@juspay/neurolink 9.31.2 → 9.32.0

package/dist/auth/index.js

@@ -1,13 +1,14 @@
 /**
  * NeuroLink Authentication Module
  *
- * Provides OAuth 2.0 authentication support for Claude Pro/Max subscriptions
- * and secure token storage.
- *
- * Key components:
- * - AnthropicOAuth: OAuth 2.0 flow implementation with PKCE support
- * - TokenStore: Secure local storage for OAuth tokens
- * - Callback Server: Local HTTP server for OAuth redirects
+ * Exports the full multi-provider authentication system including:
+ * - Anthropic OAuth 2.0 flow (PKCE, token storage, callback server)
+ * - Multi-provider auth (Auth0, Clerk, Firebase, Supabase, Cognito,
+ *   Keycloak, Better Auth, WorkOS, JWT, OAuth2, Custom)
+ * - AuthProviderFactory / AuthProviderRegistry for lazy-loaded provider creation
+ * - Auth middleware (token extraction, RBAC, rate limiting)
+ * - Session management (memory, Redis)
+ * - Auth context (AsyncLocalStorage-based request scoping)
  */
 // =============================================================================
 // ANTHROPIC OAUTH - OAuth 2.0 Authentication
@@ -31,3 +32,30 @@ export { TokenStoreError } from "../types/errors.js";
 // ACCOUNT POOL - Multi-account rotation with cooldowns
 // =============================================================================
 export { AccountPool } from "./accountPool.js";
+// =============================================================================
+// MULTI-PROVIDER AUTH SYSTEM
+// =============================================================================
+// Factory and Registry
+export { AuthProviderFactory, createAuthProvider, } from "./AuthProviderFactory.js";
+export { AuthProviderRegistry } from "./AuthProviderRegistry.js";
+// Unified error factory
+export { AuthError, AuthErrorCodes } from "./errors.js";
+// Base Provider
+export { AuthProviderError, BaseAuthProvider, InMemorySessionStorage, } from "./providers/BaseAuthProvider.js";
+// Provider Implementations
+// NOTE: Concrete provider classes are NOT re-exported here to preserve lazy
+// loading via dynamic imports in AuthProviderFactory.  Obtain provider
+// instances through the factory instead:
+//   const provider = await AuthProviderFactory.create("auth0", config);
+// Auth Middleware
+export { AuthMiddlewareError, AuthMiddlewareErrorCodes, createAuthMiddleware, createExpressAuthMiddleware, createProtectedMiddleware, createRBACMiddleware, createRequestContext, extractToken, } from "./middleware/AuthMiddleware.js";
+// Rate Limiting Middleware
+export { createAuthenticatedRateLimitMiddleware, createRateLimitByUserMiddleware, createRateLimitStorage, MemoryRateLimitStorage, RedisRateLimitStorage, UserRateLimiter, } from "./middleware/rateLimitByUser.js";
+// Session Management
+export { createSessionStorage, MemorySessionStorage, RedisSessionStorage, SessionManager, } from "./sessionManager.js";
+// Auth Context
+export { AuthContextHolder, createAuthenticatedContext, getAuthContext, getCurrentSession, getCurrentUser, globalAuthContext, hasAllPermissions, hasAnyRole, hasPermission, hasRole, isAuthenticated, requireAuth, requirePermission, requireRole, requireUser, runWithAuthContext, } from "./authContext.js";
+// Request Context
+export { RequestContext, NEUROLINK_RESOURCE_ID_KEY, NEUROLINK_THREAD_ID_KEY, } from "./RequestContext.js";
+// Server Bridge
+export { createAuthValidatorFromProvider } from "./serverBridge.js";

package/dist/auth/middleware/AuthMiddleware.d.ts

@@ -0,0 +1,181 @@
+/**
+ * AuthMiddleware - Authentication and authorization middleware
+ *
+ * Provides middleware factories for:
+ * - Token extraction and validation
+ * - User context propagation
+ * - RBAC enforcement
+ * - Public route handling
+ */
+import type { AuthenticatedContext, AuthMiddlewareConfig, AuthRequestContext, AuthUser, RBACMiddlewareConfig, TokenExtractionConfig } from "../../types/authTypes.js";
+/**
+ * Auth middleware error codes
+ */
+export declare const AuthMiddlewareErrorCodes: {
+    readonly MISSING_TOKEN: "AUTH_MIDDLEWARE-001";
+    readonly INVALID_TOKEN: "AUTH_MIDDLEWARE-002";
+    readonly UNAUTHORIZED: "AUTH_MIDDLEWARE-003";
+    readonly FORBIDDEN: "AUTH_MIDDLEWARE-004";
+    readonly PROVIDER_ERROR: "AUTH_MIDDLEWARE-005";
+    readonly CONFIGURATION_ERROR: "AUTH_MIDDLEWARE-006";
+};
+/**
+ * Auth middleware error factory
+ */
+export declare const AuthMiddlewareError: {
+    codes: {
+        readonly MISSING_TOKEN: "AUTH_MIDDLEWARE-001";
+        readonly INVALID_TOKEN: "AUTH_MIDDLEWARE-002";
+        readonly UNAUTHORIZED: "AUTH_MIDDLEWARE-003";
+        readonly FORBIDDEN: "AUTH_MIDDLEWARE-004";
+        readonly PROVIDER_ERROR: "AUTH_MIDDLEWARE-005";
+        readonly CONFIGURATION_ERROR: "AUTH_MIDDLEWARE-006";
+    };
+    create: (code: "INVALID_TOKEN" | "MISSING_TOKEN" | "PROVIDER_ERROR" | "CONFIGURATION_ERROR" | "FORBIDDEN" | "UNAUTHORIZED", message: string, options?: {
+        retryable?: boolean;
+        details?: Record<string, unknown>;
+        cause?: Error;
+    } | undefined) => import("../../core/infrastructure/baseError.js").NeuroLinkFeatureError;
+};
+/**
+ * Minimal request object accepted by {@link createRequestContext}.
+ *
+ * Avoids `any` for Express/Koa/Hono request objects while remaining
+ * compatible with any framework that exposes these standard fields.
+ */
+export type IncomingRequest = {
+    method?: string;
+    url?: string;
+    path?: string;
+    headers?: Record<string, string | string[] | undefined>;
+    cookies?: Record<string, string>;
+    query?: Record<string, string | string[] | undefined>;
+    body?: unknown;
+    ip?: string;
+    /** Populated by auth middleware after successful authentication */
+    user?: AuthUser;
+    /** Populated by auth middleware after successful authentication */
+    authContext?: AuthenticatedContext;
+};
+/**
+ * Minimal response object for Express-style middleware.
+ */
+export type OutgoingResponse = {
+    status(code: number): OutgoingResponse;
+    json(body: unknown): void;
+};
+/**
+ * Middleware handler function type
+ */
+export type MiddlewareHandler<TContext = AuthRequestContext> = (context: TContext) => Promise<MiddlewareResult>;
+/**
+ * Middleware result
+ */
+export type MiddlewareResult = {
+    /** Whether to proceed to next handler */
+    proceed: boolean;
+    /** Updated context (if authenticated) */
+    context?: AuthenticatedContext;
+    /** Error response if not proceeding */
+    error?: {
+        statusCode: number;
+        message: string;
+        code?: string;
+    };
+};
+/**
+ * Next function for middleware chaining
+ */
+export type NextFunction = () => Promise<void>;
+/**
+ * Express-style middleware function
+ */
+export type ExpressMiddleware = (req: IncomingRequest, res: OutgoingResponse, next: NextFunction) => Promise<void>;
+/**
+ * Extract token from request context based on configuration
+ */
+export declare function extractToken(context: AuthRequestContext, config?: TokenExtractionConfig): Promise<string | null>;
+/**
+ * Create authentication middleware
+ *
+ * Validates tokens and attaches user context to requests.
+ *
+ * @example
+ * ```typescript
+ * const authMiddleware = await createAuthMiddleware({
+ *   provider: 'auth0',
+ *   providerConfig: {
+ *     type: 'auth0',
+ *     domain: 'your-tenant.auth0.com',
+ *     clientId: 'your-client-id',
+ *   },
+ *   publicRoutes: ['/health', '/public/*'],
+ * });
+ *
+ * // Use in request handler
+ * const result = await authMiddleware(requestContext);
+ * if (result.proceed) {
+ *   // Access authenticated context
+ *   console.log('User:', result.context?.user);
+ * } else {
+ *   // Return error response
+ *   res.status(result.error.statusCode).json({ error: result.error.message });
+ * }
+ * ```
+ */
+export declare function createAuthMiddleware(config: AuthMiddlewareConfig): Promise<MiddlewareHandler<AuthRequestContext>>;
+/**
+ * Create RBAC (Role-Based Access Control) middleware
+ *
+ * Checks if authenticated user has required roles/permissions.
+ *
+ * @example
+ * ```typescript
+ * const rbacMiddleware = createRBACMiddleware({
+ *   roles: ['admin', 'moderator'],
+ *   permissions: ['read:users'],
+ * });
+ *
+ * // Use after auth middleware
+ * const authResult = await authMiddleware(context);
+ * if (authResult.proceed && authResult.context) {
+ *   const rbacResult = await rbacMiddleware(authResult.context);
+ *   if (!rbacResult.proceed) {
+ *     res.status(403).json({ error: rbacResult.error.message });
+ *   }
+ * }
+ * ```
+ */
+export declare function createRBACMiddleware(config: RBACMiddlewareConfig): MiddlewareHandler<AuthenticatedContext>;
+/**
+ * Create combined auth + RBAC middleware
+ *
+ * Convenience function that combines authentication and authorization.
+ *
+ * @example
+ * ```typescript
+ * const protectedMiddleware = await createProtectedMiddleware({
+ *   auth: {
+ *     provider: 'auth0',
+ *     providerConfig: { type: 'auth0', domain: '...', clientId: '...' },
+ *   },
+ *   rbac: {
+ *     roles: ['admin'],
+ *   },
+ * });
+ *
+ * const result = await protectedMiddleware(context);
+ * ```
+ */
+export declare function createProtectedMiddleware(config: {
+    auth: AuthMiddlewareConfig;
+    rbac?: RBACMiddlewareConfig;
+}): Promise<MiddlewareHandler<AuthRequestContext>>;
+/**
+ * Create request context from standard request object
+ */
+export declare function createRequestContext(req: IncomingRequest): AuthRequestContext;
+/**
+ * Create Express-compatible middleware
+ */
+export declare function createExpressAuthMiddleware(config: AuthMiddlewareConfig): Promise<ExpressMiddleware>;