@naylence/runtime 0.3.3 → 0.3.5-test.0

package/dist/esm/src/naylence/fame/security/auth/oauth2-authorizer-factory.js

@@ -0,0 +1,159 @@
+import { DEFAULT_JWKS_CACHE_TTL_SEC, DEFAULT_OAUTH2_TTL_SEC, MAX_OAUTH2_TTL_SEC, DEFAULT_REVERSE_AUTH_TTL_SEC, } from '../../constants/ttl-constants.js';
+import { getLogger } from '../../util/logging.js';
+import { safeImport } from '../../util/lazy-import.js';
+import { validateOAuth2TtlSec } from '../../util/ttl-validation.js';
+import { AUTHORIZER_FACTORY_BASE_TYPE, AuthorizerFactory, } from './authorizer-factory.js';
+import { TokenIssuerFactory, } from './token-issuer-factory.js';
+import { TokenVerifierFactory, } from './token-verifier-factory.js';
+const logger = getLogger('naylence.fame.security.auth.oauth2_authorizer_factory');
+let oauth2AuthorizerModulePromise = null;
+function getOAuth2AuthorizerModule() {
+    if (!oauth2AuthorizerModulePromise) {
+        oauth2AuthorizerModulePromise = safeImport(() => import('./oauth2-authorizer.js'), 'oauth2-authorizer');
+    }
+    return oauth2AuthorizerModulePromise;
+}
+export const FACTORY_META = {
+    base: AUTHORIZER_FACTORY_BASE_TYPE,
+    key: 'OAuth2Authorizer',
+};
+export class OAuth2AuthorizerFactory extends AuthorizerFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'OAuth2Authorizer';
+    }
+    async create(config) {
+        if (!config) {
+            throw new Error('OAuth2Authorizer requires configuration');
+        }
+        const normalized = normalizeConfig(config);
+        const tokenVerifier = await TokenVerifierFactory.createTokenVerifier(normalized.tokenVerifierConfig);
+        let tokenIssuer;
+        if (normalized.tokenIssuerConfig) {
+            try {
+                tokenIssuer = await TokenIssuerFactory.createTokenIssuer(normalized.tokenIssuerConfig);
+                logger.debug('token_issuer_created_for_reverse_auth', {
+                    issuer_type: normalized.tokenIssuerConfig.type,
+                });
+            }
+            catch (error) {
+                logger.warning('failed_to_create_token_issuer_for_reverse_auth', {
+                    error: error instanceof Error ? error.message : String(error),
+                    issuer_config: normalized.tokenIssuerConfig,
+                });
+            }
+        }
+        const authorizerOptions = {
+            tokenVerifier,
+            requiredScopes: normalized.requiredScopes,
+            requireScope: normalized.requireScope,
+            defaultTtlSec: normalized.defaultTtlSec,
+            maxTtlSec: normalized.maxTtlSec,
+            reverseAuthTtlSec: normalized.reverseAuthTtlSec,
+        };
+        if (tokenIssuer) {
+            authorizerOptions.tokenIssuer = tokenIssuer;
+        }
+        if (normalized.audience) {
+            authorizerOptions.audience = normalized.audience;
+        }
+        const { OAuth2Authorizer } = await getOAuth2AuthorizerModule();
+        return new OAuth2Authorizer(authorizerOptions);
+    }
+}
+function normalizeConfig(config) {
+    const source = config;
+    const issuer = typeof source.issuer === 'string' && source.issuer.trim().length > 0
+        ? source.issuer.trim()
+        : undefined;
+    if (!issuer) {
+        throw new Error('OAuth2Authorizer configuration requires "issuer"');
+    }
+    const audienceCandidate = source.audience ?? source.aud;
+    const audienceRaw = typeof audienceCandidate === 'string' ? audienceCandidate : null;
+    const audience = audienceRaw && audienceRaw.trim().length > 0
+        ? audienceRaw.trim()
+        : undefined;
+    const jwksUrlRaw = source.jwksUrl ?? source.jwks_url;
+    let jwksUrl = typeof jwksUrlRaw === 'string' && jwksUrlRaw.trim().length > 0
+        ? jwksUrlRaw.trim()
+        : undefined;
+    if (!jwksUrl) {
+        const trimmedIssuer = issuer.replace(/\/+$/, '');
+        jwksUrl = `${trimmedIssuer}/.well-known/jwks.json`;
+    }
+    const algorithm = typeof source.algorithm === 'string' && source.algorithm.trim().length > 0
+        ? source.algorithm.trim()
+        : 'RS256';
+    const requiredScopesSource = source.requiredScopes ?? source.required_scopes ?? [];
+    const requiredScopes = Array.isArray(requiredScopesSource)
+        ? requiredScopesSource
+            .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+            .filter((scope) => scope.length > 0)
+        : [];
+    const requireScope = typeof source.requireScope === 'boolean'
+        ? source.requireScope
+        : typeof source.require_scope === 'boolean'
+            ? source.require_scope
+            : true;
+    const defaultTtlCandidate = typeof source.defaultTtlSec === 'number'
+        ? source.defaultTtlSec
+        : typeof source.default_ttl_sec === 'number'
+            ? source.default_ttl_sec
+            : DEFAULT_OAUTH2_TTL_SEC;
+    const validatedDefaultTtl = validateOAuth2TtlSec(defaultTtlCandidate);
+    const defaultTtlSec = typeof validatedDefaultTtl === 'number'
+        ? validatedDefaultTtl
+        : defaultTtlCandidate;
+    const maxTtlCandidate = typeof source.maxTtlSec === 'number'
+        ? source.maxTtlSec
+        : typeof source.max_ttl_sec === 'number'
+            ? source.max_ttl_sec
+            : MAX_OAUTH2_TTL_SEC;
+    const validatedMaxTtl = validateOAuth2TtlSec(maxTtlCandidate);
+    const maxTtlSec = typeof validatedMaxTtl === 'number' ? validatedMaxTtl : maxTtlCandidate;
+    const reverseAuthCandidate = typeof source.reverseAuthTtlSec === 'number'
+        ? source.reverseAuthTtlSec
+        : typeof source.reverse_auth_ttl_sec === 'number'
+            ? source.reverse_auth_ttl_sec
+            : DEFAULT_REVERSE_AUTH_TTL_SEC;
+    const tokenVerifierConfigInput = source.tokenVerifierConfig ?? source.token_verifier_config ?? null;
+    const tokenVerifierConfig = normalizeTokenVerifierConfig({
+        config: tokenVerifierConfigInput,
+        issuer,
+        jwksUrl,
+        algorithm,
+    });
+    const tokenIssuerConfig = source.tokenIssuerConfig ?? source.token_issuer_config ?? undefined;
+    const normalized = {
+        issuer,
+        jwksUrl,
+        algorithm,
+        requiredScopes,
+        requireScope,
+        defaultTtlSec,
+        maxTtlSec,
+        tokenVerifierConfig,
+        reverseAuthTtlSec: reverseAuthCandidate,
+        ...(audience ? { audience } : {}),
+    };
+    if (tokenIssuerConfig) {
+        normalized.tokenIssuerConfig = tokenIssuerConfig;
+    }
+    return normalized;
+}
+function normalizeTokenVerifierConfig({ config, issuer, jwksUrl, algorithm, }) {
+    if (config) {
+        return config;
+    }
+    const defaultConfig = {
+        type: 'JWKSJWTTokenVerifier',
+        issuer,
+        jwksUrl,
+        cacheTtlSec: DEFAULT_JWKS_CACHE_TTL_SEC,
+        algorithms: [algorithm],
+    };
+    return defaultConfig;
+}
+export default OAuth2AuthorizerFactory;
+//# sourceMappingURL=oauth2-authorizer-factory.js.map

package/dist/esm/src/naylence/fame/security/auth/oauth2-authorizer-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-authorizer-factory.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/oauth2-authorizer-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EACL,4BAA4B,EAC5B,iBAAiB,GAElB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAIrC,MAAM,MAAM,GAAG,SAAS,CACtB,uDAAuD,CACxD,CAAC;AAIF,IAAI,6BAA6B,GAC/B,IAAI,CAAC;AACP,SAAS,yBAAyB;IAChC,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,6BAA6B,GAAG,UAAU,CACxC,GAAG,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,EACtC,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,OAAO,6BAA6B,CAAC;AACvC,CAAC;AAuCD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,4BAA4B;IAClC,GAAG,EAAE,kBAAkB;CACf,CAAC;AAEX,MAAM,OAAO,uBAAwB,SAAQ,iBAAyC;IAAtF;;QACkB,SAAI,GAAG,kBAAkB,CAAC;IAqD5C,CAAC;IAnDQ,KAAK,CAAC,MAAM,CACjB,MAAgE;QAEhE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE3C,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,mBAAmB,CAClE,UAAU,CAAC,mBAAmB,CAC/B,CAAC;QAEF,IAAI,WAAoC,CAAC;QACzC,IAAI,UAAU,CAAC,iBAAiB,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,iBAAiB,CACtD,UAAU,CAAC,iBAAiB,CAC7B,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBACpD,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,IAAI;iBAC/C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,OAAO,CAAC,gDAAgD,EAAE;oBAC/D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7D,aAAa,EAAE,UAAU,CAAC,iBAAiB;iBAC5C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,iBAAiB,GAA4B;YACjD,aAAa;YACb,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;SAChD,CAAC;QAEF,IAAI,WAAW,EAAE,CAAC;YAChB,iBAAiB,CAAC,WAAW,GAAG,WAAW,CAAC;QAC9C,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,iBAAiB,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAE/D,OAAO,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;CACF;AAED,SAAS,eAAe,CACtB,MAAwD;IAExD,MAAM,MAAM,GAAG,MAA0D,CAAC;IAE1E,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,IAAK,MAAkC,CAAC,GAAG,CAAC;IAC7D,MAAM,WAAW,GACf,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,QAAQ,GACZ,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;QACpB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,IAAI,OAAO,GACT,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5D,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,GAAG,GAAG,aAAa,wBAAwB,CAAC;IACrD,CAAC;IAED,MAAM,SAAS,GACb,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACxE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;QACzB,CAAC,CAAC,OAAO,CAAC;IAEd,MAAM,oBAAoB,GACxB,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IACxD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxD,CAAC,CAAC,oBAAoB;aACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS;QACtC,CAAC,CAAC,MAAM,CAAC,YAAY;QACrB,CAAC,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,SAAS;YACzC,CAAC,CAAC,MAAM,CAAC,aAAa;YACtB,CAAC,CAAC,IAAI,CAAC;IAEb,MAAM,mBAAmB,GACvB,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACtC,CAAC,CAAC,MAAM,CAAC,aAAa;QACtB,CAAC,CAAC,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;YAC1C,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,sBAAsB,CAAC;IAE/B,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,aAAa,GACjB,OAAO,mBAAmB,KAAK,QAAQ;QACrC,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,mBAAmB,CAAC;IAE1B,MAAM,eAAe,GACnB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QAClC,CAAC,CAAC,MAAM,CAAC,SAAS;QAClB,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,CAAC,MAAM,CAAC,WAAW;YACpB,CAAC,CAAC,kBAAkB,CAAC;IAE3B,MAAM,eAAe,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,SAAS,GACb,OAAO,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;IAE1E,MAAM,oBAAoB,GACxB,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;QAC1C,CAAC,CAAC,MAAM,CAAC,iBAAiB;QAC1B,CAAC,CAAC,OAAO,MAAM,CAAC,oBAAoB,KAAK,QAAQ;YAC/C,CAAC,CAAC,MAAM,CAAC,oBAAoB;YAC7B,CAAC,CAAC,4BAA4B,CAAC;IAErC,MAAM,wBAAwB,GAC5B,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAErE,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;QACvD,MAAM,EAAE,wBAAwB;QAChC,MAAM;QACN,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,iBAAiB,GACrB,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAEtE,MAAM,UAAU,GAAqC;QACnD,MAAM;QACN,OAAO;QACP,SAAS;QACT,cAAc;QACd,YAAY;QACZ,aAAa;QACb,SAAS;QACT,mBAAmB;QACnB,iBAAiB,EAAE,oBAAoB;QACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IAEF,IAAI,iBAAiB,EAAE,CAAC;QACtB,UAAU,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IACnD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,4BAA4B,CAAC,EACpC,MAAM,EACN,MAAM,EACN,OAAO,EACP,SAAS,GAMV;IACC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAA+B;QAChD,IAAI,EAAE,sBAAsB;QAC5B,MAAM;QACN,OAAO;QACP,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,CAAC,SAAS,CAAC;KACxB,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,eAAe,uBAAuB,CAAC"}

package/dist/esm/src/naylence/fame/security/auth/oauth2-authorizer.js

@@ -0,0 +1,266 @@
+import { createAuthorizationContext } from '@naylence/core';
+import { DEFAULT_REVERSE_AUTH_TTL_SEC } from '../../constants/ttl-constants.js';
+import { getLogger } from '../../util/logging.js';
+const logger = getLogger('naylence.fame.security.auth.oauth2_authorizer');
+function normalizeOptions(raw) {
+    const camel = raw;
+    const snake = raw;
+    const tokenVerifier = camel.tokenVerifier ?? snake.token_verifier;
+    if (!tokenVerifier) {
+        throw new Error('OAuth2Authorizer requires a tokenVerifier');
+    }
+    const tokenIssuer = camel.tokenIssuer ?? snake.token_issuer;
+    const requiredScopes = camel.requiredScopes ??
+        (Array.isArray(snake.required_scopes)
+            ? snake.required_scopes
+            : undefined);
+    const requireScope = camel.requireScope ??
+        (typeof snake.require_scope === 'boolean'
+            ? snake.require_scope
+            : undefined);
+    const reverseAuthTtlSec = camel.reverseAuthTtlSec ??
+        (typeof snake.reverse_auth_ttl_sec === 'number'
+            ? snake.reverse_auth_ttl_sec
+            : undefined);
+    const defaultTtlSec = camel.defaultTtlSec ??
+        (typeof snake.default_ttl_sec === 'number'
+            ? snake.default_ttl_sec
+            : undefined);
+    const maxTtlSec = camel.maxTtlSec ??
+        (typeof snake.max_ttl_sec === 'number' ? snake.max_ttl_sec : undefined);
+    const audience = camel.audience ??
+        (typeof snake.audience === 'string'
+            ? snake.audience
+            : typeof snake.aud === 'string'
+                ? snake.aud
+                : undefined);
+    return {
+        tokenVerifier,
+        tokenIssuer,
+        audience,
+        requiredScopes,
+        requireScope,
+        defaultTtlSec,
+        maxTtlSec,
+        reverseAuthTtlSec,
+    };
+}
+export class OAuth2Authorizer {
+    constructor(rawOptions) {
+        this.priority = 1000;
+        const options = normalizeOptions(rawOptions);
+        this.tokenVerifierImpl = options.tokenVerifier;
+        this.tokenIssuer = options.tokenIssuer ?? undefined;
+        this.audience = options.audience ?? undefined;
+        this.requiredScopes = new Set((options.requiredScopes ?? []).filter((scope) => scope.trim().length > 0));
+        this.requireScope = options.requireScope ?? true;
+        this.reverseAuthTtlSec =
+            options.reverseAuthTtlSec ?? DEFAULT_REVERSE_AUTH_TTL_SEC;
+    }
+    get tokenVerifier() {
+        return this.tokenVerifierImpl;
+    }
+    async onNodeStarted(node) {
+        this.node = node;
+    }
+    async authenticate(credentials) {
+        const token = this.normalizeBearerToken(credentials);
+        if (!token) {
+            logger.debug('oauth2_authenticate_missing_token');
+            return undefined;
+        }
+        try {
+            const expectedAudience = this.audience ?? this.node?.physicalPath;
+            logger.debug('oauth2_authenticate_start', {
+                expected_audience: expectedAudience,
+            });
+            const context = expectedAudience !== undefined
+                ? await this.tokenVerifierImpl.verify(token, { expectedAudience })
+                : await this.tokenVerifierImpl.verify(token);
+            const claims = { ...(context.claims ?? {}) };
+            const scopes = this.extractScopes(claims);
+            const grantedScopes = this.mergeScopes(context.grantedScopes ?? [], scopes);
+            if (this.requireScope &&
+                this.requiredScopes.size > 0 &&
+                !this.hasRequiredScope(grantedScopes)) {
+                logger.warning('oauth2_token_missing_required_scope', {
+                    required_scopes: Array.from(this.requiredScopes),
+                    token_scopes: Array.from(scopes),
+                });
+                return undefined;
+            }
+            const normalized = createAuthorizationContext({
+                ...context,
+                authenticated: true,
+                authorized: context.authorized ?? true,
+                claims,
+                grantedScopes,
+                authMethod: context.authMethod ?? 'oauth2_jwt',
+            });
+            logger.debug('oauth2_authenticate_success', {
+                granted_scopes: Array.from(grantedScopes),
+            });
+            return normalized;
+        }
+        catch (error) {
+            logger.warning('oauth2_token_verification_failed', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    async authorize(_node, _envelope, context) {
+        const security = context?.security;
+        const authorization = security?.authorization;
+        if (!authorization) {
+            return undefined;
+        }
+        // Early return if already authorized (matches Python behavior)
+        // This skips scope checking for reverse auth contexts
+        if (authorization.authorized) {
+            return authorization;
+        }
+        const grantedScopes = new Set(authorization.grantedScopes ?? []);
+        if (this.requireScope &&
+            this.requiredScopes.size > 0 &&
+            !this.hasRequiredScope(grantedScopes)) {
+            return undefined;
+        }
+        return createAuthorizationContext({
+            ...authorization,
+            authorized: true,
+        });
+    }
+    async createReverseAuthorizationConfig(node) {
+        if (!this.tokenIssuer) {
+            return undefined;
+        }
+        const expiresAt = new Date(Date.now() + this.reverseAuthTtlSec * 1000);
+        try {
+            const token = await this.tokenIssuer.issue({
+                iss: this.tokenIssuer.issuer,
+                aud: this.audience ?? node.physicalPath,
+                exp: Math.floor(expiresAt.getTime() / 1000),
+                sub: `reverse-auth-${node.id}`,
+                instance_id: node.instanceId ?? null,
+                capabilities: Array.from(this.requiredScopes),
+            });
+            logger.debug('reverse_authorization_token_generated', {
+                node_id: node.id,
+                expires_at: expiresAt.toISOString(),
+                capabilities: Array.from(this.requiredScopes),
+            });
+            const staticTokenConfig = {
+                type: 'StaticTokenProvider',
+                token,
+                expiresAt,
+            };
+            const result = {
+                type: 'BearerTokenHeaderAuthInjectionStrategy',
+                tokenProvider: staticTokenConfig,
+            };
+            return result;
+        }
+        catch (error) {
+            logger.warning('failed_to_generate_reverse_auth_token', {
+                node_id: node.id,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    async validateNodeAttachRequest(node, frame, authContext) {
+        if (!authContext || !authContext.authenticated) {
+            return undefined;
+        }
+        const claims = { ...(authContext.claims ?? {}) };
+        const scopes = this.extractScopes(claims);
+        const grantedScopes = this.mergeScopes(authContext.grantedScopes ?? [], scopes);
+        if (this.requireScope &&
+            this.requiredScopes.size > 0 &&
+            !this.hasRequiredScope(grantedScopes)) {
+            logger.warning('oauth2_attach_missing_required_scope', {
+                required_scopes: Array.from(this.requiredScopes),
+                token_scopes: Array.from(scopes),
+            });
+            return undefined;
+        }
+        claims.instance_id = claims.instance_id ?? frame.instanceId;
+        claims.assigned_path = claims.assigned_path ?? frame.assignedPath;
+        claims.accepted_capabilities =
+            frame.capabilities ?? claims.accepted_capabilities;
+        claims.accepted_logicals =
+            frame.acceptedLogicals ?? claims.accepted_logicals;
+        claims.aud = node.id;
+        claims.scopes = Array.from(scopes);
+        return createAuthorizationContext({
+            ...authContext,
+            claims,
+            principal: authContext.principal ??
+                (typeof claims.sub === 'string'
+                    ? claims.sub
+                    : frame.systemId),
+            grantedScopes,
+            authorized: true,
+            authMethod: authContext.authMethod ?? 'oauth2_jwt',
+        });
+    }
+    normalizeBearerToken(credentials) {
+        if (typeof credentials === 'string') {
+            const trimmed = credentials.trim();
+            if (trimmed.toLowerCase().startsWith('bearer ')) {
+                return trimmed.slice(7).trim();
+            }
+            return trimmed.length > 0 ? trimmed : undefined;
+        }
+        const decoded = new TextDecoder().decode(credentials);
+        return this.normalizeBearerToken(decoded);
+    }
+    extractScopes(claims) {
+        const scopes = new Set();
+        const add = (value) => {
+            if (typeof value === 'string') {
+                value
+                    .split(/[\s,]+/)
+                    .filter(Boolean)
+                    .forEach((scope) => scopes.add(scope));
+            }
+            else if (Array.isArray(value)) {
+                value
+                    .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+                    .filter(Boolean)
+                    .forEach((scope) => scopes.add(scope));
+            }
+        };
+        add(claims.scope);
+        add(claims.scopes);
+        const capabilities = claims.capabilities;
+        if (Array.isArray(capabilities)) {
+            capabilities
+                .map((scope) => (typeof scope === 'string' ? scope.trim() : ''))
+                .filter(Boolean)
+                .forEach((scope) => scopes.add(scope));
+        }
+        return scopes;
+    }
+    mergeScopes(existing, scopes) {
+        const merged = new Set(existing.filter((scope) => typeof scope === 'string'));
+        for (const scope of scopes) {
+            merged.add(scope);
+        }
+        return Array.from(merged);
+    }
+    hasRequiredScope(scopes) {
+        const candidate = scopes instanceof Set ? scopes : new Set(scopes);
+        if (this.requiredScopes.size === 0) {
+            return true;
+        }
+        for (const scope of this.requiredScopes) {
+            if (candidate.has(scope)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=oauth2-authorizer.js.map

package/dist/esm/src/naylence/fame/security/auth/oauth2-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-authorizer.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/oauth2-authorizer.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQlD,MAAM,MAAM,GAAG,SAAS,CAAC,+CAA+C,CAAC,CAAC;AAuC1E,SAAS,gBAAgB,CACvB,GAAsD;IAEtD,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,KAAK,GAAG,GAAuC,CAAC;IAEtD,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,IAAK,KAAK,CAAC,cAA4C,CAAC;IAE7E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GACf,KAAK,CAAC,WAAW,IAAK,KAAK,CAAC,YAAwC,CAAC;IACvE,MAAM,cAAc,GAClB,KAAK,CAAC,cAAc;QACpB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;YACnC,CAAC,CAAE,KAAK,CAAC,eAA4B;YACrC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,MAAM,YAAY,GAChB,KAAK,CAAC,YAAY;QAClB,CAAC,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS;YACvC,CAAC,CAAC,KAAK,CAAC,aAAa;YACrB,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,iBAAiB,GACrB,KAAK,CAAC,iBAAiB;QACvB,CAAC,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa;QACnB,CAAC,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;YACxC,CAAC,CAAC,KAAK,CAAC,eAAe;YACvB,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjB,MAAM,SAAS,GACb,KAAK,CAAC,SAAS;QACf,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE1E,MAAM,QAAQ,GACZ,KAAK,CAAC,QAAQ;QACd,CAAC,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;YACjC,CAAC,CAAC,KAAK,CAAC,QAAQ;YAChB,CAAC,CAAC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBAC7B,CAAC,CAAC,KAAK,CAAC,GAAG;gBACX,CAAC,CAAC,SAAS,CAAC,CAAC;IAEnB,OAAO;QACL,aAAa;QACb,WAAW;QACX,QAAQ;QACR,cAAc;QACd,YAAY;QACZ,aAAa;QACb,SAAS;QACT,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAa3B,YAAY,UAA6D;QAVzD,aAAQ,GAAG,IAAI,CAAC;QAW9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE7C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAC;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC9C,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAC3B,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAC1E,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,iBAAiB;YACpB,OAAO,CAAC,iBAAiB,IAAI,4BAA4B,CAAC;IAC9D,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAc;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,WAAgC;QAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAClE,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBACxC,iBAAiB,EAAE,gBAAgB;aACpC,CAAC,CAAC;YACH,MAAM,OAAO,GACX,gBAAgB,KAAK,SAAS;gBAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC;gBAClE,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAA6B,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CACpC,OAAO,CAAC,aAAa,IAAI,EAAE,EAC3B,MAAM,CACP,CAAC;YAEF,IACE,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC;gBAC5B,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EACrC,CAAC;gBACD,MAAM,CAAC,OAAO,CAAC,qCAAqC,EAAE;oBACpD,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;oBAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;iBACjC,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,0BAA0B,CAAC;gBAC5C,GAAG,OAAO;gBACV,aAAa,EAAE,IAAI;gBACnB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;gBACtC,MAAM;gBACN,aAAa;gBACb,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,YAAY;aAC/C,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC1C,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;aAC1C,CAAC,CAAC;YAEH,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE;gBACjD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAe,EACf,SAAuB,EACvB,OAA6B;QAE7B,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;QACnC,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,CAAC;QAC9C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,+DAA+D;QAC/D,sDAAsD;QACtD,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAEzE,IACE,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC;YAC5B,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EACrC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,0BAA0B,CAAC;YAChC,GAAG,aAAa;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gCAAgC,CACpC,IAAc;QAEd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;gBAC5B,GAAG,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY;gBACvC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;gBAC3C,GAAG,EAAE,gBAAgB,IAAI,CAAC,EAAE,EAAE;gBAC9B,WAAW,EACR,IAA2C,CAAC,UAAU,IAAI,IAAI;gBACjE,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;aAC9C,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;gBACpD,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;gBACnC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;aAC9C,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAA8B;gBACnD,IAAI,EAAE,qBAAqB;gBAC3B,KAAK;gBACL,SAAS;aACV,CAAC;YAEF,MAAM,MAAM,GAAiD;gBAC3D,IAAI,EAAE,wCAAwC;gBAC9C,aAAa,EAAE,iBAAiB;aACjC,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,uCAAuC,EAAE;gBACtD,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAc,EACd,KAAsB,EACtB,WAAkC;QAElC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC,EAA6B,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CACpC,WAAW,CAAC,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;QAEF,IACE,IAAI,CAAC,YAAY;YACjB,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC;YAC5B,CAAC,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EACrC,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE;gBACrD,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAChD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;aACjC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC;QAC5D,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC;QAClE,MAAM,CAAC,qBAAqB;YAC1B,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,qBAAqB,CAAC;QACrD,MAAM,CAAC,iBAAiB;YACtB,KAAK,CAAC,gBAAgB,IAAI,MAAM,CAAC,iBAAiB,CAAC;QACrD,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnC,OAAO,0BAA0B,CAAC;YAChC,GAAG,WAAW;YACd,MAAM;YACN,SAAS,EACP,WAAW,CAAC,SAAS;gBACrB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;oBAC7B,CAAC,CAAE,MAAM,CAAC,GAAc;oBACxB,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;YACrB,aAAa;YACb,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,WAAW,CAAC,UAAU,IAAI,YAAY;SACnD,CAAC,CAAC;IACL,CAAC;IAEO,oBAAoB,CAC1B,WAAgC;QAEhC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,MAA+B;QACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QAEjC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAQ,EAAE;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK;qBACF,KAAK,CAAC,QAAQ,CAAC;qBACf,MAAM,CAAC,OAAO,CAAC;qBACf,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,KAAK;qBACF,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;qBAC/D,MAAM,CAAC,OAAO,CAAC;qBACf,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;QAEF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEnB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,YAAY;iBACT,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC/D,MAAM,CAAC,OAAO,CAAC;iBACf,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,QAAkB,EAAE,MAAmB;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACtD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,gBAAgB,CAAC,MAA8B;QACrD,MAAM,SAAS,GAAG,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/esm/src/naylence/fame/security/auth/oauth2-client-credentials-token-provider-factory.js

@@ -0,0 +1,69 @@
+import { CredentialProviderFactory, } from '../credential/credential-provider-factory.js';
+import { normalizeSecretSource, } from '../credential/secret-source.js';
+import { safeImport } from '../../util/lazy-import.js';
+import { TOKEN_PROVIDER_FACTORY_BASE_TYPE, TokenProviderFactory, } from './token-provider-factory.js';
+let oauth2ClientCredentialsTokenProviderModulePromise = null;
+async function getOAuth2ClientCredentialsTokenProviderModule() {
+    if (!oauth2ClientCredentialsTokenProviderModulePromise) {
+        oauth2ClientCredentialsTokenProviderModulePromise = safeImport(() => import('./oauth2-client-credentials-token-provider.js'), 'oauth2-client-credentials-token-provider');
+    }
+    return oauth2ClientCredentialsTokenProviderModulePromise;
+}
+function normalizeConfig(config) {
+    if (!config) {
+        throw new Error('OAuth2ClientCredentialsTokenProvider requires configuration');
+    }
+    const candidate = config;
+    // Support both camelCase and snake_case for compatibility
+    const tokenUrl = candidate.tokenUrl ?? candidate.token_url;
+    if (typeof tokenUrl !== 'string' || tokenUrl.length === 0) {
+        throw new Error('OAuth2ClientCredentialsTokenProvider tokenUrl must be a non-empty string');
+    }
+    const clientIdSource = candidate.clientId ?? candidate.client_id;
+    const clientSecretSource = candidate.clientSecret ?? candidate.client_secret;
+    const scopes = Array.isArray(candidate.scopes)
+        ? candidate.scopes.filter((scope) => typeof scope === 'string' && scope.length > 0)
+        : ['node.connect'];
+    const normalized = {
+        tokenUrl,
+        clientIdConfig: normalizeSecretSource(clientIdSource),
+        clientSecretConfig: normalizeSecretSource(clientSecretSource),
+        scopes,
+    };
+    const audienceCandidate = candidate.audience ?? candidate.aud;
+    if (typeof audienceCandidate === 'string' &&
+        audienceCandidate.trim().length > 0) {
+        normalized.audience = audienceCandidate.trim();
+    }
+    return normalized;
+}
+export const FACTORY_META = {
+    base: TOKEN_PROVIDER_FACTORY_BASE_TYPE,
+    key: 'OAuth2ClientCredentialsTokenProvider',
+};
+export class OAuth2ClientCredentialsTokenProviderFactory extends TokenProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = 'OAuth2ClientCredentialsTokenProvider';
+    }
+    async create(config) {
+        const normalized = normalizeConfig(config);
+        const [clientIdProvider, clientSecretProvider] = await Promise.all([
+            CredentialProviderFactory.createCredentialProvider(normalized.clientIdConfig),
+            CredentialProviderFactory.createCredentialProvider(normalized.clientSecretConfig),
+        ]);
+        const options = {
+            tokenUrl: normalized.tokenUrl,
+            clientIdProvider,
+            clientSecretProvider,
+            scopes: normalized.scopes,
+        };
+        if (normalized.audience) {
+            options.audience = normalized.audience;
+        }
+        const { OAuth2ClientCredentialsTokenProvider } = await getOAuth2ClientCredentialsTokenProviderModule();
+        return new OAuth2ClientCredentialsTokenProvider(options);
+    }
+}
+export default OAuth2ClientCredentialsTokenProviderFactory;
+//# sourceMappingURL=oauth2-client-credentials-token-provider-factory.js.map

package/dist/esm/src/naylence/fame/security/auth/oauth2-client-credentials-token-provider-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-client-credentials-token-provider-factory.js","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/oauth2-client-credentials-token-provider-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EACL,gCAAgC,EAChC,oBAAoB,GAErB,MAAM,6BAA6B,CAAC;AAMrC,IAAI,iDAAiD,GACnD,IAAI,CAAC;AACP,KAAK,UAAU,6CAA6C;IAC1D,IAAI,CAAC,iDAAiD,EAAE,CAAC;QACvD,iDAAiD,GAAG,UAAU,CAC5D,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,EAC7D,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAoBD,SAAS,eAAe,CACtB,MAGQ;IAER,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MACO,CAAC;IAE1B,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC;IAC3D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAClB,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,CAAC;IAC5C,MAAM,kBAAkB,GACtB,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,aAAa,CAAC;IAEpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CACrB,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAChD;QACH,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAErB,MAAM,UAAU,GAA2B;QACzC,QAAQ;QACR,cAAc,EAAE,qBAAqB,CAAC,cAAc,CAAC;QACrD,kBAAkB,EAAE,qBAAqB,CAAC,kBAAkB,CAAC;QAC7D,MAAM;KACP,CAAC;IAEF,MAAM,iBAAiB,GACrB,SAAS,CAAC,QAAQ,IAAK,SAAqC,CAAC,GAAG,CAAC;IACnE,IACE,OAAO,iBAAiB,KAAK,QAAQ;QACrC,iBAAiB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EACnC,CAAC;QACD,UAAU,CAAC,QAAQ,GAAG,iBAAiB,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,IAAI,EAAE,gCAAgC;IACtC,GAAG,EAAE,sCAAsC;CACnC,CAAC;AAEX,MAAM,OAAO,2CAA4C,SAAQ,oBAAgE;IAAjI;;QACkB,SAAI,GAAG,sCAAsC,CAAC;IAmChE,CAAC;IAjCQ,KAAK,CAAC,MAAM,CACjB,MAGQ;QAER,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAE3C,MAAM,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjE,yBAAyB,CAAC,wBAAwB,CAChD,UAAU,CAAC,cAAc,CAC1B;YACD,yBAAyB,CAAC,wBAAwB,CAChD,UAAU,CAAC,kBAAkB,CAC9B;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAgD;YAC3D,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,gBAAgB;YAChB,oBAAoB;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC;QAEF,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;QACzC,CAAC;QAED,MAAM,EAAE,oCAAoC,EAAE,GAC5C,MAAM,6CAA6C,EAAE,CAAC;QAExD,OAAO,IAAI,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAED,eAAe,2CAA2C,CAAC"}