@juspay/neurolink 9.32.0 → 9.33.0

package/dist/client/auth/providers/supabase.js

@@ -1,259 +0,0 @@
-// src/lib/auth/providers/supabase.ts
-import { BaseAuthProvider } from "./BaseAuthProvider.js";
-import { AuthError } from "../errors.js";
-import { logger } from "../../utils/logger.js";
-import { createProxyFetch } from "../../proxy/proxyFetch.js";
-import * as jose from "jose";
-/**
- * Supabase Authentication Provider
- *
- * Supports Supabase JWT validation and user management.
- * Can validate tokens locally with JWT secret or via Supabase API.
- *
- * Features:
- * - Local JWT validation with JWT secret
- * - API-based token validation
- * - User profile fetching (requires service role key)
- * - Role extraction from app_metadata
- *
- * @example
- * ```typescript
- * const supabase = new SupabaseAuthProvider({
- *   type: "supabase",
- *   url: "https://your-project.supabase.co",
- *   anonKey: "your-anon-key",
- *   jwtSecret: "your-jwt-secret" // Optional for local validation
- * });
- *
- * const result = await supabase.authenticateToken(accessToken);
- * if (result.valid) {
- *   console.log("Authenticated user:", result.user);
- * }
- * ```
- */
-export class SupabaseAuthProvider extends BaseAuthProvider {
-    type = "supabase";
-    supabaseUrl;
-    anonKey;
-    serviceRoleKey;
-    jwtSecret;
-    constructor(config) {
-        super(config);
-        if (!config.url) {
-            throw AuthError.create("CONFIGURATION_ERROR", "Supabase URL is required", { details: { missingFields: ["url"] } });
-        }
-        if (!config.anonKey) {
-            throw AuthError.create("CONFIGURATION_ERROR", "Supabase anon key is required", { details: { missingFields: ["anonKey"] } });
-        }
-        this.supabaseUrl = config.url.replace(/\/$/, ""); // Remove trailing slash
-        this.anonKey = config.anonKey;
-        this.serviceRoleKey = config.serviceRoleKey;
-        this.jwtSecret = config.jwtSecret;
-    }
-    /**
-     * Validate Supabase JWT
-     */
-    async authenticateToken(token, _context) {
-        try {
-            // If JWT secret is provided, verify locally
-            if (this.jwtSecret) {
-                const secret = new TextEncoder().encode(this.jwtSecret);
-                const { payload } = await jose.jwtVerify(token, secret);
-                // Reject tokens without a sub claim (anon/service_role JWTs)
-                if (!payload.sub) {
-                    return {
-                        valid: false,
-                        error: "Token missing sub claim: cannot authenticate without a user identity",
-                    };
-                }
-                // Only accept tokens with "authenticated" role
-                const role = payload.role;
-                if (role && role !== "authenticated") {
-                    return {
-                        valid: false,
-                        error: `Invalid token role: ${role}. Only "authenticated" role is accepted`,
-                    };
-                }
-                const user = this.payloadToUser(payload);
-                return {
-                    valid: true,
-                    payload: payload,
-                    user,
-                    expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
-                    tokenType: "jwt",
-                };
-            }
-            // Otherwise, validate via Supabase API
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/user`, {
-                headers: {
-                    Authorization: `Bearer ${token}`,
-                    apikey: this.anonKey,
-                },
-            });
-            if (!response.ok) {
-                return {
-                    valid: false,
-                    error: `Token validation failed: HTTP ${response.status}`,
-                };
-            }
-            const userData = (await response.json());
-            const user = this.supabaseUserToAuthUser(userData);
-            return {
-                valid: true,
-                payload: userData,
-                user,
-                tokenType: "jwt",
-            };
-        }
-        catch (error) {
-            return {
-                valid: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    /**
-     * Convert JWT payload to AuthUser
-     */
-    payloadToUser(payload) {
-        const appMetadata = payload.app_metadata;
-        const userMetadata = payload.user_metadata;
-        // Use payload.role (Supabase standard claim) for the roles array
-        const role = payload.role;
-        return {
-            id: payload.sub,
-            email: payload.email,
-            name: userMetadata?.full_name || userMetadata?.name,
-            picture: userMetadata?.avatar_url,
-            emailVerified: payload.email_confirmed || false,
-            roles: role ? [role] : appMetadata?.roles || [],
-            permissions: appMetadata?.permissions || [],
-            metadata: userMetadata,
-        };
-    }
-    /**
-     * Convert Supabase user to AuthUser
-     */
-    supabaseUserToAuthUser(userData) {
-        const appMetadata = userData.app_metadata;
-        const userMetadata = userData.user_metadata;
-        return {
-            id: userData.id,
-            email: userData.email,
-            name: userMetadata?.full_name || userMetadata?.name,
-            picture: userMetadata?.avatar_url,
-            emailVerified: !!userData.email_confirmed_at,
-            roles: appMetadata?.roles || [],
-            permissions: appMetadata?.permissions || [],
-            createdAt: userData.created_at
-                ? new Date(userData.created_at)
-                : undefined,
-            lastLoginAt: userData.last_sign_in_at
-                ? new Date(userData.last_sign_in_at)
-                : undefined,
-            metadata: userMetadata,
-        };
-    }
-    /**
-     * Get user by ID via Supabase Admin API
-     * Requires service role key
-     */
-    async getUser(userId) {
-        if (!this.serviceRoleKey) {
-            logger.warn("Service role key required for user lookup");
-            return null;
-        }
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/admin/users/${userId}`, {
-                headers: {
-                    Authorization: `Bearer ${this.serviceRoleKey}`,
-                    apikey: this.anonKey,
-                },
-            });
-            if (!response.ok) {
-                if (response.status === 404) {
-                    return null;
-                }
-                throw AuthError.create("PROVIDER_ERROR", `Supabase API returned ${response.status}`, { details: { statusCode: response.status } });
-            }
-            const userData = (await response.json());
-            return this.supabaseUserToAuthUser(userData);
-        }
-        catch (error) {
-            logger.error("Failed to fetch Supabase user:", error);
-            if (error &&
-                typeof error === "object" &&
-                "code" in error &&
-                typeof error.code === "string") {
-                throw error;
-            }
-            return null;
-        }
-    }
-    /**
-     * Get user by email via Supabase Admin API
-     * Requires service role key
-     */
-    async getUserByEmail(email) {
-        if (!this.serviceRoleKey) {
-            logger.warn("Service role key required for user lookup by email");
-            return null;
-        }
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/admin/users?email=${encodeURIComponent(email)}`, {
-                headers: {
-                    Authorization: `Bearer ${this.serviceRoleKey}`,
-                    apikey: this.anonKey,
-                },
-            });
-            if (!response.ok) {
-                throw AuthError.create("PROVIDER_ERROR", `Supabase API returned ${response.status}`, { details: { statusCode: response.status } });
-            }
-            const result = (await response.json());
-            const users = result.users || [];
-            if (users.length === 0) {
-                return null;
-            }
-            return this.supabaseUserToAuthUser(users[0]);
-        }
-        catch (error) {
-            logger.error("Failed to fetch Supabase user by email:", error);
-            if (error &&
-                typeof error === "object" &&
-                "code" in error &&
-                typeof error.code === "string") {
-                throw error;
-            }
-            return null;
-        }
-    }
-    /**
-     * Health check
-     */
-    async healthCheck() {
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`${this.supabaseUrl}/auth/v1/health`, {
-                headers: {
-                    apikey: this.anonKey,
-                },
-            });
-            return {
-                healthy: response.ok,
-                providerConnected: response.ok,
-                sessionStorageHealthy: true,
-            };
-        }
-        catch (error) {
-            return {
-                healthy: false,
-                providerConnected: false,
-                sessionStorageHealthy: true,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-}

package/dist/client/auth/providers/workos.js

@@ -1,284 +0,0 @@
-// src/lib/auth/providers/workos.ts
-import { logger } from "../../utils/logger.js";
-import { createProxyFetch } from "../../proxy/proxyFetch.js";
-import { AuthError } from "../errors.js";
-import * as jose from "jose";
-import { BaseAuthProvider } from "./BaseAuthProvider.js";
-/**
- * WorkOS Authentication Provider
- *
- * Supports WorkOS for enterprise SSO and user management.
- * Validates JWTs issued by WorkOS and fetches user information.
- *
- * Features:
- * - JWT validation using WorkOS JWKS
- * - SSO token validation
- * - Enterprise directory integration
- * - Organization support for multi-tenant apps
- * - Session management (inherited from BaseAuthProvider)
- *
- * @example
- * ```typescript
- * const workos = new WorkOSProvider({
- *   type: "workos",
- *   apiKey: "sk_...",
- *   clientId: "client_..."
- * });
- *
- * const result = await workos.authenticateToken(accessToken);
- * if (result.valid) {
- *   console.log("Authenticated user:", result.user);
- * }
- * ```
- */
-export class WorkOSProvider extends BaseAuthProvider {
-    type = "workos";
-    apiKey;
-    clientId;
-    organizationId;
-    jwks = null;
-    constructor(config) {
-        super(config);
-        if (!config.apiKey) {
-            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS API key is required", { details: { provider: "workos", missingFields: ["apiKey"] } });
-        }
-        if (!config.clientId) {
-            throw AuthError.create("CONFIGURATION_ERROR", "WorkOS client ID is required", { details: { provider: "workos", missingFields: ["clientId"] } });
-        }
-        this.apiKey = config.apiKey;
-        this.clientId = config.clientId;
-        this.organizationId = config.organizationId;
-    }
-    /**
-     * Initialize JWKS for WorkOS token verification
-     */
-    async initialize() {
-        const jwksUrl = new URL("https://api.workos.com/sso/jwks");
-        this.jwks = jose.createRemoteJWKSet(jwksUrl);
-        logger.debug("WorkOS provider initialized");
-    }
-    /**
-     * Validate WorkOS access token
-     */
-    async authenticateToken(token, _context) {
-        if (!this.jwks) {
-            await this.initialize();
-        }
-        try {
-            // Verify the JWT
-            const { payload } = await jose.jwtVerify(token, this.jwks, {
-                audience: this.clientId,
-            });
-            // Enforce organizationId if configured
-            if (this.organizationId &&
-                payload.org_id !== this.organizationId) {
-                return {
-                    valid: false,
-                    error: `Organization mismatch: expected ${this.organizationId}, got ${payload.org_id}`,
-                };
-            }
-            const user = {
-                id: payload.sub,
-                email: payload.email,
-                name: payload.first_name && payload.last_name
-                    ? `${payload.first_name} ${payload.last_name}`.trim()
-                    : undefined,
-                emailVerified: true, // WorkOS verifies emails via SSO
-                roles: payload.roles || [],
-                permissions: payload.permissions || [],
-                organizationId: payload.org_id,
-                metadata: {
-                    connection_id: payload.connection_id,
-                    connection_type: payload.connection_type,
-                    idp_id: payload.idp_id,
-                },
-            };
-            return {
-                valid: true,
-                payload: payload,
-                user,
-                expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
-                tokenType: "jwt",
-            };
-        }
-        catch {
-            // If JWT validation fails, try session validation via API
-            return this.validateSessionViaAPI(token);
-        }
-    }
-    /**
-     * Validate session via WorkOS API
-     */
-    async validateSessionViaAPI(token) {
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch("https://api.workos.com/user_management/authenticate", {
-                method: "POST",
-                headers: {
-                    Authorization: `Bearer ${this.apiKey}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify({
-                    session_token: token,
-                    client_id: this.clientId,
-                }),
-                signal: AbortSignal.timeout(5000),
-            });
-            if (!response.ok) {
-                return {
-                    valid: false,
-                    error: `Session validation failed: HTTP ${response.status}`,
-                };
-            }
-            const data = (await response.json());
-            if (!data.user) {
-                return {
-                    valid: false,
-                    error: "User not found in session",
-                };
-            }
-            // Enforce organizationId if configured
-            if (this.organizationId && data.organization_id !== this.organizationId) {
-                return {
-                    valid: false,
-                    error: `Organization mismatch: expected ${this.organizationId}, got ${data.organization_id}`,
-                };
-            }
-            const user = {
-                id: data.user.id,
-                email: data.user.email,
-                name: data.user.first_name && data.user.last_name
-                    ? `${data.user.first_name} ${data.user.last_name}`.trim()
-                    : undefined,
-                picture: data.user.profile_picture_url,
-                emailVerified: data.user.email_verified,
-                roles: [],
-                permissions: [],
-                organizationId: data.organization_id,
-                createdAt: data.user.created_at
-                    ? new Date(data.user.created_at)
-                    : undefined,
-                metadata: data.user,
-            };
-            return {
-                valid: true,
-                payload: data,
-                user,
-                tokenType: "session",
-            };
-        }
-        catch (error) {
-            return {
-                valid: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    /**
-     * Get user by ID via WorkOS API
-     */
-    async getUser(userId) {
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`https://api.workos.com/user_management/users/${userId}`, {
-                headers: {
-                    Authorization: `Bearer ${this.apiKey}`,
-                },
-            });
-            if (!response.ok) {
-                if (response.status === 404) {
-                    return null;
-                }
-                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
-            }
-            const data = (await response.json());
-            return {
-                id: data.id,
-                email: data.email,
-                name: data.first_name && data.last_name
-                    ? `${data.first_name} ${data.last_name}`.trim()
-                    : undefined,
-                picture: data.profile_picture_url,
-                emailVerified: data.email_verified,
-                roles: [],
-                permissions: [],
-                createdAt: data.created_at
-                    ? new Date(data.created_at)
-                    : undefined,
-                metadata: data,
-            };
-        }
-        catch (error) {
-            logger.error("Failed to fetch WorkOS user:", error instanceof Error ? error.message : String(error));
-            // Always rethrow -- transport errors should not be silenced as null
-            throw error;
-        }
-    }
-    /**
-     * Get user by email via WorkOS API
-     */
-    async getUserByEmail(email) {
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch(`https://api.workos.com/user_management/users?email=${encodeURIComponent(email)}`, {
-                headers: {
-                    Authorization: `Bearer ${this.apiKey}`,
-                },
-            });
-            if (!response.ok) {
-                throw AuthError.create("PROVIDER_ERROR", `WorkOS API returned ${response.status}`, { details: { provider: "workos", statusCode: response.status } });
-            }
-            const result = (await response.json());
-            const users = result.data || [];
-            if (users.length === 0) {
-                return null;
-            }
-            const data = users[0];
-            return {
-                id: data.id,
-                email: data.email,
-                name: data.first_name && data.last_name
-                    ? `${data.first_name} ${data.last_name}`.trim()
-                    : undefined,
-                picture: data.profile_picture_url,
-                emailVerified: data.email_verified,
-                roles: [],
-                permissions: [],
-                createdAt: data.created_at
-                    ? new Date(data.created_at)
-                    : undefined,
-                metadata: data,
-            };
-        }
-        catch (error) {
-            logger.error("Failed to fetch WorkOS user by email:", error instanceof Error ? error.message : String(error));
-            // Rethrow AuthErrors, silence unknown transport errors
-            if (error instanceof Error && error.name === "AuthError") {
-                throw error;
-            }
-            return null;
-        }
-    }
-    /**
-     * Health check
-     */
-    async healthCheck() {
-        try {
-            const proxyFetch = createProxyFetch();
-            const response = await proxyFetch("https://api.workos.com/sso/jwks");
-            return {
-                healthy: response.ok,
-                providerConnected: response.ok,
-                sessionStorageHealthy: true,
-            };
-        }
-        catch (error) {
-            return {
-                healthy: false,
-                providerConnected: false,
-                sessionStorageHealthy: true,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-}

package/dist/client/auth/serverBridge.js

@@ -1,25 +0,0 @@
-/**
- * Bridge between auth providers and NeuroLink's server middleware.
- * Converts an auth provider's authenticateToken() into the validate
- * callback expected by the existing createAuthMiddleware.
- */
-/**
- * Create a validate function for server auth middleware from an auth provider.
- */
-export function createAuthValidatorFromProvider(provider) {
-    return async (token, ctx) => {
-        const result = await provider.authenticateToken(token, ctx);
-        if (!result.valid) {
-            return null;
-        }
-        if (result.user) {
-            return {
-                id: result.user.id,
-                email: result.user.email,
-                roles: result.user.roles,
-            };
-        }
-        // Fail closed: valid token without a resolved user is treated as failure
-        return null;
-    };
-}