@memberjunction/auth-providers 0.0.1 → 5.17.0

package/src/IAuthProvider.ts

@@ -0,0 +1,54 @@
+import { JwtHeader, JwtPayload, SigningKeyCallback } from 'jsonwebtoken';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+
+/**
+ * Interface for authentication providers in MemberJunction
+ * Enables support for any OAuth 2.0/OIDC compliant provider
+ */
+export interface IAuthProvider {
+  /**
+   * Unique name identifier for this provider
+   */
+  name: string;
+
+  /**
+   * The issuer URL for this provider (must match the 'iss' claim in tokens)
+   */
+  issuer: string;
+
+  /**
+   * The expected audience for tokens from this provider
+   */
+  audience: string;
+
+  /**
+   * The JWKS endpoint URL for retrieving signing keys
+   */
+  jwksUri: string;
+
+  /**
+   * OAuth client ID for this provider (optional, used by OAuth proxy for upstream authentication)
+   */
+  clientId?: string;
+
+  /**
+   * Validates that the provider configuration is complete and valid
+   */
+  validateConfig(): boolean;
+
+  /**
+   * Gets the signing key for token verification
+   */
+  getSigningKey(header: JwtHeader, callback: SigningKeyCallback): void;
+
+  /**
+   * Extracts user information from the JWT payload
+   * Different providers use different claim names
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo;
+
+  /**
+   * Checks if a given issuer URL belongs to this provider
+   */
+  matchesIssuer(issuer: string): boolean;
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+export { IAuthProvider } from './IAuthProvider.js';
+export { BaseAuthProvider } from './BaseAuthProvider.js';
+export { AuthProviderFactory } from './AuthProviderFactory.js';
+export { TokenExpiredError } from './tokenExpiredError.js';
+
+// Re-export types consumers commonly need alongside the auth providers
+export type { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';

package/src/providers/Auth0Provider.ts

@@ -0,0 +1,45 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+/**
+ * Auth0 authentication provider implementation
+ */
+@RegisterClass(BaseAuthProvider, 'auth0')
+export class Auth0Provider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from Auth0 JWT payload
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    // Auth0 uses standard OIDC claims
+    const email = payload.email as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    const preferredUsername = payload.preferred_username as string | undefined || email;
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername
+    };
+  }
+
+  /**
+   * Validates Auth0-specific configuration
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+    const hasDomain = !!this.config.domain;
+    
+    return baseValid && hasClientId && hasDomain;
+  }
+}

package/src/providers/CognitoProvider.ts

@@ -0,0 +1,50 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+
+/**
+ * AWS Cognito authentication provider implementation
+ */
+@RegisterClass(BaseAuthProvider, 'cognito')
+export class CognitoProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from Cognito JWT payload
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    // Cognito uses custom claims with 'cognito:' prefix for some fields
+    const email = payload.email as string | undefined || 
+                  payload['cognito:username'] as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    const preferredUsername = payload['cognito:username'] as string | undefined || 
+                             payload.preferred_username as string | undefined || 
+                             email;
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername
+    };
+  }
+
+  /**
+   * Validates Cognito-specific configuration
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+    const hasRegion = !!this.config.region;
+    const hasUserPoolId = !!this.config.userPoolId;
+    
+    return baseValid && hasClientId && hasRegion && hasUserPoolId;
+  }
+}

package/src/providers/GoogleProvider.ts

@@ -0,0 +1,45 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+
+/**
+ * Google Identity Platform authentication provider implementation
+ */
+@RegisterClass(BaseAuthProvider, 'google')
+export class GoogleProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from Google JWT payload
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    // Google uses standard OIDC claims
+    const email = payload.email as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    const preferredUsername = email; // Google typically uses email as username
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername
+    };
+  }
+
+  /**
+   * Validates Google-specific configuration
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+    
+    return baseValid && hasClientId;
+  }
+}

package/src/providers/MSALProvider.ts

@@ -0,0 +1,45 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+/**
+ * Microsoft Authentication Library (MSAL) provider implementation
+ */
+@RegisterClass(BaseAuthProvider, 'msal')
+export class MSALProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from MSAL/Azure AD JWT payload
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    // MSAL/Azure AD uses some custom claims
+    const email = payload.email as string | undefined || payload.preferred_username as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    const preferredUsername = payload.preferred_username as string | undefined;
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername
+    };
+  }
+
+  /**
+   * Validates MSAL-specific configuration
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+    const hasTenantId = !!this.config.tenantId;
+    
+    return baseValid && hasClientId && hasTenantId;
+  }
+}

package/src/providers/OktaProvider.ts

@@ -0,0 +1,46 @@
+import { JwtPayload } from 'jsonwebtoken';
+import { RegisterClass } from '@memberjunction/global';
+import { AuthProviderConfig, AuthUserInfo } from '@memberjunction/core';
+import { BaseAuthProvider } from '../BaseAuthProvider.js';
+
+
+/**
+ * Okta authentication provider implementation
+ */
+@RegisterClass(BaseAuthProvider, 'okta')
+export class OktaProvider extends BaseAuthProvider {
+  constructor(config: AuthProviderConfig) {
+    super(config);
+  }
+
+  /**
+   * Extracts user information from Okta JWT payload
+   */
+  extractUserInfo(payload: JwtPayload): AuthUserInfo {
+    // Okta uses standard OIDC claims plus some custom ones
+    const email = payload.email as string | undefined || payload.preferred_username as string | undefined;
+    const fullName = payload.name as string | undefined;
+    const firstName = payload.given_name as string | undefined;
+    const lastName = payload.family_name as string | undefined;
+    const preferredUsername = payload.preferred_username as string | undefined || email;
+
+    return {
+      email,
+      firstName: firstName || fullName?.split(' ')[0],
+      lastName: lastName || fullName?.split(' ')[1] || fullName?.split(' ')[0],
+      fullName,
+      preferredUsername
+    };
+  }
+
+  /**
+   * Validates Okta-specific configuration
+   */
+  validateConfig(): boolean {
+    const baseValid = super.validateConfig();
+    const hasClientId = !!this.config.clientId;
+    const hasDomain = !!this.config.domain;
+    
+    return baseValid && hasClientId && hasDomain;
+  }
+}

package/src/tokenExpiredError.ts

@@ -0,0 +1,12 @@
+import { GraphQLError } from 'graphql';
+
+export class TokenExpiredError extends GraphQLError {
+  constructor(expiryDate: Date, message = 'The provided token has expired. Please authenticate again.') {
+    super(message, {
+      extensions: {
+        code: 'JWT_EXPIRED',
+        expiryDate: expiryDate.toISOString(),
+      },
+    });
+  }
+}

package/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.server.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src",
+    "module": "es2022"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "src/__tests__/**", "src/**/*.test.ts", "src/**/*.spec.ts", "vitest.config.ts"]
+}

package/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineProject, mergeConfig } from 'vitest/config';
+import sharedConfig from '../../vitest.shared';
+
+export default mergeConfig(
+  sharedConfig,
+  defineProject({
+    test: {
+      environment: 'node',
+    },
+  })
+);

package/README.md

@@ -1,45 +0,0 @@
-# @memberjunction/auth-providers
-
-## ⚠️ IMPORTANT NOTICE ⚠️
-
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
-
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
-
-## Purpose
-
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@memberjunction/auth-providers`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
-
-## What is OIDC Trusted Publishing?
-
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
-
-## Setup Instructions
-
-To properly configure OIDC trusted publishing for this package:
-
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**