | undefined;
+}
+export interface JwtPayload {
+    readonly sub?: string | undefined;
+    readonly iss?: string | undefined;
+    readonly aud?: string | readonly string[] | undefined;
+    readonly exp?: number | undefined;
+    readonly nbf?: number | undefined;
+    readonly iat?: number | undefined;
+    readonly jti?: string | undefined;
+    readonly [key: string]: unknown;
+}
+export interface JwtSignOptions {
+    readonly algorithm?: JwtAlgorithm | undefined;
+    readonly expiresInSeconds?: number | undefined;
+    readonly notBeforeSeconds?: number | undefined;
+    readonly issuer?: string | undefined;
+    readonly audience?: string | readonly string[] | undefined;
+    readonly jwtId?: string | undefined;
+}
+export interface JwtVerifyOptions {
+    readonly allowedAlgorithms?: readonly JwtAlgorithm[] | undefined;
+    readonly issuer?: string | undefined;
+    readonly audience?: string | readonly string[] | undefined;
+    readonly clockToleranceSeconds?: number | undefined;
+}
+export interface ITokenRevocationStore {
+    isRevoked(tokenId: string): Promise<boolean>;
+    revoke(tokenId: string, expiresAt: number): Promise<void>;
+}
+export declare class JwtService {
+    private readonly secret;
+    private readonly defaultAlgorithm;
+    private readonly allowedAlgorithms;
+    private readonly revocationStore?;
+    constructor(secretOrOptions: string | {
+        secret: string;
+        defaultAlgorithm?: JwtAlgorithm | undefined;
+        allowedAlgorithms?: readonly JwtAlgorithm[] | undefined;
+        revocationStore?: ITokenRevocationStore | undefined;
+    }, additionalOptions?: {
+        defaultAlgorithm?: JwtAlgorithm | undefined;
+        allowedAlgorithms?: readonly JwtAlgorithm[] | undefined;
+        revocationStore?: ITokenRevocationStore | undefined;
+    });
+    sign(payload: Record<string, unknown>, options?: JwtSignOptions): string;
+    verify<T extends JwtPayload = JwtPayload>(token: string, options?: JwtVerifyOptions): Promise<T>;
+    private createSignature;
+}
+export declare class MemoryTokenRevocationStore implements ITokenRevocationStore {
+    private readonly revoked;
+    isRevoked(tokenId: string): Promise<boolean>;
+    revoke(tokenId: string, expiresAt: number): Promise<void>;
+    clear(): void;
+}
+//# sourceMappingURL=jwt.d.ts.map

package/dist/public/authentication/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../src/public/authentication/jwt.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAe;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAoC;gBAGnE,eAAe,EACX,MAAM,GACN;QACE,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAC5C,iBAAiB,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;QACxD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;KACrD,EACL,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;QAC5C,iBAAiB,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;QACxD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;KACrD;IAkBI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM;IAyCtE,MAAM,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EACnD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,CAAC,CAAC;IAoFb,OAAO,CAAC,eAAe;CAOxB;AAED,qBAAa,0BAA2B,YAAW,qBAAqB;IACtE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAExC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAY5C,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,KAAK,IAAI,IAAI;CAGrB"}

package/dist/public/authentication/jwt.js

@@ -0,0 +1,154 @@
+import * as crypto from 'node:crypto';
+import { Base64Url } from '../../internal/base64url.js';
+import { InvalidCredentialsError, TokenExpiredError } from '../errors.js';
+export class JwtService {
+    secret;
+    defaultAlgorithm;
+    allowedAlgorithms;
+    revocationStore;
+    constructor(secretOrOptions, additionalOptions) {
+        const options = typeof secretOrOptions === 'string'
+            ? { secret: secretOrOptions, ...additionalOptions }
+            : secretOrOptions;
+        if (!options?.secret || options.secret.length < 16) {
+            throw new Error('JWT secret must be at least 16 characters long for cryptographic safety.');
+        }
+        this.secret = options.secret;
+        this.defaultAlgorithm = options.defaultAlgorithm ?? 'HS256';
+        this.allowedAlgorithms = Object.freeze([
+            ...(options.allowedAlgorithms ?? ['HS256', 'HS384', 'HS512']),
+        ]);
+        this.revocationStore = options.revocationStore;
+    }
+    sign(payload, options = {}) {
+        const algorithm = options.algorithm ?? this.defaultAlgorithm;
+        if (!this.allowedAlgorithms.includes(algorithm)) {
+            throw new Error(`Algorithm "${algorithm}" is not in the allowed algorithms list.`);
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const fullPayload = {
+            ...payload,
+            iat: payload['iat'] ?? now,
+        };
+        if (options.expiresInSeconds !== undefined) {
+            fullPayload['exp'] = now + options.expiresInSeconds;
+        }
+        if (options.notBeforeSeconds !== undefined) {
+            fullPayload['nbf'] = now + options.notBeforeSeconds;
+        }
+        if (options.issuer !== undefined) {
+            fullPayload['iss'] = options.issuer;
+        }
+        if (options.audience !== undefined) {
+            fullPayload['aud'] = options.audience;
+        }
+        if (options.jwtId !== undefined) {
+            fullPayload['jti'] = options.jwtId;
+        }
+        const header = {
+            alg: algorithm,
+            typ: 'JWT',
+        };
+        const encodedHeader = Base64Url.encode(JSON.stringify(header));
+        const encodedPayload = Base64Url.encode(JSON.stringify(fullPayload));
+        const signingInput = `${encodedHeader}.${encodedPayload}`;
+        const signature = this.createSignature(signingInput, algorithm);
+        return `${signingInput}.${signature}`;
+    }
+    async verify(token, options = {}) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new InvalidCredentialsError('Malformed JWT format.');
+        }
+        const [encodedHeader, encodedPayload, signature] = parts;
+        // 1. Decode and validate header
+        let header;
+        try {
+            header = JSON.parse(Base64Url.decode(encodedHeader));
+        }
+        catch {
+            throw new InvalidCredentialsError('Invalid JWT header encoding.');
+        }
+        // Strict algorithm confusion defense
+        const allowed = options.allowedAlgorithms ?? this.allowedAlgorithms;
+        if (!header.alg || !allowed.includes(header.alg) || header.alg === 'none') {
+            throw new InvalidCredentialsError(`Disallowed JWT algorithm "${header.alg}".`);
+        }
+        // 2. Constant-time signature verification
+        const signingInput = `${encodedHeader}.${encodedPayload}`;
+        const expectedSignature = this.createSignature(signingInput, header.alg);
+        const sigBuf = Base64Url.decodeToBuffer(signature);
+        const expectedSigBuf = Base64Url.decodeToBuffer(expectedSignature);
+        if (sigBuf.length !== expectedSigBuf.length ||
+            !crypto.timingSafeEqual(sigBuf, expectedSigBuf)) {
+            throw new InvalidCredentialsError('Invalid JWT signature.');
+        }
+        // 3. Decode and validate payload claims
+        let payload;
+        try {
+            payload = JSON.parse(Base64Url.decode(encodedPayload));
+        }
+        catch {
+            throw new InvalidCredentialsError('Invalid JWT payload encoding.');
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const tolerance = options.clockToleranceSeconds ?? 0;
+        // Check expiration (exp)
+        if (typeof payload.exp === 'number' && now - tolerance >= payload.exp) {
+            throw new TokenExpiredError();
+        }
+        // Check not before (nbf)
+        if (typeof payload.nbf === 'number' && now + tolerance < payload.nbf) {
+            throw new InvalidCredentialsError('JWT token is not active yet.');
+        }
+        // Check issuer (iss)
+        if (options.issuer && payload.iss !== options.issuer) {
+            throw new InvalidCredentialsError(`JWT issuer mismatch: expected "${options.issuer}".`);
+        }
+        // Check audience (aud)
+        if (options.audience) {
+            const aud = payload.aud;
+            const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];
+            const actualAud = Array.isArray(aud) ? aud : [aud];
+            const match = actualAud.some((a) => expectedAud.includes(a));
+            if (!match) {
+                throw new InvalidCredentialsError('JWT audience mismatch.');
+            }
+        }
+        // Check revocation (jti)
+        if (this.revocationStore && payload.jti) {
+            const isRevoked = await this.revocationStore.isRevoked(payload.jti);
+            if (isRevoked) {
+                throw new InvalidCredentialsError('JWT token has been revoked.');
+            }
+        }
+        return payload;
+    }
+    createSignature(signingInput, algorithm) {
+        const hmacAlgorithm = algorithm === 'HS256' ? 'sha256' : algorithm === 'HS384' ? 'sha384' : 'sha512';
+        const hmac = crypto.createHmac(hmacAlgorithm, this.secret);
+        hmac.update(signingInput);
+        return Base64Url.encode(hmac.digest());
+    }
+}
+export class MemoryTokenRevocationStore {
+    revoked = new Map();
+    async isRevoked(tokenId) {
+        const expiresAt = this.revoked.get(tokenId);
+        if (!expiresAt) {
+            return false;
+        }
+        if (Date.now() / 1000 > expiresAt) {
+            this.revoked.delete(tokenId);
+            return false;
+        }
+        return true;
+    }
+    async revoke(tokenId, expiresAt) {
+        this.revoked.set(tokenId, expiresAt);
+    }
+    clear() {
+        this.revoked.clear();
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/public/authentication/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../src/public/authentication/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AA0C1E,MAAM,OAAO,UAAU;IACJ,MAAM,CAAS;IACf,gBAAgB,CAAe;IAC/B,iBAAiB,CAA0B;IAC3C,eAAe,CAAqC;IAErE,YACE,eAOK,EACL,iBAIC;QAED,MAAM,OAAO,GACX,OAAO,eAAe,KAAK,QAAQ;YACjC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,iBAAiB,EAAE;YACnD,CAAC,CAAC,eAAe,CAAC;QAEtB,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC;QAC5D,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IACjD,CAAC;IAEM,IAAI,CAAC,OAAgC,EAAE,UAA0B,EAAE;QACxE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,0CAA0C,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAA4B;YAC3C,GAAG,OAAO;YACV,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG;SAC3B,CAAC;QAEF,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3C,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC3C,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,WAAW,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,WAAW,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,WAAW,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAc;YACxB,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,KAAK;SACX,CAAC;QAEF,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;QAE1D,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QAChE,OAAO,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IACxC,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,KAAa,EACb,UAA4B,EAAE;QAE9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,GAAG,KAAiC,CAAC;QAErF,gCAAgC;QAChC,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,CAAc,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;QACpE,CAAC;QAED,qCAAqC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAK,MAAM,CAAC,GAAc,KAAK,MAAM,EAAE,CAAC;YACtF,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QACjF,CAAC;QAED,0CAA0C;QAC1C,MAAM,YAAY,GAAG,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAEzE,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAEnE,IACE,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;YACvC,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QAED,wCAAwC;QACxC,IAAI,OAAU,CAAC;QACf,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAM,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAErD,yBAAyB;QACzB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACtE,MAAM,IAAI,iBAAiB,EAAE,CAAC;QAChC,CAAC;QAED,yBAAyB;QACzB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACrE,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,CAAC,CAAC;QACpE,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACrD,MAAM,IAAI,uBAAuB,CAAC,kCAAkC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,uBAAuB;QACvB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5F,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAW,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,YAAoB,EAAE,SAAuB;QACnE,MAAM,aAAa,GACjB,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjF,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,0BAA0B;IACpB,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,KAAK,CAAC,SAAS,CAAC,OAAe;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,SAAiB;QACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}