@kurdel/auth 0.1.0-beta.1

package/lib/strategies/jwt/jwt-service.js

@@ -0,0 +1,87 @@
+import crypto from 'node:crypto';
+/**
+ * ## JwtService
+ *
+ * Lightweight JWT (HS256) implementation with zero dependencies.
+ * Provides signing, decoding and verification.
+ */
+export class JwtService {
+    constructor(opts) {
+        this.opts = opts;
+    }
+    /**
+     * Signs a new JWT token with the configured HS256 secret.
+     */
+    sign(payload) {
+        const header = { alg: 'HS256', typ: 'JWT' };
+        const iat = Math.floor(Date.now() / 1000);
+        const exp = this.opts.expiresIn ? iat + this.opts.expiresIn : undefined;
+        const fullPayload = {
+            ...payload,
+            iat,
+            exp,
+            iss: this.opts.issuer,
+            aud: this.opts.audience,
+        };
+        const encodedHeader = this.b64(JSON.stringify(header));
+        const encodedPayload = this.b64(JSON.stringify(fullPayload));
+        const signature = this.signSegment(`${encodedHeader}.${encodedPayload}`);
+        return `${encodedHeader}.${encodedPayload}.${signature}`;
+    }
+    /**
+     * Decodes the payload **without validating the signature**.
+     * Useful for debugging or optional preview.
+     */
+    decode(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return null;
+        try {
+            return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Verifies signature + exp/nbf/iss/aud constraints.
+     * Returns the decoded payload or throws an Error.
+     */
+    verify(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid token format');
+        }
+        const [headerB64, payloadB64, signature] = parts;
+        const computedSign = this.signSegment(`${headerB64}.${payloadB64}`);
+        if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(computedSign))) {
+            throw new Error('Invalid token signature');
+        }
+        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString());
+        const now = Math.floor(Date.now() / 1000);
+        if (payload.exp && now >= payload.exp) {
+            throw new Error('Token expired');
+        }
+        if (payload.nbf && now < payload.nbf) {
+            throw new Error('Token not yet valid');
+        }
+        if (this.opts.issuer && payload.iss !== this.opts.issuer) {
+            throw new Error('Invalid issuer');
+        }
+        if (this.opts.audience && payload.aud !== this.opts.audience) {
+            throw new Error('Invalid audience');
+        }
+        return payload;
+    }
+    // ─────────────────────────────────────────────
+    b64(str) {
+        return Buffer.from(str).toString('base64url');
+    }
+    signSegment(data) {
+        return crypto
+            .createHmac('sha256', this.opts.secret)
+            .update(data)
+            .digest('base64url');
+    }
+}
+//# sourceMappingURL=jwt-service.js.map

package/lib/strategies/jwt/jwt-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-service.js","sourceRoot":"","sources":["../../../src/strategies/jwt/jwt-service.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAqCjC;;;;;GAKG;AACH,MAAM,OAAO,UAAU;IACrB,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD;;OAEG;IACH,IAAI,CAAC,OAAwC;QAC3C,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAEvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAExE,MAAM,WAAW,GAAG;YAClB,GAAG,OAAO;YACV,GAAG;YACH,GAAG;YACH,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM;YACrB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;SACV,CAAC;QAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,CAAC,CAAC;QAEzE,OAAO,GAAG,aAAa,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAe,CAAC;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gDAAgD;IAExC,GAAG,CAAC,GAAW;QACrB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAEO,WAAW,CAAC,IAAY;QAC9B,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;aACtC,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF"}

package/lib/strategies/jwt/jwt-strategy.d.ts

@@ -0,0 +1,27 @@
+import type { HttpRequest } from '@kurdel/common';
+import type { AuthenticationResult, AuthStrategy } from '../../domain/index.js';
+import type { AuthUserRepository } from '../../repositories/index.js';
+import type { JwtService } from '../../strategies/index.js';
+/**
+ * ## JwtStrategyOptions
+ *
+ * Configures how the strategy extracts and validates JWT tokens.
+ */
+export interface JwtStrategyOptions {
+    header?: string;
+    prefix?: string;
+}
+/**
+ * ## JwtStrategy
+ *
+ * Authentication strategy that validates a JWT token from
+ * the HttpRequest and returns an AuthUser.
+ */
+export declare class JwtStrategy implements AuthStrategy {
+    private readonly service;
+    private readonly users;
+    private readonly header;
+    private readonly prefix;
+    constructor(service: JwtService, users: AuthUserRepository, opts?: JwtStrategyOptions);
+    authenticate(req: HttpRequest): Promise<AuthenticationResult | null>;
+}

package/lib/strategies/jwt/jwt-strategy.js

@@ -0,0 +1,45 @@
+/**
+ * ## JwtStrategy
+ *
+ * Authentication strategy that validates a JWT token from
+ * the HttpRequest and returns an AuthUser.
+ */
+export class JwtStrategy {
+    constructor(service, users, opts = {}) {
+        this.service = service;
+        this.users = users;
+        this.header = (opts.header ?? 'authorization').toLowerCase();
+        this.prefix = (opts.prefix ?? 'Bearer').toLowerCase();
+    }
+    async authenticate(req) {
+        const raw = req.headers?.[this.header];
+        if (!raw)
+            return null;
+        const str = Array.isArray(raw) ? raw[0] : raw;
+        const value = typeof str === 'string' ? str.trim() : '';
+        if (!value.toLowerCase().startsWith(this.prefix.toLowerCase())) {
+            return null;
+        }
+        const token = value.slice(this.prefix.length).trim();
+        try {
+            const payload = this.service.verify(token);
+            if (!payload.sub)
+                return null;
+            const user = await this.users.findById(payload.sub);
+            if (!user)
+                return null;
+            return {
+                user,
+                credential: {
+                    type: 'jwt',
+                    ...(typeof payload.jti === 'string' ? { id: payload.jti } : {}),
+                },
+                claims: payload,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=jwt-strategy.js.map

package/lib/strategies/jwt/jwt-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-strategy.js","sourceRoot":"","sources":["../../../src/strategies/jwt/jwt-strategy.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAItB,YACmB,OAAmB,EACnB,KAAyB,EAC1C,OAA2B,EAAE;QAFZ,YAAO,GAAP,OAAO,CAAY;QACnB,UAAK,GAAL,KAAK,CAAoB;QAG1C,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAExD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAE3C,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE;oBACV,IAAI,EAAE,KAAK;oBACX,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChE;gBACD,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/lib/tokens.d.ts

@@ -0,0 +1,11 @@
+export declare const AUTH_TOKENS: {
+    StrategyRegistry: symbol;
+    PolicyRegistry: symbol;
+    EventSink: symbol;
+    UserRepository: symbol;
+    /** @deprecated Use UserRepository. */
+    JwtRepository: symbol;
+    ApiKeyRepository: symbol;
+    ApiKeyUsageRecorder: symbol;
+    JwtService: symbol;
+};

package/lib/tokens.js

@@ -0,0 +1,13 @@
+const UserRepository = Symbol('AuthUserRepository');
+export const AUTH_TOKENS = {
+    StrategyRegistry: Symbol('AuthStrategyRegistry'),
+    PolicyRegistry: Symbol('AuthorizationPolicyRegistry'),
+    EventSink: Symbol('AuthEventSink'),
+    UserRepository,
+    /** @deprecated Use UserRepository. */
+    JwtRepository: UserRepository,
+    ApiKeyRepository: Symbol('ApiKeyRepository'),
+    ApiKeyUsageRecorder: Symbol('ApiKeyUsageRecorder'),
+    JwtService: Symbol('JwtService'),
+};
+//# sourceMappingURL=tokens.js.map

package/lib/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,gBAAgB,EAAE,MAAM,CAAC,sBAAsB,CAAC;IAChD,cAAc,EAAE,MAAM,CAAC,6BAA6B,CAAC;IACrD,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC;IAClC,cAAc;IACd,sCAAsC;IACtC,aAAa,EAAE,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC,kBAAkB,CAAC;IAC5C,mBAAmB,EAAE,MAAM,CAAC,qBAAqB,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC;CACjC,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@kurdel/auth",
+  "version": "0.1.0-beta.1",
+  "description": "Authentication and authorization primitives for Kurdel applications",
+  "type": "module",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "files": [
+    "lib"
+  ],
+  "scripts": {
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
+    "clean": "rimraf lib ../../.cache/tsconfig.auth.build.tsbuildinfo",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
+    "build:force": "npm run clean && tsc -p tsconfig.build.json --force && tsc-alias -p tsconfig.build.json"
+  },
+  "keywords": [
+    "kurdel",
+    "authentication",
+    "authorization",
+    "framework"
+  ],
+  "author": "Andrii Sorokin",
+  "license": "MIT",
+  "engines": {
+    "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ignorantic/kurdel.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/ignorantic/kurdel/tree/main/packages/auth#readme",
+  "bugs": {
+    "url": "https://github.com/ignorantic/kurdel/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "beta"
+  },
+  "devDependencies": {
+    "rimraf": "^6.0.1",
+    "tsc-alias": "^1.8.16"
+  },
+  "dependencies": {
+    "@kurdel/common": "0.1.0-beta.1",
+    "@kurdel/core": "0.1.0-beta.1",
+    "@kurdel/ioc": "0.1.0-beta.1"
+  }
+}