@kurdel/auth 0.1.0-beta.1

package/lib/repositories/index.js

@@ -0,0 +1,4 @@
+export * from './api-key/index.js';
+export * from './jwt/index.js';
+export * from './user/index.js';
+//# sourceMappingURL=index.js.map

package/lib/repositories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC"}

package/lib/repositories/jwt/index.d.ts

@@ -0,0 +1 @@
+export * from './jwt-repository.js';

package/lib/repositories/jwt/index.js

@@ -0,0 +1,2 @@
+export * from './jwt-repository.js';
+//# sourceMappingURL=index.js.map

package/lib/repositories/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/repositories/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/lib/repositories/jwt/jwt-repository.d.ts

@@ -0,0 +1,3 @@
+import type { AuthUserRepository } from '../../repositories/user/index.js';
+/** @deprecated Use AuthUserRepository. JWT is a credential, not a user store. */
+export type JwtRepository = AuthUserRepository;

package/lib/repositories/jwt/jwt-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt-repository.js.map

package/lib/repositories/jwt/jwt-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-repository.js","sourceRoot":"","sources":["../../../src/repositories/jwt/jwt-repository.ts"],"names":[],"mappings":""}

package/lib/repositories/user/auth-user-repository.d.ts

@@ -0,0 +1,11 @@
+import type { AuthUser } from '@kurdel/common';
+/**
+ * Resolves the current application identity used for authorization.
+ *
+ * Implementations exclude identities that must not authenticate, such as
+ * disabled or deleted users. Roles come from this source of truth rather than
+ * from the presented credential.
+ */
+export interface AuthUserRepository {
+    findById(id: string | number): Promise<AuthUser | null> | AuthUser | null;
+}

package/lib/repositories/user/auth-user-repository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-user-repository.js.map

package/lib/repositories/user/auth-user-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-user-repository.js","sourceRoot":"","sources":["../../../src/repositories/user/auth-user-repository.ts"],"names":[],"mappings":""}

package/lib/repositories/user/index.d.ts

@@ -0,0 +1 @@
+export * from './auth-user-repository.js';

package/lib/repositories/user/index.js

@@ -0,0 +1,2 @@
+export * from './auth-user-repository.js';
+//# sourceMappingURL=index.js.map

package/lib/repositories/user/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/repositories/user/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC"}

package/lib/runtime/auth-module.d.ts

@@ -0,0 +1,64 @@
+import type { Container } from '@kurdel/ioc';
+import { ModulePriority, type AppModule, type ProviderConfig } from '@kurdel/core/app';
+import { type AuthEventSinkProvider, type AuthStrategyProvider, type AuthorizationPolicyProvider } from '../domain/index.js';
+/**
+ * ## AuthModuleConfig
+ *
+ * Defines authentication strategies supplied by the application.
+ *
+ * Example:
+ * ```ts
+ * new AuthModule({
+ *   strategies: [
+ *     { name: 'api-key', use: new ApiKeyStrategy({...}) },
+ *     { name: 'jwt', use: new JwtStrategy({...}) },
+ *   ]
+ * })
+ * ```
+ *
+ * Strategies are registered **once** during module initialization.
+ */
+export interface AuthModuleConfig {
+    /** List of user-provided authentication strategies. */
+    strategies?: AuthStrategyProvider[];
+    /** List of named application authorization policies. */
+    policies?: AuthorizationPolicyProvider[];
+    /** Optional destination for sanitized authentication lifecycle events. */
+    events?: AuthEventSinkProvider;
+}
+/**
+ * ## AuthModule
+ *
+ * Provides:
+ * - singleton `AuthStrategyRegistry`
+ * - automatic registration of configured strategies
+ *
+ * Responsibilities:
+ * - expose a DI-managed registry storing all auth strategies
+ * - populate it during `register()`
+ *
+ * Non-responsibilities:
+ * - no transport logic
+ * - no middleware ordering
+ * - no policy evaluation
+ *
+ * Identity repositories, credentials and strategy-specific services are
+ * application concerns and must be supplied outside this module.
+ */
+export declare class AuthModule implements AppModule<AuthModuleConfig> {
+    private readonly config;
+    readonly priority = ModulePriority.Auth;
+    /**
+     * Providers exposed by the module.
+     *
+     * - `StrategyRegistry` → a singleton container of auth strategies
+     */
+    readonly providers: ProviderConfig[];
+    constructor(config?: AuthModuleConfig);
+    /**
+     * Registers all configured authentication strategies.
+     *
+     * Called once during app startup.
+     */
+    register(ioc: Container): Promise<void>;
+}

package/lib/runtime/auth-module.js

@@ -0,0 +1,83 @@
+import { ModulePriority } from '@kurdel/core/app';
+import { TOKENS } from '@kurdel/core/tokens';
+import { NoopAuthEventSink, } from '../domain/index.js';
+import { AuthStrategyRegistry, AuthorizationPolicyRegistry, createAuthMiddleware, } from '../runtime/index.js';
+import { AUTH_TOKENS } from '../tokens.js';
+/**
+ * ## AuthModule
+ *
+ * Provides:
+ * - singleton `AuthStrategyRegistry`
+ * - automatic registration of configured strategies
+ *
+ * Responsibilities:
+ * - expose a DI-managed registry storing all auth strategies
+ * - populate it during `register()`
+ *
+ * Non-responsibilities:
+ * - no transport logic
+ * - no middleware ordering
+ * - no policy evaluation
+ *
+ * Identity repositories, credentials and strategy-specific services are
+ * application concerns and must be supplied outside this module.
+ */
+export class AuthModule {
+    constructor(config = {}) {
+        this.config = config;
+        this.priority = ModulePriority.Auth;
+        const eventSink = config.events;
+        this.providers = [
+            {
+                provide: AUTH_TOKENS.StrategyRegistry,
+                useClass: AuthStrategyRegistry,
+                singleton: true,
+            },
+            {
+                provide: AUTH_TOKENS.PolicyRegistry,
+                useClass: AuthorizationPolicyRegistry,
+                singleton: true,
+            },
+            eventSink && 'useFactory' in eventSink
+                ? {
+                    provide: AUTH_TOKENS.EventSink,
+                    useFactory: eventSink.useFactory,
+                    singleton: true,
+                }
+                : {
+                    provide: AUTH_TOKENS.EventSink,
+                    useInstance: eventSink?.use ?? new NoopAuthEventSink(),
+                },
+        ];
+    }
+    /**
+     * Registers all configured authentication strategies.
+     *
+     * Called once during app startup.
+     */
+    async register(ioc) {
+        const registry = ioc.get(AUTH_TOKENS.StrategyRegistry);
+        const policies = ioc.get(AUTH_TOKENS.PolicyRegistry);
+        const events = ioc.get(AUTH_TOKENS.EventSink);
+        // register user strategies
+        for (const s of this.config.strategies ?? []) {
+            if ('use' in s) {
+                registry.register(s.name, s.use);
+            }
+            else {
+                const strategy = s.useFactory(ioc);
+                registry.register(s.name, strategy);
+            }
+        }
+        for (const policy of this.config.policies ?? []) {
+            policies.register(policy.name, 'use' in policy ? policy.use : policy.useFactory(ioc));
+        }
+        // register system auth middleware
+        const mwReg = ioc.get(TOKENS.MiddlewareRegistry);
+        mwReg.use(createAuthMiddleware(registry, policies, events), {
+            zone: 'auth',
+            priority: 0,
+        });
+    }
+}
+//# sourceMappingURL=auth-module.js.map

package/lib/runtime/auth-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-module.js","sourceRoot":"","sources":["../../src/runtime/auth-module.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAuC,MAAM,kBAAkB,CAAC;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EACL,iBAAiB,GAKlB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA4B5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,UAAU;IAUrB,YAA6B,SAA2B,EAAE;QAA7B,WAAM,GAAN,MAAM,CAAuB;QATjD,aAAQ,GAAG,cAAc,CAAC,IAAI,CAAC;QAUtC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG;YACf;gBACE,OAAO,EAAE,WAAW,CAAC,gBAAgB;gBACrC,QAAQ,EAAE,oBAAoB;gBAC9B,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,OAAO,EAAE,WAAW,CAAC,cAAc;gBACnC,QAAQ,EAAE,2BAA2B;gBACrC,SAAS,EAAE,IAAI;aAChB;YACD,SAAS,IAAI,YAAY,IAAI,SAAS;gBACpC,CAAC,CAAC;oBACE,OAAO,EAAE,WAAW,CAAC,SAAS;oBAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,SAAS,EAAE,IAAI;iBAChB;gBACH,CAAC,CAAC;oBACE,OAAO,EAAE,WAAW,CAAC,SAAS;oBAC9B,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,iBAAiB,EAAE;iBACvD;SACN,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAc;QAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAuB,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAA8B,WAAW,CAAC,cAAc,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAgB,WAAW,CAAC,SAAS,CAAC,CAAC;QAE7D,2BAA2B;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC7C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACf,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACnC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,QAAQ,CACf,MAAM,CAAC,IAAI,EACX,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CACtD,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAqB,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrE,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE;YAC1D,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;CACF"}

package/lib/runtime/auth-strategy-registry.d.ts

@@ -0,0 +1,25 @@
+import type { AuthStrategy } from '../domain/index.js';
+/**
+ * ## AuthStrategyRegistry
+ *
+ * Holds named authentication strategies (e.g. `jwt`, `apikey`, `session`).
+ * Strategies are resolved by middleware per request.
+ */
+export declare class AuthStrategyRegistry {
+    private readonly strategies;
+    /**
+     * Registers a new authentication strategy.
+     *
+     * @param name - Strategy identifier (e.g. "jwt", "apikey").
+     * @param strategy - Implementation of {@link AuthStrategy}.
+     */
+    register(name: string, strategy: AuthStrategy): void;
+    /**
+     * Returns a strategy by name, if registered.
+     */
+    get(name: string): AuthStrategy | undefined;
+    /**
+     * Removes a strategy (rarely used).
+     */
+    unregister(name: string): void;
+}

package/lib/runtime/auth-strategy-registry.js

@@ -0,0 +1,33 @@
+/**
+ * ## AuthStrategyRegistry
+ *
+ * Holds named authentication strategies (e.g. `jwt`, `apikey`, `session`).
+ * Strategies are resolved by middleware per request.
+ */
+export class AuthStrategyRegistry {
+    constructor() {
+        this.strategies = new Map();
+    }
+    /**
+     * Registers a new authentication strategy.
+     *
+     * @param name - Strategy identifier (e.g. "jwt", "apikey").
+     * @param strategy - Implementation of {@link AuthStrategy}.
+     */
+    register(name, strategy) {
+        this.strategies.set(name, strategy);
+    }
+    /**
+     * Returns a strategy by name, if registered.
+     */
+    get(name) {
+        return this.strategies.get(name);
+    }
+    /**
+     * Removes a strategy (rarely used).
+     */
+    unregister(name) {
+        this.strategies.delete(name);
+    }
+}
+//# sourceMappingURL=auth-strategy-registry.js.map

package/lib/runtime/auth-strategy-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-strategy-registry.js","sourceRoot":"","sources":["../../src/runtime/auth-strategy-registry.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IAAjC;QACmB,eAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IAyBhE,CAAC;IAvBC;;;;;OAKG;IACH,QAAQ,CAAC,IAAY,EAAE,QAAsB;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/lib/runtime/authorization-policy-registry.d.ts

@@ -0,0 +1,8 @@
+import type { AuthorizationPolicy } from '../domain/index.js';
+/** Stores the named authorization policies available to route metadata. */
+export declare class AuthorizationPolicyRegistry {
+    private readonly policies;
+    register(name: string, policy: AuthorizationPolicy): void;
+    get(name: string): AuthorizationPolicy | undefined;
+    unregister(name: string): void;
+}

package/lib/runtime/authorization-policy-registry.js

@@ -0,0 +1,16 @@
+/** Stores the named authorization policies available to route metadata. */
+export class AuthorizationPolicyRegistry {
+    constructor() {
+        this.policies = new Map();
+    }
+    register(name, policy) {
+        this.policies.set(name, policy);
+    }
+    get(name) {
+        return this.policies.get(name);
+    }
+    unregister(name) {
+        this.policies.delete(name);
+    }
+}
+//# sourceMappingURL=authorization-policy-registry.js.map

package/lib/runtime/authorization-policy-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-policy-registry.js","sourceRoot":"","sources":["../../src/runtime/authorization-policy-registry.ts"],"names":[],"mappings":"AAEA,2EAA2E;AAC3E,MAAM,OAAO,2BAA2B;IAAxC;QACmB,aAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAarE,CAAC;IAXC,QAAQ,CAAC,IAAY,EAAE,MAA2B;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;CACF"}

package/lib/runtime/create-auth-middleware.d.ts

@@ -0,0 +1,5 @@
+import type { Middleware } from '@kurdel/core/http';
+import { type AuthEventSink } from '../domain/index.js';
+import type { AuthStrategyRegistry } from './auth-strategy-registry.js';
+import { AuthorizationPolicyRegistry } from './authorization-policy-registry.js';
+export declare function createAuthMiddleware(registry: AuthStrategyRegistry, policies?: AuthorizationPolicyRegistry, events?: AuthEventSink, now?: () => Date): Middleware;

package/lib/runtime/create-auth-middleware.js

@@ -0,0 +1,89 @@
+import { NoopAuthEventSink } from '../domain/index.js';
+import { AuthorizationPolicyRegistry } from './authorization-policy-registry.js';
+export function createAuthMiddleware(registry, policies = new AuthorizationPolicyRegistry(), events = new NoopAuthEventSink(), now = () => new Date()) {
+    return async (ctx, next) => {
+        const meta = ctx.route?.auth;
+        if (!meta || meta.public) {
+            // public route
+            return next();
+        }
+        const { strategy, roles, policies: requiredPolicies } = meta;
+        // --- 1️⃣ Authenticate ---
+        let auth;
+        if (strategy) {
+            const strat = registry.get(strategy);
+            if (!strat) {
+                return ctx.json(500, { error: `Unknown auth strategy '${strategy}'` });
+            }
+            const result = await strat.authenticate(ctx.req);
+            if (!result) {
+                await events.report({
+                    type: 'authentication.failed',
+                    occurredAt: now(),
+                    strategy,
+                    reason: 'invalid-credential',
+                });
+                return ctx.json(401, { error: 'Unauthorized' });
+            }
+            auth = {
+                ...result,
+                strategy,
+            };
+            ctx.auth = auth;
+            ctx.user = result.user;
+            await events.report({
+                type: 'authentication.succeeded',
+                occurredAt: now(),
+                strategy,
+                userId: auth.user.id,
+                ...(auth.credential ? { credential: auth.credential } : {}),
+            });
+        }
+        // --- 2️⃣ Authorize ---
+        if (roles && roles.length > 0) {
+            const ok = auth && Array.isArray(auth.user.roles)
+                ? roles.some(r => auth.user.roles.includes(r))
+                : false;
+            if (!ok) {
+                await events.report({
+                    type: 'authorization.denied',
+                    occurredAt: now(),
+                    ...(auth ? { strategy: auth.strategy, userId: auth.user.id } : {}),
+                    ...(auth?.credential ? { credential: auth.credential } : {}),
+                    reason: 'missing-role',
+                });
+                return ctx.json(403, { error: 'Forbidden' });
+            }
+        }
+        if (requiredPolicies && requiredPolicies.length > 0) {
+            if (!auth) {
+                await events.report({
+                    type: 'authorization.denied',
+                    occurredAt: now(),
+                    reason: 'missing-authentication',
+                });
+                return ctx.json(403, { error: 'Forbidden' });
+            }
+            for (const name of requiredPolicies) {
+                const policy = policies.get(name);
+                if (!policy) {
+                    return ctx.json(500, { error: `Unknown authorization policy '${name}'` });
+                }
+                if (!(await policy.authorize(auth, ctx))) {
+                    await events.report({
+                        type: 'authorization.denied',
+                        occurredAt: now(),
+                        strategy: auth.strategy,
+                        userId: auth.user.id,
+                        ...(auth.credential ? { credential: auth.credential } : {}),
+                        reason: 'policy-rejected',
+                        policy: name,
+                    });
+                    return ctx.json(403, { error: 'Forbidden' });
+                }
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=create-auth-middleware.js.map

package/lib/runtime/create-auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-auth-middleware.js","sourceRoot":"","sources":["../../src/runtime/create-auth-middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAwC,MAAM,qBAAqB,CAAC;AAG9F,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,UAAU,oBAAoB,CAClC,QAA8B,EAC9B,WAAwC,IAAI,2BAA2B,EAAE,EACzE,SAAwB,IAAI,iBAAiB,EAAE,EAC/C,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,eAAe;YACf,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;QAE7D,2BAA2B;QAC3B,IAAI,IAA6B,CAAC;QAElC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,0BAA0B,QAAQ,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,uBAAuB;oBAC7B,UAAU,EAAE,GAAG,EAAE;oBACjB,QAAQ;oBACR,MAAM,EAAE,oBAAoB;iBAC7B,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,GAAG;gBACL,GAAG,MAAM;gBACT,QAAQ;aACT,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClB,IAAI,EAAE,0BAA0B;gBAChC,UAAU,EAAE,GAAG,EAAE;gBACjB,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC/C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;YAEV,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,cAAc;iBACvB,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,UAAU,EAAE,GAAG,EAAE;oBACjB,MAAM,EAAE,wBAAwB;iBACjC,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBAED,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBACzC,MAAM,MAAM,CAAC,MAAM,CAAC;wBAClB,IAAI,EAAE,sBAAsB;wBAC5B,UAAU,EAAE,GAAG,EAAE;wBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;wBACpB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3D,MAAM,EAAE,iBAAiB;wBACzB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;oBACH,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/lib/runtime/index.d.ts

@@ -0,0 +1,4 @@
+export * from './auth-module.js';
+export * from './auth-strategy-registry.js';
+export * from './authorization-policy-registry.js';
+export * from './create-auth-middleware.js';

package/lib/runtime/index.js

@@ -0,0 +1,5 @@
+export * from './auth-module.js';
+export * from './auth-strategy-registry.js';
+export * from './authorization-policy-registry.js';
+export * from './create-auth-middleware.js';
+//# sourceMappingURL=index.js.map

package/lib/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oCAAoC,CAAC;AACnD,cAAc,6BAA6B,CAAC"}

package/lib/strategies/api-key/api-key-strategy.d.ts

@@ -0,0 +1,22 @@
+import type { HttpRequest } from '@kurdel/common';
+import type { AuthenticationResult, AuthStrategy } from '../../domain/index.js';
+import type { ApiKeyRepository, ApiKeyUsageRecorder, AuthUserRepository } from '../../repositories/index.js';
+export interface ApiKeyStrategyOptions {
+    /** Name of the request header containing the API key. */
+    header: string;
+    /** Credential metadata source. It does not provide authorization data. */
+    credentials: ApiKeyRepository;
+    /** Source of truth for the current user and their authorization roles. */
+    users: AuthUserRepository;
+    /** Optional sink for recording successful credential usage. */
+    usage?: ApiKeyUsageRecorder;
+    /** Injectable clock keeps expiration behavior deterministic in tests. */
+    now?: () => Date;
+}
+/** Authenticates an API key and resolves its current application identity. */
+export declare class ApiKeyStrategy implements AuthStrategy {
+    private readonly options;
+    constructor(options: ApiKeyStrategyOptions);
+    authenticate(req: HttpRequest): Promise<AuthenticationResult | null>;
+    private now;
+}

package/lib/strategies/api-key/api-key-strategy.js

@@ -0,0 +1,36 @@
+/** Authenticates an API key and resolves its current application identity. */
+export class ApiKeyStrategy {
+    constructor(options) {
+        this.options = options;
+    }
+    async authenticate(req) {
+        const raw = req.headers?.[this.options.header.toLowerCase()];
+        const key = Array.isArray(raw) ? raw[0] : raw;
+        if (!key || typeof key !== 'string')
+            return null;
+        const credential = await this.options.credentials.findByKey(key);
+        if (!credential || credential.revoked)
+            return null;
+        const authenticatedAt = this.now();
+        if (credential.expiresAt && credential.expiresAt.getTime() <= authenticatedAt.getTime()) {
+            return null;
+        }
+        const user = await this.options.users.findById(credential.userId);
+        if (!user)
+            return null;
+        if (credential.id) {
+            await this.options.usage?.recordUsage(credential.id, authenticatedAt);
+        }
+        return {
+            user,
+            credential: {
+                type: 'api-key',
+                ...(credential.id ? { id: credential.id } : {}),
+            },
+        };
+    }
+    now() {
+        return this.options.now?.() ?? new Date();
+    }
+}
+//# sourceMappingURL=api-key-strategy.js.map

package/lib/strategies/api-key/api-key-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-strategy.js","sourceRoot":"","sources":["../../../src/strategies/api-key/api-key-strategy.ts"],"names":[],"mappings":"AAsBA,8EAA8E;AAC9E,MAAM,OAAO,cAAc;IACzB,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;IAAG,CAAC;IAE/D,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;QACxE,CAAC;QAED,OAAO;YACL,IAAI;YACJ,UAAU,EAAE;gBACV,IAAI,EAAE,SAAS;gBACf,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/lib/strategies/api-key/index.d.ts

@@ -0,0 +1 @@
+export * from './api-key-strategy.js';

package/lib/strategies/api-key/index.js

@@ -0,0 +1,2 @@
+export * from './api-key-strategy.js';
+//# sourceMappingURL=index.js.map

package/lib/strategies/api-key/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/strategies/api-key/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA"}

package/lib/strategies/index.d.ts

@@ -0,0 +1,2 @@
+export * from './api-key/index.js';
+export * from './jwt/index.js';

package/lib/strategies/index.js

@@ -0,0 +1,3 @@
+export * from './api-key/index.js';
+export * from './jwt/index.js';
+//# sourceMappingURL=index.js.map

package/lib/strategies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA"}

package/lib/strategies/jwt/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jwt-service.js';
+export * from './jwt-strategy.js';

package/lib/strategies/jwt/index.js

@@ -0,0 +1,3 @@
+export * from './jwt-service.js';
+export * from './jwt-strategy.js';
+//# sourceMappingURL=index.js.map

package/lib/strategies/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/strategies/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/lib/strategies/jwt/jwt-service.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ## JwtPayload
+ * Standard JWT claims plus application-level fields.
+ */
+export interface JwtPayload {
+    sub: string | number;
+    roles: string[];
+    iat?: number;
+    exp?: number;
+    nbf?: number;
+    iss?: string;
+    aud?: string;
+    [key: string]: unknown;
+}
+/**
+ * ## JwtServiceOptions
+ * The minimal configuration required to sign and verify JWT tokens.
+ */
+export interface JwtServiceOptions {
+    secret: string;
+    issuer?: string;
+    audience?: string;
+    expiresIn?: number;
+}
+/**
+ * ## JwtService
+ *
+ * Lightweight JWT (HS256) implementation with zero dependencies.
+ * Provides signing, decoding and verification.
+ */
+export declare class JwtService {
+    private readonly opts;
+    constructor(opts: JwtServiceOptions);
+    /**
+     * Signs a new JWT token with the configured HS256 secret.
+     */
+    sign(payload: Omit<JwtPayload, 'iat' | 'exp'>): string;
+    /**
+     * Decodes the payload **without validating the signature**.
+     * Useful for debugging or optional preview.
+     */
+    decode(token: string): JwtPayload | null;
+    /**
+     * Verifies signature + exp/nbf/iss/aud constraints.
+     * Returns the decoded payload or throws an Error.
+     */
+    verify(token: string): JwtPayload;
+    private b64;
+    private signSegment;
+}