@juspay/neurolink 9.31.1 → 9.32.0

package/dist/client/auth/providers/supabase.js

@@ -0,0 +1,259 @@
+// src/lib/auth/providers/supabase.ts
+import { BaseAuthProvider } from "./BaseAuthProvider.js";
+import { AuthError } from "../errors.js";
+import { logger } from "../../utils/logger.js";
+import { createProxyFetch } from "../../proxy/proxyFetch.js";
+import * as jose from "jose";
+/**
+ * Supabase Authentication Provider
+ *
+ * Supports Supabase JWT validation and user management.
+ * Can validate tokens locally with JWT secret or via Supabase API.
+ *
+ * Features:
+ * - Local JWT validation with JWT secret
+ * - API-based token validation
+ * - User profile fetching (requires service role key)
+ * - Role extraction from app_metadata
+ *
+ * @example
+ * ```typescript
+ * const supabase = new SupabaseAuthProvider({
+ *   type: "supabase",
+ *   url: "https://your-project.supabase.co",
+ *   anonKey: "your-anon-key",
+ *   jwtSecret: "your-jwt-secret" // Optional for local validation
+ * });
+ *
+ * const result = await supabase.authenticateToken(accessToken);
+ * if (result.valid) {
+ *   console.log("Authenticated user:", result.user);
+ * }
+ * ```
+ */
+export class SupabaseAuthProvider extends BaseAuthProvider {
+    type = "supabase";
+    supabaseUrl;
+    anonKey;
+    serviceRoleKey;
+    jwtSecret;
+    constructor(config) {
+        super(config);
+        if (!config.url) {
+            throw AuthError.create("CONFIGURATION_ERROR", "Supabase URL is required", { details: { missingFields: ["url"] } });
+        }
+        if (!config.anonKey) {
+            throw AuthError.create("CONFIGURATION_ERROR", "Supabase anon key is required", { details: { missingFields: ["anonKey"] } });
+        }
+        this.supabaseUrl = config.url.replace(/\/$/, ""); // Remove trailing slash
+        this.anonKey = config.anonKey;
+        this.serviceRoleKey = config.serviceRoleKey;
+        this.jwtSecret = config.jwtSecret;
+    }
+    /**
+     * Validate Supabase JWT
+     */
+    async authenticateToken(token, _context) {
+        try {
+            // If JWT secret is provided, verify locally
+            if (this.jwtSecret) {
+                const secret = new TextEncoder().encode(this.jwtSecret);
+                const { payload } = await jose.jwtVerify(token, secret);
+                // Reject tokens without a sub claim (anon/service_role JWTs)
+                if (!payload.sub) {
+                    return {
+                        valid: false,
+                        error: "Token missing sub claim: cannot authenticate without a user identity",
+                    };
+                }
+                // Only accept tokens with "authenticated" role
+                const role = payload.role;
+                if (role && role !== "authenticated") {
+                    return {
+                        valid: false,
+                        error: `Invalid token role: ${role}. Only "authenticated" role is accepted`,
+                    };
+                }
+                const user = this.payloadToUser(payload);
+                return {
+                    valid: true,
+                    payload: payload,
+                    user,
+                    expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+                    tokenType: "jwt",
+                };
+            }
+            // Otherwise, validate via Supabase API
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/user`, {
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    apikey: this.anonKey,
+                },
+            });
+            if (!response.ok) {
+                return {
+                    valid: false,
+                    error: `Token validation failed: HTTP ${response.status}`,
+                };
+            }
+            const userData = (await response.json());
+            const user = this.supabaseUserToAuthUser(userData);
+            return {
+                valid: true,
+                payload: userData,
+                user,
+                tokenType: "jwt",
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Convert JWT payload to AuthUser
+     */
+    payloadToUser(payload) {
+        const appMetadata = payload.app_metadata;
+        const userMetadata = payload.user_metadata;
+        // Use payload.role (Supabase standard claim) for the roles array
+        const role = payload.role;
+        return {
+            id: payload.sub,
+            email: payload.email,
+            name: userMetadata?.full_name || userMetadata?.name,
+            picture: userMetadata?.avatar_url,
+            emailVerified: payload.email_confirmed || false,
+            roles: role ? [role] : appMetadata?.roles || [],
+            permissions: appMetadata?.permissions || [],
+            metadata: userMetadata,
+        };
+    }
+    /**
+     * Convert Supabase user to AuthUser
+     */
+    supabaseUserToAuthUser(userData) {
+        const appMetadata = userData.app_metadata;
+        const userMetadata = userData.user_metadata;
+        return {
+            id: userData.id,
+            email: userData.email,
+            name: userMetadata?.full_name || userMetadata?.name,
+            picture: userMetadata?.avatar_url,
+            emailVerified: !!userData.email_confirmed_at,
+            roles: appMetadata?.roles || [],
+            permissions: appMetadata?.permissions || [],
+            createdAt: userData.created_at
+                ? new Date(userData.created_at)
+                : undefined,
+            lastLoginAt: userData.last_sign_in_at
+                ? new Date(userData.last_sign_in_at)
+                : undefined,
+            metadata: userMetadata,
+        };
+    }
+    /**
+     * Get user by ID via Supabase Admin API
+     * Requires service role key
+     */
+    async getUser(userId) {
+        if (!this.serviceRoleKey) {
+            logger.warn("Service role key required for user lookup");
+            return null;
+        }
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/admin/users/${userId}`, {
+                headers: {
+                    Authorization: `Bearer ${this.serviceRoleKey}`,
+                    apikey: this.anonKey,
+                },
+            });
+            if (!response.ok) {
+                if (response.status === 404) {
+                    return null;
+                }
+                throw AuthError.create("PROVIDER_ERROR", `Supabase API returned ${response.status}`, { details: { statusCode: response.status } });
+            }
+            const userData = (await response.json());
+            return this.supabaseUserToAuthUser(userData);
+        }
+        catch (error) {
+            logger.error("Failed to fetch Supabase user:", error);
+            if (error &&
+                typeof error === "object" &&
+                "code" in error &&
+                typeof error.code === "string") {
+                throw error;
+            }
+            return null;
+        }
+    }
+    /**
+     * Get user by email via Supabase Admin API
+     * Requires service role key
+     */
+    async getUserByEmail(email) {
+        if (!this.serviceRoleKey) {
+            logger.warn("Service role key required for user lookup by email");
+            return null;
+        }
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/admin/users?email=${encodeURIComponent(email)}`, {
+                headers: {
+                    Authorization: `Bearer ${this.serviceRoleKey}`,
+                    apikey: this.anonKey,
+                },
+            });
+            if (!response.ok) {
+                throw AuthError.create("PROVIDER_ERROR", `Supabase API returned ${response.status}`, { details: { statusCode: response.status } });
+            }
+            const result = (await response.json());
+            const users = result.users || [];
+            if (users.length === 0) {
+                return null;
+            }
+            return this.supabaseUserToAuthUser(users[0]);
+        }
+        catch (error) {
+            logger.error("Failed to fetch Supabase user by email:", error);
+            if (error &&
+                typeof error === "object" &&
+                "code" in error &&
+                typeof error.code === "string") {
+                throw error;
+            }
+            return null;
+        }
+    }
+    /**
+     * Health check
+     */
+    async healthCheck() {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/health`, {
+                headers: {
+                    apikey: this.anonKey,
+                },
+            });
+            return {
+                healthy: response.ok,
+                providerConnected: response.ok,
+                sessionStorageHealthy: true,
+            };
+        }
+        catch (error) {
+            return {
+                healthy: false,
+                providerConnected: false,
+                sessionStorageHealthy: true,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+}

package/dist/client/auth/providers/workos.js

@@ -0,0 +1,284 @@
+// src/lib/auth/providers/workos.ts
+import { logger } from "../../utils/logger.js";
+import { createProxyFetch } from "../../proxy/proxyFetch.js";
+import { AuthError } from "../errors.js";
+import * as jose from "jose";
+import { BaseAuthProvider } from "./BaseAuthProvider.js";
+/**
+ * WorkOS Authentication Provider
+ *
+ * Supports WorkOS for enterprise SSO and user management.
+ * Validates JWTs issued by WorkOS and fetches user information.
+ *
+ * Features:
+ * - JWT validation using WorkOS JWKS
+ * - SSO token validation
+ * - Enterprise directory integration
+ * - Organization support for multi-tenant apps
+ * - Session management (inherited from BaseAuthProvider)
+ *
+ * @example
+ * ```typescript
+ * const workos = new WorkOSProvider({
+ *   type: "workos",
+ *   apiKey: "sk_...",
+ *   clientId: "client_..."
+ * });
+ *
+ * const result = await workos.authenticateToken(accessToken);
+ * if (result.valid) {
+ *   console.log("Authenticated user:", result.user);
+ * }
+ * ```
+ */
+export class WorkOSProvider extends BaseAuthProvider {
+    type = "workos";
+    apiKey;
+    clientId;
+    organizationId;
+    jwks = null;
+    constructor(config) {
+        super(config);
+        if (!config.apiKey) {
+            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS API key is required", { details: { provider: "workos", missingFields: ["apiKey"] } });
+        }
+        if (!config.clientId) {
+            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS client ID is required", { details: { provider: "workos", missingFields: ["clientId"] } });
+        }
+        this.apiKey = config.apiKey;
+        this.clientId = config.clientId;
+        this.organizationId = config.organizationId;
+    }
+    /**
+     * Initialize JWKS for WorkOS token verification
+     */
+    async initialize() {
+        const jwksUrl = new URL("https://api.workos.com/sso/jwks");
+        this.jwks = jose.createRemoteJWKSet(jwksUrl);
+        logger.debug("WorkOS provider initialized");
+    }
+    /**
+     * Validate WorkOS access token
+     */
+    async authenticateToken(token, _context) {
+        if (!this.jwks) {
+            await this.initialize();
+        }
+        try {
+            // Verify the JWT
+            const { payload } = await jose.jwtVerify(token, this.jwks, {
+                audience: this.clientId,
+            });
+            // Enforce organizationId if configured
+            if (this.organizationId &&
+                payload.org_id !== this.organizationId) {
+                return {
+                    valid: false,
+                    error: `Organization mismatch: expected ${this.organizationId}, got ${payload.org_id}`,
+                };
+            }
+            const user = {
+                id: payload.sub,
+                email: payload.email,
+                name: payload.first_name && payload.last_name
+                    ? `${payload.first_name} ${payload.last_name}`.trim()
+                    : undefined,
+                emailVerified: true, // WorkOS verifies emails via SSO
+                roles: payload.roles || [],
+                permissions: payload.permissions || [],
+                organizationId: payload.org_id,
+                metadata: {
+                    connection_id: payload.connection_id,
+                    connection_type: payload.connection_type,
+                    idp_id: payload.idp_id,
+                },
+            };
+            return {
+                valid: true,
+                payload: payload,
+                user,
+                expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+                tokenType: "jwt",
+            };
+        }
+        catch {
+            // If JWT validation fails, try session validation via API
+            return this.validateSessionViaAPI(token);
+        }
+    }
+    /**
+     * Validate session via WorkOS API
+     */
+    async validateSessionViaAPI(token) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch("https://api.workos.com/user_management/authenticate", {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    session_token: token,
+                    client_id: this.clientId,
+                }),
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!response.ok) {
+                return {
+                    valid: false,
+                    error: `Session validation failed: HTTP ${response.status}`,
+                };
+            }
+            const data = (await response.json());
+            if (!data.user) {
+                return {
+                    valid: false,
+                    error: "User not found in session",
+                };
+            }
+            // Enforce organizationId if configured
+            if (this.organizationId && data.organization_id !== this.organizationId) {
+                return {
+                    valid: false,
+                    error: `Organization mismatch: expected ${this.organizationId}, got ${data.organization_id}`,
+                };
+            }
+            const user = {
+                id: data.user.id,
+                email: data.user.email,
+                name: data.user.first_name && data.user.last_name
+                    ? `${data.user.first_name} ${data.user.last_name}`.trim()
+                    : undefined,
+                picture: data.user.profile_picture_url,
+                emailVerified: data.user.email_verified,
+                roles: [],
+                permissions: [],
+                organizationId: data.organization_id,
+                createdAt: data.user.created_at
+                    ? new Date(data.user.created_at)
+                    : undefined,
+                metadata: data.user,
+            };
+            return {
+                valid: true,
+                payload: data,
+                user,
+                tokenType: "session",
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Get user by ID via WorkOS API
+     */
+    async getUser(userId) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`https://api.workos.com/user_management/users/${userId}`, {
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                },
+            });
+            if (!response.ok) {
+                if (response.status === 404) {
+                    return null;
+                }
+                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
+            }
+            const data = (await response.json());
+            return {
+                id: data.id,
+                email: data.email,
+                name: data.first_name && data.last_name
+                    ? `${data.first_name} ${data.last_name}`.trim()
+                    : undefined,
+                picture: data.profile_picture_url,
+                emailVerified: data.email_verified,
+                roles: [],
+                permissions: [],
+                createdAt: data.created_at
+                    ? new Date(data.created_at)
+                    : undefined,
+                metadata: data,
+            };
+        }
+        catch (error) {
+            logger.error("Failed to fetch WorkOS user:", error instanceof Error ? error.message : String(error));
+            // Always rethrow -- transport errors should not be silenced as null
+            throw error;
+        }
+    }
+    /**
+     * Get user by email via WorkOS API
+     */
+    async getUserByEmail(email) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`https://api.workos.com/user_management/users?email=${encodeURIComponent(email)}`, {
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                },
+            });
+            if (!response.ok) {
+                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
+            }
+            const result = (await response.json());
+            const users = result.data || [];
+            if (users.length === 0) {
+                return null;
+            }
+            const data = users[0];
+            return {
+                id: data.id,
+                email: data.email,
+                name: data.first_name && data.last_name
+                    ? `${data.first_name} ${data.last_name}`.trim()
+                    : undefined,
+                picture: data.profile_picture_url,
+                emailVerified: data.email_verified,
+                roles: [],
+                permissions: [],
+                createdAt: data.created_at
+                    ? new Date(data.created_at)
+                    : undefined,
+                metadata: data,
+            };
+        }
+        catch (error) {
+            logger.error("Failed to fetch WorkOS user by email:", error instanceof Error ? error.message : String(error));
+            // Rethrow AuthErrors, silence unknown transport errors
+            if (error instanceof Error && error.name === "AuthError") {
+                throw error;
+            }
+            return null;
+        }
+    }
+    /**
+     * Health check
+     */
+    async healthCheck() {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch("https://api.workos.com/sso/jwks");
+            return {
+                healthy: response.ok,
+                providerConnected: response.ok,
+                sessionStorageHealthy: true,
+            };
+        }
+        catch (error) {
+            return {
+                healthy: false,
+                providerConnected: false,
+                sessionStorageHealthy: true,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+}

package/dist/client/auth/serverBridge.js

@@ -0,0 +1,25 @@
+/**
+ * Bridge between auth providers and NeuroLink's server middleware.
+ * Converts an auth provider's authenticateToken() into the validate
+ * callback expected by the existing createAuthMiddleware.
+ */
+/**
+ * Create a validate function for server auth middleware from an auth provider.
+ */
+export function createAuthValidatorFromProvider(provider) {
+    return async (token, ctx) => {
+        const result = await provider.authenticateToken(token, ctx);
+        if (!result.valid) {
+            return null;
+        }
+        if (result.user) {
+            return {
+                id: result.user.id,
+                email: result.user.email,
+                roles: result.user.roles,
+            };
+        }
+        // Fail closed: valid token without a resolved user is treated as failure
+        return null;
+    };
+}