@jskit-ai/auth-core 0.1.99 → 0.1.101

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-core",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "kind": "runtime",
   "dependsOn": [
     "@jskit-ai/value-app-config-shared"
@@ -21,6 +21,10 @@ export default Object.freeze({
           "entrypoint": "src/server/providers/AccessCoreServiceProvider.js",
           "export": "AccessCoreServiceProvider"
         },
+        {
+          "entrypoint": "src/server/providers/AuthActionsServiceProvider.js",
+          "export": "AuthActionsServiceProvider"
+        },
         {
           "entrypoint": "src/server/providers/FastifyAuthPolicyServiceProvider.js",
           "export": "FastifyAuthPolicyServiceProvider"
@@ -49,7 +53,7 @@ export default Object.freeze({
         },
         {
           "subpath": "./server",
-          "summary": "Exports server auth access and Fastify auth policy providers plus server auth utility modules."
+          "summary": "Exports server auth access, shared auth action, and Fastify auth policy providers plus server auth utility modules."
         },
         {
           "subpath": "./shared",
@@ -58,7 +62,8 @@ export default Object.freeze({
       ],
       "containerTokens": {
         "server": [
-          "auth.access"
+          "auth.access",
+          "auth.session.events.service"
         ],
         "client": [
           "auth.access.client"
@@ -69,7 +74,7 @@ export default Object.freeze({
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/kernel": "0.1.101",
+        "@jskit-ai/kernel": "0.1.103",
         "@fastify/cookie": "^11.0.2",
         "@fastify/csrf-protection": "^7.1.0",
         "@fastify/rate-limit": "^10.3.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-core",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -8,8 +8,13 @@
   "exports": {
     "./server/providers/AccessCoreServiceProvider": "./src/server/providers/AccessCoreServiceProvider.js",
     "./server/providers/FastifyAuthPolicyServiceProvider": "./src/server/providers/FastifyAuthPolicyServiceProvider.js",
+    "./server/providers/AuthActionsServiceProvider": "./src/server/providers/AuthActionsServiceProvider.js",
+    "./server/actions/auth.contributor": "./src/server/actions/auth.contributor.js",
+    "./server/services/authSessionEventsService": "./src/server/services/authSessionEventsService.js",
     "./server/authPolicyContextResolverRegistry": "./src/server/authPolicyContextResolverRegistry.js",
     "./server/authServiceDecoratorRegistry": "./src/server/authServiceDecoratorRegistry.js",
+    "./server/authActor": "./src/server/authActor.js",
+    "./server/unsupportedOperation": "./src/server/unsupportedOperation.js",
     "./server/utils": "./src/server/utils.js",
     "./server/validators": "./src/server/validators.js",
     "./server/inviteTokens": "./src/server/inviteTokens.js",
@@ -26,6 +31,8 @@
     "./shared/authDenied": "./src/shared/authDenied.js",
     "./shared/authPaths": "./src/shared/authPaths.js",
     "./shared/authConstraints": "./src/shared/authConstraints.js",
+    "./shared/authCapabilities": "./src/shared/authCapabilities.js",
+    "./shared/authSecurityStatus": "./src/shared/authSecurityStatus.js",
     "./shared/authMethods": "./src/shared/authMethods.js",
     "./shared/oauthProviders": "./src/shared/oauthProviders.js",
     "./shared/oauthCallbackParams": "./src/shared/oauthCallbackParams.js",
@@ -47,7 +54,7 @@
     "./shared/commands/authSessionReadCommand": "./src/shared/commands/authSessionReadCommand.js"
   },
   "dependencies": {
-    "@jskit-ai/kernel": "0.1.101",
+    "@jskit-ai/kernel": "0.1.103",
     "@fastify/cookie": "^11.0.2",
     "@fastify/csrf-protection": "^7.1.0",
     "@fastify/rate-limit": "^10.3.0",

package/src/server/actions/auth.contributor.js

@@ -0,0 +1,263 @@
+import { createSchema } from "json-rest-schema";
+import {
+  emptyInputValidator
+} from "@jskit-ai/kernel/shared/actions/actionContributorHelpers";
+import {
+  composeSchemaDefinitions
+} from "@jskit-ai/kernel/shared/validators";
+import { deepFreeze } from "@jskit-ai/kernel/shared/support/deepFreeze";
+import {
+  authRegisterCommand,
+  authRegisterConfirmationResendCommand,
+  authLoginPasswordCommand,
+  authLoginOtpRequestCommand,
+  authLoginOtpVerifyCommand,
+  authLoginOAuthStartCommand,
+  authLoginOAuthCompleteCommand,
+  authPasswordResetRequestCommand,
+  authPasswordRecoveryCompleteCommand,
+  authPasswordResetCommand
+} from "../../shared/commands/index.js";
+
+const authLoginOAuthStartInput = composeSchemaDefinitions([
+  authLoginOAuthStartCommand.operation.params,
+  authLoginOAuthStartCommand.operation.query
+], {
+  mode: "patch",
+  context: "authContributor.authLoginOAuthStartInput"
+});
+
+const authLogoutOutput = deepFreeze({
+  schema: createSchema({
+    ok: { type: "boolean", required: true },
+    clearSession: { type: "boolean", required: true }
+  }),
+  mode: "replace"
+});
+
+function requireRequestContext(context, actionId) {
+  const request = context?.requestMeta?.request || null;
+  if (request) {
+    return request;
+  }
+
+  throw new Error(`${actionId} requires request context.`);
+}
+
+const baseAuthActions = Object.freeze([
+  {
+    id: "auth.register",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authRegisterCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.register"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.register(input);
+    }
+  },
+  {
+    id: "auth.register.confirmation.resend",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authRegisterConfirmationResendCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.register.confirmation.resend"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.resendRegisterConfirmation(input);
+    }
+  },
+  {
+    id: "auth.login.password",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authLoginPasswordCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.login.password"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.login(input);
+    }
+  },
+  {
+    id: "auth.login.otp.request",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authLoginOtpRequestCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.login.otp.request"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.requestOtpLogin(input);
+    }
+  },
+  {
+    id: "auth.login.otp.verify",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authLoginOtpVerifyCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.login.otp.verify"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.verifyOtpLogin(input);
+    }
+  },
+  {
+    id: "auth.login.oauth.start",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authLoginOAuthStartInput,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.login.oauth.start"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.oauthStart(input);
+    }
+  },
+  {
+    id: "auth.login.oauth.complete",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authLoginOAuthCompleteCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.login.oauth.complete"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.oauthComplete(input);
+    }
+  },
+  {
+    id: "auth.password.reset.request",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authPasswordResetRequestCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.password.reset.request"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.requestPasswordReset(input);
+    }
+  },
+  {
+    id: "auth.password.recovery.complete",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authPasswordRecoveryCompleteCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.password.recovery.complete"
+    },
+    observability: {},
+    async execute(input, _context, deps) {
+      return deps.authService.completePasswordRecovery(input);
+    }
+  },
+  {
+    id: "auth.password.reset",
+    version: 1,
+    kind: "command",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: authPasswordResetCommand.operation.body,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.password.reset"
+    },
+    observability: {},
+    async execute(input, context, deps) {
+      return deps.authService.resetPassword(requireRequestContext(context, "auth.password.reset"), input);
+    }
+  },
+  {
+    id: "auth.logout",
+    version: 1,
+    kind: "command",
+    channels: ["api", "automation", "internal"],
+    surfacesFrom: "enabled",
+    input: emptyInputValidator,
+    output: authLogoutOutput,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.logout"
+    },
+    observability: {},
+    async execute(_input, context, deps) {
+      let logoutResult = {
+        ok: true,
+        clearSession: true
+      };
+      if (deps.authService && typeof deps.authService.logout === "function") {
+        logoutResult = await deps.authService.logout(requireRequestContext(context, "auth.logout"));
+      }
+
+      if (deps.authSessionEventsService && typeof deps.authSessionEventsService.notifySessionChanged === "function") {
+        await deps.authSessionEventsService.notifySessionChanged({
+          context
+        });
+      }
+      return {
+        ok: logoutResult?.ok !== false,
+        clearSession: logoutResult?.clearSession !== false
+      };
+    }
+  },
+  {
+    id: "auth.session.read",
+    version: 1,
+    kind: "query",
+    channels: ["api", "internal"],
+    surfacesFrom: "enabled",
+    input: emptyInputValidator,
+    idempotency: "none",
+    audit: {
+      actionName: "auth.session.read"
+    },
+    observability: {},
+    async execute(_input, context, deps) {
+      return deps.authService.authenticateRequest(requireRequestContext(context, "auth.session.read"));
+    }
+  }
+]);
+
+function buildAuthActions() {
+  return baseAuthActions;
+}
+
+export { baseAuthActions, buildAuthActions, requireRequestContext };

package/src/server/authActor.js

@@ -0,0 +1,96 @@
+import { normalizeOpaqueId } from "@jskit-ai/kernel/shared/support/normalize";
+import { normalizeAuthProviderId } from "../shared/authCapabilities.js";
+import { normalizeEmail } from "./utils.js";
+
+function normalizeDisplayName(value, email = "") {
+  const displayName = String(value || "").trim();
+  if (displayName) {
+    return displayName;
+  }
+  const localPart = String(email || "").split("@")[0]?.trim();
+  return localPart || "User";
+}
+
+function normalizeProviderUserId(value) {
+  return String(value || "").trim();
+}
+
+function createAuthIdentityId(provider, providerUserId) {
+  if (!provider || !providerUserId) {
+    return "";
+  }
+  return `${provider}:${providerUserId}`;
+}
+
+function normalizeAuthActor(value = {}, options = {}) {
+  const source = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const provider = normalizeAuthProviderId(source.provider || source.authProvider || options.provider, {
+    fallback: normalizeAuthProviderId(options.provider, { fallback: "unknown" })
+  });
+  const providerUserId = normalizeProviderUserId(
+    source.providerUserId ||
+      source.authProviderUserSid ||
+      source.sub ||
+      source.userId ||
+      source.id
+  );
+  const email = normalizeEmail(source.email || "");
+  const displayName = normalizeDisplayName(source.displayName || source.username || source.name, email);
+  const appUserId = normalizeOpaqueId(source.appUserId || source.profileId || source.userProfileId, {
+    fallback: null
+  });
+  const authIdentityId = String(source.authIdentityId || createAuthIdentityId(provider, providerUserId)).trim();
+
+  if (!providerUserId || !email) {
+    return null;
+  }
+
+  return Object.freeze({
+    authIdentityId,
+    provider,
+    providerUserId,
+    email,
+    displayName,
+    appUserId,
+    profileSource: String(source.profileSource || options.profileSource || "auth-provider").trim() || "auth-provider"
+  });
+}
+
+function buildLegacyProfileFromActor(actorLike) {
+  const actor = normalizeAuthActor(actorLike);
+  if (!actor) {
+    return null;
+  }
+  const id = actor.appUserId || actor.providerUserId || actor.authIdentityId;
+  return Object.freeze({
+    id,
+    email: actor.email,
+    displayName: actor.displayName,
+    authProvider: actor.provider,
+    authProviderUserSid: actor.providerUserId
+  });
+}
+
+function normalizeAuthResult(value = {}, options = {}) {
+  const source = value && typeof value === "object" && !Array.isArray(value) ? value : {};
+  const actor = normalizeAuthActor(source.actor, options) || normalizeAuthActor(source.profile, {
+    ...options,
+    profileSource: "users"
+  });
+  const profile = source.profile && typeof source.profile === "object"
+    ? source.profile
+    : buildLegacyProfileFromActor(actor);
+
+  return Object.freeze({
+    ...source,
+    ...(actor ? { actor } : {}),
+    ...(profile ? { profile } : {})
+  });
+}
+
+export {
+  createAuthIdentityId,
+  normalizeAuthActor,
+  buildLegacyProfileFromActor,
+  normalizeAuthResult
+};

package/src/server/lib/index.js

@@ -1,2 +1,14 @@
 export { authPolicyPlugin } from "./plugin.js";
 export { withAuthPolicy, mergeAuthPolicy } from "./routeMeta.js";
+export {
+  createAuthIdentityId,
+  normalizeAuthActor,
+  buildLegacyProfileFromActor,
+  normalizeAuthResult
+} from "../authActor.js";
+export {
+  AUTH_OPERATION_UNSUPPORTED_CODE,
+  createUnsupportedAuthOperationError,
+  throwUnsupportedAuthOperation,
+  isUnsupportedAuthOperationError
+} from "../unsupportedOperation.js";

package/src/server/providers/AuthActionsServiceProvider.js

@@ -0,0 +1,67 @@
+import { withActionDefaults } from "@jskit-ai/kernel/shared/actions";
+import { buildAuthActions } from "../actions/auth.contributor.js";
+import { createAuthSessionEventsService } from "../services/authSessionEventsService.js";
+
+class AuthActionsServiceProvider {
+  static id = "auth.actions";
+
+  static dependsOn = ["runtime.actions"];
+
+  register(app) {
+    if (
+      !app ||
+      typeof app.actions !== "function" ||
+      typeof app.has !== "function" ||
+      typeof app.service !== "function"
+    ) {
+      throw new Error("AuthActionsServiceProvider requires application actions()/has()/service().");
+    }
+
+    if (!app.has("auth.session.events.service")) {
+      app.service(
+        "auth.session.events.service",
+        () => createAuthSessionEventsService(),
+        {
+          events: {
+            notifySessionChanged: [
+              {
+                type: "entity.changed",
+                source: "auth",
+                entity: "session",
+                operation: "updated",
+                entityId: ({ result }) => result?.id,
+                realtime: {
+                  event: "auth.session.changed",
+                  audience: "actor_user"
+                }
+              },
+              {
+                type: "entity.changed",
+                source: "users",
+                entity: "bootstrap",
+                operation: "updated",
+                entityId: ({ result }) => result?.id,
+                realtime: {
+                  event: "users.bootstrap.changed",
+                  audience: "actor_user"
+                }
+              }
+            ]
+          }
+        }
+      );
+    }
+
+    app.actions(
+      withActionDefaults(buildAuthActions(), {
+        domain: "auth",
+        dependencies: {
+          authService: "authService",
+          authSessionEventsService: "auth.session.events.service"
+        }
+      })
+    );
+  }
+}
+
+export { AuthActionsServiceProvider };

package/src/server/providers/FastifyAuthPolicyServiceProvider.js

@@ -38,8 +38,6 @@ function defaultHasPermission({ permission, permissions = [] } = {}) {
 class FastifyAuthPolicyServiceProvider {
   static id = "auth.policy.fastify";
 
-  static dependsOn = ["auth.provider"];
-
   register(app) {
     if (!app || typeof app.has !== "function") {
       throw new Error("FastifyAuthPolicyServiceProvider requires application has().");
@@ -70,15 +68,18 @@ class FastifyAuthPolicyServiceProvider {
     if (!app || typeof app.make !== "function" || typeof app.has !== "function") {
       throw new Error("FastifyAuthPolicyServiceProvider requires application make()/has().");
     }
-    if (!app.has("authService")) {
-      throw new Error("FastifyAuthPolicyServiceProvider requires authService binding.");
-    }
-
     const env = app.has("jskit.env") ? app.make("jskit.env") : {};
     const fastify = app.make("jskit.fastify");
 
     const pluginDeps = {
       resolveActor: async (request) => {
+        if (!app.has("authService")) {
+          return {
+            authenticated: false,
+            actor: null,
+            transientFailure: false
+          };
+        }
         const authService = app.make("authService");
         if (authService && typeof authService.authenticateRequest === "function") {
           return authService.authenticateRequest(request);

package/src/server/services/authSessionEventsService.js

@@ -0,0 +1,30 @@
+import { normalizeOpaqueId } from "@jskit-ai/kernel/shared/support/normalize";
+
+function resolveActorId(context = {}) {
+  return normalizeOpaqueId(
+    context?.actor?.id ||
+      context?.actor?.appUserId ||
+      context?.actor?.providerUserId ||
+      context?.profile?.id,
+    { fallback: null }
+  );
+}
+
+function createAuthSessionEventsService() {
+  async function notifySessionChanged(options = {}) {
+    const actorId = resolveActorId(options?.context || {});
+    if (!actorId) {
+      return null;
+    }
+
+    return {
+      id: actorId
+    };
+  }
+
+  return Object.freeze({
+    notifySessionChanged
+  });
+}
+
+export { createAuthSessionEventsService };

package/src/server/unsupportedOperation.js

@@ -0,0 +1,28 @@
+import { AppError } from "@jskit-ai/kernel/server/runtime/errors";
+
+const AUTH_OPERATION_UNSUPPORTED_CODE = "AUTH_OPERATION_UNSUPPORTED";
+
+function createUnsupportedAuthOperationError(operation, message = "") {
+  const operationName = String(operation || "auth operation").trim() || "auth operation";
+  return new AppError(501, message || `Auth operation "${operationName}" is not supported by the active provider.`, {
+    code: AUTH_OPERATION_UNSUPPORTED_CODE,
+    details: {
+      operation: operationName
+    }
+  });
+}
+
+function throwUnsupportedAuthOperation(operation, message = "") {
+  throw createUnsupportedAuthOperationError(operation, message);
+}
+
+function isUnsupportedAuthOperationError(error) {
+  return String(error?.code || "") === AUTH_OPERATION_UNSUPPORTED_CODE;
+}
+
+export {
+  AUTH_OPERATION_UNSUPPORTED_CODE,
+  createUnsupportedAuthOperationError,
+  throwUnsupportedAuthOperation,
+  isUnsupportedAuthOperationError
+};