@juspay/neurolink 9.31.2 → 9.32.0

package/dist/lib/auth/providers/workos.js

@@ -0,0 +1,285 @@
+// src/lib/auth/providers/workos.ts
+import { logger } from "../../utils/logger.js";
+import { createProxyFetch } from "../../proxy/proxyFetch.js";
+import { AuthError } from "../errors.js";
+import * as jose from "jose";
+import { BaseAuthProvider } from "./BaseAuthProvider.js";
+/**
+ * WorkOS Authentication Provider
+ *
+ * Supports WorkOS for enterprise SSO and user management.
+ * Validates JWTs issued by WorkOS and fetches user information.
+ *
+ * Features:
+ * - JWT validation using WorkOS JWKS
+ * - SSO token validation
+ * - Enterprise directory integration
+ * - Organization support for multi-tenant apps
+ * - Session management (inherited from BaseAuthProvider)
+ *
+ * @example
+ * ```typescript
+ * const workos = new WorkOSProvider({
+ *   type: "workos",
+ *   apiKey: "sk_...",
+ *   clientId: "client_..."
+ * });
+ *
+ * const result = await workos.authenticateToken(accessToken);
+ * if (result.valid) {
+ *   console.log("Authenticated user:", result.user);
+ * }
+ * ```
+ */
+export class WorkOSProvider extends BaseAuthProvider {
+    type = "workos";
+    apiKey;
+    clientId;
+    organizationId;
+    jwks = null;
+    constructor(config) {
+        super(config);
+        if (!config.apiKey) {
+            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS API key is required", { details: { provider: "workos", missingFields: ["apiKey"] } });
+        }
+        if (!config.clientId) {
+            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS client ID is required", { details: { provider: "workos", missingFields: ["clientId"] } });
+        }
+        this.apiKey = config.apiKey;
+        this.clientId = config.clientId;
+        this.organizationId = config.organizationId;
+    }
+    /**
+     * Initialize JWKS for WorkOS token verification
+     */
+    async initialize() {
+        const jwksUrl = new URL("https://api.workos.com/sso/jwks");
+        this.jwks = jose.createRemoteJWKSet(jwksUrl);
+        logger.debug("WorkOS provider initialized");
+    }
+    /**
+     * Validate WorkOS access token
+     */
+    async authenticateToken(token, _context) {
+        if (!this.jwks) {
+            await this.initialize();
+        }
+        try {
+            // Verify the JWT
+            const { payload } = await jose.jwtVerify(token, this.jwks, {
+                audience: this.clientId,
+            });
+            // Enforce organizationId if configured
+            if (this.organizationId &&
+                payload.org_id !== this.organizationId) {
+                return {
+                    valid: false,
+                    error: `Organization mismatch: expected ${this.organizationId}, got ${payload.org_id}`,
+                };
+            }
+            const user = {
+                id: payload.sub,
+                email: payload.email,
+                name: payload.first_name && payload.last_name
+                    ? `${payload.first_name} ${payload.last_name}`.trim()
+                    : undefined,
+                emailVerified: true, // WorkOS verifies emails via SSO
+                roles: payload.roles || [],
+                permissions: payload.permissions || [],
+                organizationId: payload.org_id,
+                metadata: {
+                    connection_id: payload.connection_id,
+                    connection_type: payload.connection_type,
+                    idp_id: payload.idp_id,
+                },
+            };
+            return {
+                valid: true,
+                payload: payload,
+                user,
+                expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+                tokenType: "jwt",
+            };
+        }
+        catch {
+            // If JWT validation fails, try session validation via API
+            return this.validateSessionViaAPI(token);
+        }
+    }
+    /**
+     * Validate session via WorkOS API
+     */
+    async validateSessionViaAPI(token) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch("https://api.workos.com/user_management/authenticate", {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    session_token: token,
+                    client_id: this.clientId,
+                }),
+                signal: AbortSignal.timeout(5000),
+            });
+            if (!response.ok) {
+                return {
+                    valid: false,
+                    error: `Session validation failed: HTTP ${response.status}`,
+                };
+            }
+            const data = (await response.json());
+            if (!data.user) {
+                return {
+                    valid: false,
+                    error: "User not found in session",
+                };
+            }
+            // Enforce organizationId if configured
+            if (this.organizationId && data.organization_id !== this.organizationId) {
+                return {
+                    valid: false,
+                    error: `Organization mismatch: expected ${this.organizationId}, got ${data.organization_id}`,
+                };
+            }
+            const user = {
+                id: data.user.id,
+                email: data.user.email,
+                name: data.user.first_name && data.user.last_name
+                    ? `${data.user.first_name} ${data.user.last_name}`.trim()
+                    : undefined,
+                picture: data.user.profile_picture_url,
+                emailVerified: data.user.email_verified,
+                roles: [],
+                permissions: [],
+                organizationId: data.organization_id,
+                createdAt: data.user.created_at
+                    ? new Date(data.user.created_at)
+                    : undefined,
+                metadata: data.user,
+            };
+            return {
+                valid: true,
+                payload: data,
+                user,
+                tokenType: "session",
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    /**
+     * Get user by ID via WorkOS API
+     */
+    async getUser(userId) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`https://api.workos.com/user_management/users/${userId}`, {
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                },
+            });
+            if (!response.ok) {
+                if (response.status === 404) {
+                    return null;
+                }
+                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
+            }
+            const data = (await response.json());
+            return {
+                id: data.id,
+                email: data.email,
+                name: data.first_name && data.last_name
+                    ? `${data.first_name} ${data.last_name}`.trim()
+                    : undefined,
+                picture: data.profile_picture_url,
+                emailVerified: data.email_verified,
+                roles: [],
+                permissions: [],
+                createdAt: data.created_at
+                    ? new Date(data.created_at)
+                    : undefined,
+                metadata: data,
+            };
+        }
+        catch (error) {
+            logger.error("Failed to fetch WorkOS user:", error instanceof Error ? error.message : String(error));
+            // Always rethrow -- transport errors should not be silenced as null
+            throw error;
+        }
+    }
+    /**
+     * Get user by email via WorkOS API
+     */
+    async getUserByEmail(email) {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch(`https://api.workos.com/user_management/users?email=${encodeURIComponent(email)}`, {
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                },
+            });
+            if (!response.ok) {
+                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
+            }
+            const result = (await response.json());
+            const users = result.data || [];
+            if (users.length === 0) {
+                return null;
+            }
+            const data = users[0];
+            return {
+                id: data.id,
+                email: data.email,
+                name: data.first_name && data.last_name
+                    ? `${data.first_name} ${data.last_name}`.trim()
+                    : undefined,
+                picture: data.profile_picture_url,
+                emailVerified: data.email_verified,
+                roles: [],
+                permissions: [],
+                createdAt: data.created_at
+                    ? new Date(data.created_at)
+                    : undefined,
+                metadata: data,
+            };
+        }
+        catch (error) {
+            logger.error("Failed to fetch WorkOS user by email:", error instanceof Error ? error.message : String(error));
+            // Rethrow AuthErrors, silence unknown transport errors
+            if (error instanceof Error && error.name === "AuthError") {
+                throw error;
+            }
+            return null;
+        }
+    }
+    /**
+     * Health check
+     */
+    async healthCheck() {
+        try {
+            const proxyFetch = createProxyFetch();
+            const response = await proxyFetch("https://api.workos.com/sso/jwks");
+            return {
+                healthy: response.ok,
+                providerConnected: response.ok,
+                sessionStorageHealthy: true,
+            };
+        }
+        catch (error) {
+            return {
+                healthy: false,
+                providerConnected: false,
+                sessionStorageHealthy: true,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+}
+//# sourceMappingURL=workos.js.map

package/dist/lib/auth/serverBridge.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Bridge between auth providers and NeuroLink's server middleware.
+ * Converts an auth provider's authenticateToken() into the validate
+ * callback expected by the existing createAuthMiddleware.
+ */
+import type { MastraAuthProvider } from "../types/authTypes.js";
+/**
+ * Create a validate function for server auth middleware from an auth provider.
+ */
+export declare function createAuthValidatorFromProvider(provider: MastraAuthProvider): (token: string, ctx: unknown) => Promise<{
+    id: string;
+    email?: string;
+    roles?: string[];
+} | null>;

package/dist/lib/auth/serverBridge.js

@@ -0,0 +1,26 @@
+/**
+ * Bridge between auth providers and NeuroLink's server middleware.
+ * Converts an auth provider's authenticateToken() into the validate
+ * callback expected by the existing createAuthMiddleware.
+ */
+/**
+ * Create a validate function for server auth middleware from an auth provider.
+ */
+export function createAuthValidatorFromProvider(provider) {
+    return async (token, ctx) => {
+        const result = await provider.authenticateToken(token, ctx);
+        if (!result.valid) {
+            return null;
+        }
+        if (result.user) {
+            return {
+                id: result.user.id,
+                email: result.user.email,
+                roles: result.user.roles,
+            };
+        }
+        // Fail closed: valid token without a resolved user is treated as failure
+        return null;
+    };
+}
+//# sourceMappingURL=serverBridge.js.map

package/dist/lib/auth/sessionManager.d.ts

@@ -0,0 +1,142 @@
+import type { AuthUser, AuthSession, SessionConfig } from "../types/authTypes.js";
+/**
+ * Session storage interface for SessionManager
+ *
+ * Defines the contract for session storage backends (memory, Redis, custom).
+ * Note: This is a SessionManager-specific interface that uses `set()`/`getUserSessions()`/
+ * `deleteUserSessions()`/`isHealthy()` method names, which differ from the canonical
+ * `SessionStorage` type in `../types/authTypes.js` (which uses `save()`/`getForUser()`/
+ * `deleteAllForUser()`/`exists()`/`touch()`). Both interfaces coexist because
+ * SessionManager and BaseAuthProvider have separate storage patterns.
+ */
+export interface SessionManagerStorage {
+    /** Get a session by ID */
+    get(sessionId: string): Promise<AuthSession | null>;
+    /** Store a session */
+    set(session: AuthSession): Promise<void>;
+    /** Delete a session */
+    delete(sessionId: string): Promise<void>;
+    /** Get all sessions for a user */
+    getUserSessions(userId: string): Promise<AuthSession[]>;
+    /** Delete all sessions for a user */
+    deleteUserSessions(userId: string): Promise<void>;
+    /** Clear all sessions (for cleanup) */
+    clear(): Promise<void>;
+    /** Health check */
+    isHealthy(): Promise<boolean>;
+}
+/**
+ * In-memory session storage
+ *
+ * Simple session storage using Map. Suitable for single-instance deployments
+ * or development. Sessions are lost on restart.
+ */
+export declare class MemorySessionStorage implements SessionManagerStorage {
+    private sessions;
+    private userSessions;
+    get(sessionId: string): Promise<AuthSession | null>;
+    set(session: AuthSession): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+    getUserSessions(userId: string): Promise<AuthSession[]>;
+    deleteUserSessions(userId: string): Promise<void>;
+    clear(): Promise<void>;
+    isHealthy(): Promise<boolean>;
+}
+/**
+ * Redis session storage
+ *
+ * Distributed session storage using Redis. Suitable for multi-instance
+ * deployments. Requires ioredis or similar Redis client.
+ *
+ * Note: Redis client must be provided or configured via environment.
+ */
+export declare class RedisSessionStorage implements SessionManagerStorage {
+    private prefix;
+    private ttl;
+    private redisUrl;
+    private client;
+    private initPromise;
+    constructor(config: {
+        url: string;
+        prefix?: string;
+        ttl?: number;
+    });
+    private getClient;
+    private createClient;
+    private sessionKey;
+    private userSessionsKey;
+    get(sessionId: string): Promise<AuthSession | null>;
+    set(session: AuthSession): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+    getUserSessions(userId: string): Promise<AuthSession[]>;
+    deleteUserSessions(userId: string): Promise<void>;
+    clear(): Promise<void>;
+    isHealthy(): Promise<boolean>;
+    disconnect(): Promise<void>;
+}
+/**
+ * Session Manager
+ *
+ * High-level session management that handles session lifecycle,
+ * automatic refresh, and storage abstraction.
+ */
+export declare class SessionManager {
+    private storage;
+    private config;
+    constructor(config?: SessionConfig);
+    private createStorage;
+    /**
+     * Create a new session
+     */
+    createSession(user: AuthUser, metadata?: {
+        ipAddress?: string;
+        userAgent?: string;
+        deviceId?: string;
+    }): Promise<AuthSession>;
+    /**
+     * Get a session by ID
+     *
+     * Optionally auto-refreshes if close to expiration.
+     */
+    getSession(sessionId: string, autoRefresh?: boolean | undefined): Promise<AuthSession | null>;
+    /**
+     * Check if session should be refreshed
+     */
+    private shouldRefresh;
+    /**
+     * Refresh a session
+     */
+    refreshSession(sessionId: string): Promise<AuthSession | null>;
+    /**
+     * Destroy a session
+     */
+    destroySession(sessionId: string): Promise<void>;
+    /**
+     * Get all sessions for a user
+     */
+    getUserSessions(userId: string): Promise<AuthSession[]>;
+    /**
+     * Destroy all sessions for a user (global logout)
+     */
+    destroyAllUserSessions(userId: string): Promise<void>;
+    /**
+     * Validate a session is still active
+     */
+    validateSession(sessionId: string): Promise<boolean>;
+    /**
+     * Update session metadata
+     */
+    updateSessionMetadata(sessionId: string, metadata: Record<string, unknown>): Promise<AuthSession | null>;
+    /**
+     * Health check
+     */
+    isHealthy(): Promise<boolean>;
+    /**
+     * Clear all sessions (for testing/cleanup)
+     */
+    clear(): Promise<void>;
+}
+/**
+ * Create session storage based on configuration
+ */
+export declare function createSessionStorage(config: SessionConfig): SessionManagerStorage;