@oktis-works/auth 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { AuthService } from './service.js';
+export type { AuthResult, RegisterInput, LoginInput } from './service.js';
+export { JWTService } from './jwt/index.js';
+export type { TokenPayload, TokenPair } from './jwt/index.js';
+export { RBACService } from './rbac/index.js';
+export type { Permission, RolePermissions, RBACPolicy } from './rbac/index.js';
+export { SessionService } from './sessions/index.js';
+export type { Session } from './sessions/index.js';
+export { hashPassword, verifyPassword } from './password/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @oktis-works/auth - Main Entry Point
+export { AuthService } from './service.js';
+export { JWTService } from './jwt/index.js';
+export { RBACService } from './rbac/index.js';
+export { SessionService } from './sessions/index.js';
+export { hashPassword, verifyPassword } from './password/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/jwt/index.d.ts

@@ -0,0 +1,22 @@
+import type { AuthConfig } from '@oktis-works/config';
+export interface TokenPayload {
+    sub: string;
+    email: string;
+    tenantId: string;
+    roles: string[];
+    iat: number;
+    exp: number;
+}
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+}
+export declare class JWTService {
+    private config;
+    constructor(config: AuthConfig);
+    generateTokenPair(payload: Omit<TokenPayload, 'iat' | 'exp'>): Promise<TokenPair>;
+    verifyToken(token: string): Promise<TokenPayload | null>;
+    refreshAccessToken(refreshToken: string): Promise<TokenPair | null>;
+    private sign;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAmDD,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,EAAE,UAAU;IAIxB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAuBjF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAuBxD,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAY3D,IAAI;CAOnB"}

package/dist/jwt/index.js

@@ -0,0 +1,98 @@
+// @oktis-works/auth - JWT Token Management
+async function hmacSign(data, secret) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(secret);
+    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(data));
+    return Buffer.from(signature).toString('base64url');
+}
+async function hmacVerify(data, signature, secret) {
+    const encoder = new TextEncoder();
+    const keyData = encoder.encode(secret);
+    const key = await crypto.subtle.importKey('raw', keyData, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+    const sigBuffer = Buffer.from(signature, 'base64url');
+    return crypto.subtle.verify('HMAC', key, sigBuffer, encoder.encode(data));
+}
+function base64urlEncode(data) {
+    return Buffer.from(data).toString('base64url');
+}
+function base64urlDecode(data) {
+    return Buffer.from(data, 'base64url').toString();
+}
+function parseDuration(str) {
+    const match = str.match(/^(\d+)([smhd])$/);
+    if (!match)
+        return 900;
+    const num = parseInt(match[1], 10);
+    switch (match[2]) {
+        case 's': return num;
+        case 'm': return num * 60;
+        case 'h': return num * 3600;
+        case 'd': return num * 86400;
+        default: return 900;
+    }
+}
+export class JWTService {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async generateTokenPair(payload) {
+        const now = Math.floor(Date.now() / 1000);
+        const expiresIn = parseDuration(this.config.jwtExpiresIn);
+        const refreshExpiresIn = parseDuration(this.config.refreshTokenExpiresIn);
+        const accessToken = {
+            ...payload,
+            iat: now,
+            exp: now + expiresIn,
+        };
+        const refreshToken = {
+            ...payload,
+            iat: now,
+            exp: now + refreshExpiresIn,
+        };
+        return {
+            accessToken: await this.sign(accessToken),
+            refreshToken: await this.sign(refreshToken),
+        };
+    }
+    async verifyToken(token) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3)
+                return null;
+            const [header, payload, signature] = parts;
+            const data = `${header}.${payload}`;
+            const valid = await hmacVerify(data, signature, this.config.jwtSecret);
+            if (!valid)
+                return null;
+            const decoded = JSON.parse(base64urlDecode(payload));
+            if (decoded.exp < Math.floor(Date.now() / 1000)) {
+                return null;
+            }
+            return decoded;
+        }
+        catch {
+            return null;
+        }
+    }
+    async refreshAccessToken(refreshToken) {
+        const payload = await this.verifyToken(refreshToken);
+        if (!payload)
+            return null;
+        return this.generateTokenPair({
+            sub: payload.sub,
+            email: payload.email,
+            tenantId: payload.tenantId,
+            roles: payload.roles,
+        });
+    }
+    async sign(payload) {
+        const header = base64urlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+        const body = base64urlEncode(JSON.stringify(payload));
+        const data = `${header}.${body}`;
+        const signature = await hmacSign(data, this.config.jwtSecret);
+        return `${data}.${signature}`;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAkB3C,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc;IAClD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB,EAAE,MAAc;IACvE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,EACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IACpC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC;QACrB,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,IAAI,CAAC;QAC5B,KAAK,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,KAAK,CAAC;QAC7B,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,UAAU;IACb,MAAM,CAAa;IAE3B,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAA0C;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,gBAAgB,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAiB;YAChC,GAAG,OAAO;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,SAAS;SACrB,CAAC;QAEF,MAAM,YAAY,GAAiB;YACjC,GAAG,OAAO;YACV,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG,GAAG,gBAAgB;SAC5B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACzC,YAAY,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEpC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAE3C,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,SAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAQ,CAAC,CAAiB,CAAC;YAEtE,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAqB;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9D,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;IAChC,CAAC;CACF"}

package/dist/password/index.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(password: string, hash: string): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/password/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/password/index.ts"],"names":[],"mappings":"AAEA,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BpE;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0CrF"}

package/dist/password/index.js

@@ -0,0 +1,46 @@
+// @oktis-works/auth - Password Hashing
+export async function hashPassword(password) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password);
+    // Use Web Crypto API (available in Node 15+)
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const key = await crypto.subtle.importKey('raw', data, { name: 'PBKDF2' }, false, ['deriveBits']);
+    const bits = await crypto.subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt,
+        iterations: 100000,
+    }, key, 256);
+    const hashArray = new Uint8Array(bits);
+    const saltArray = new Uint8Array(salt);
+    // Format: $algorithm$iterations$salt$hash
+    return `$pbkdf2-sha256$100000$${Buffer.from(saltArray).toString('base64')}$${Buffer.from(hashArray).toString('base64')}`;
+}
+export async function verifyPassword(password, hash) {
+    const parts = hash.split('$');
+    if (parts.length !== 5 || parts[1] !== 'pbkdf2-sha256') {
+        throw new Error('Invalid hash format');
+    }
+    const iterations = parseInt(parts[2], 10);
+    const salt = Buffer.from(parts[3], 'base64');
+    const expectedHash = Buffer.from(parts[4], 'base64');
+    const encoder = new TextEncoder();
+    const data = encoder.encode(password);
+    const key = await crypto.subtle.importKey('raw', data, { name: 'PBKDF2' }, false, ['deriveBits']);
+    const bits = await crypto.subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt,
+        iterations,
+    }, key, 256);
+    const computedHash = new Uint8Array(bits);
+    // Constant-time comparison
+    if (computedHash.length !== expectedHash.length)
+        return false;
+    for (let i = 0; i < computedHash.length; i++) {
+        if (computedHash[i] !== expectedHash[i])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=index.js.map

package/dist/password/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/password/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AAEvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEtC,6CAA6C;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,EACJ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,UAAU,EAAE,MAAM;KACnB,EACD,GAAG,EACH,GAAG,CACJ,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAEvC,0CAA0C;IAC1C,OAAO,yBAAyB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3H,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,EACJ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI;QACJ,UAAU;KACX,EACD,GAAG,EACH,GAAG,CACJ,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAE1C,2BAA2B;IAC3B,IAAI,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rbac/index.d.ts

@@ -0,0 +1,22 @@
+export interface Permission {
+    action: string;
+    resource: string;
+    conditions?: Record<string, unknown>;
+}
+export interface RolePermissions {
+    role: string;
+    permissions: Permission[];
+}
+export interface RBACPolicy {
+    roles: RolePermissions[];
+    inheritance: Record<string, string[]>;
+}
+export declare class RBACService {
+    private policy;
+    constructor(policy?: RBACPolicy);
+    hasPermission(userRoles: string[], action: string, resource: string, context?: Record<string, unknown>): boolean;
+    getUserPermissions(userRoles: string[]): Permission[];
+    private resolvePermissions;
+    private checkConditions;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAwDD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,CAAC,EAAE,UAAU;IAI/B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IAqBhH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE;IAIrD,OAAO,CAAC,kBAAkB;IA2B1B,OAAO,CAAC,eAAe;CAYxB"}

package/dist/rbac/index.js

@@ -0,0 +1,116 @@
+// @oktis-works/auth - Role-Based Access Control
+const DEFAULT_POLICY = {
+    roles: [
+        {
+            role: 'SUPER_ADMIN',
+            permissions: [{ action: '*', resource: '*' }],
+        },
+        {
+            role: 'TENANT_ADMIN',
+            permissions: [
+                { action: '*', resource: 'tenant' },
+                { action: '*', resource: 'user' },
+                { action: '*', resource: 'role' },
+                { action: '*', resource: 'content' },
+                { action: '*', resource: 'media' },
+                { action: '*', resource: 'plugin' },
+                { action: '*', resource: 'theme' },
+                { action: '*', resource: 'setting' },
+            ],
+        },
+        {
+            role: 'EDITOR',
+            permissions: [
+                { action: 'read', resource: 'content' },
+                { action: 'create', resource: 'content' },
+                { action: 'update', resource: 'content' },
+                { action: 'read', resource: 'media' },
+                { action: 'upload', resource: 'media' },
+            ],
+        },
+        {
+            role: 'AUTHOR',
+            permissions: [
+                { action: 'read', resource: 'content' },
+                { action: 'create', resource: 'content' },
+                { action: 'update', resource: 'content', conditions: { own: true } },
+                { action: 'read', resource: 'media' },
+                { action: 'upload', resource: 'media' },
+            ],
+        },
+        {
+            role: 'VIEWER',
+            permissions: [
+                { action: 'read', resource: 'content' },
+                { action: 'read', resource: 'media' },
+            ],
+        },
+    ],
+    inheritance: {
+        TENANT_ADMIN: ['EDITOR'],
+        EDITOR: ['AUTHOR'],
+        AUTHOR: ['VIEWER'],
+    },
+};
+export class RBACService {
+    policy;
+    constructor(policy) {
+        this.policy = policy ?? DEFAULT_POLICY;
+    }
+    hasPermission(userRoles, action, resource, context) {
+        const allPermissions = this.resolvePermissions(userRoles);
+        return allPermissions.some(permission => {
+            // Check action match
+            const actionMatch = permission.action === '*' || permission.action === action;
+            if (!actionMatch)
+                return false;
+            // Check resource match
+            const resourceMatch = permission.resource === '*' || permission.resource === resource;
+            if (!resourceMatch)
+                return false;
+            // Check conditions
+            if (permission.conditions && context) {
+                return this.checkConditions(permission.conditions, context);
+            }
+            return true;
+        });
+    }
+    getUserPermissions(userRoles) {
+        return this.resolvePermissions(userRoles);
+    }
+    resolvePermissions(roles) {
+        const permissions = [];
+        const visited = new Set();
+        const resolve = (role) => {
+            if (visited.has(role))
+                return;
+            visited.add(role);
+            const rolePerms = this.policy.roles.find(r => r.role === role);
+            if (rolePerms) {
+                permissions.push(...rolePerms.permissions);
+            }
+            // Resolve inherited roles
+            const inherited = this.policy.inheritance[role] ?? [];
+            for (const inheritedRole of inherited) {
+                resolve(inheritedRole);
+            }
+        };
+        for (const role of roles) {
+            resolve(role);
+        }
+        return permissions;
+    }
+    checkConditions(conditions, context) {
+        for (const [key, value] of Object.entries(conditions)) {
+            if (key === 'own') {
+                // Check if the user owns the resource
+                if (value === true && context['userId'] !== context['resourceOwnerId']) {
+                    return false;
+                }
+            }
+            // Add more condition checks as needed
+        }
+        return true;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rbac/index.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAkBhD,MAAM,cAAc,GAAe;IACjC,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;SAC9C;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;gBACjC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;gBACjC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACpC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBACnC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE;aACrC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;aACxC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACzC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBACpE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;aACxC;SACF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE;gBACX,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;gBACvC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;aACtC;SACF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC;QACxB,MAAM,EAAE,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,CAAC,QAAQ,CAAC;KACnB;CACF,CAAC;AAEF,MAAM,OAAO,WAAW;IACd,MAAM,CAAa;IAE3B,YAAY,MAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,cAAc,CAAC;IACzC,CAAC;IAED,aAAa,CAAC,SAAmB,EAAE,MAAc,EAAE,QAAgB,EAAE,OAAiC;QACpG,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAE1D,OAAO,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;YACtC,qBAAqB;YACrB,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;YAC9E,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAE/B,uBAAuB;YACvB,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACtF,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,mBAAmB;YACnB,IAAI,UAAU,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,SAAmB;QACpC,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,KAAe;QACxC,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO;YAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAElB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC;YAED,0BAA0B;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtD,KAAK,MAAM,aAAa,IAAI,SAAS,EAAE,CAAC;gBACtC,OAAO,CAAC,aAAa,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,eAAe,CAAC,UAAmC,EAAE,OAAgC;QAC3F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,sCAAsC;gBACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;oBACvE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,sCAAsC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/service.d.ts

@@ -0,0 +1,38 @@
+import type { AuthConfig } from '@oktis-works/config';
+import type { User } from '@oktis-works/types';
+export interface AuthResult {
+    user: User;
+    accessToken: string;
+    refreshToken: string;
+    sessionId: string;
+}
+export interface RegisterInput {
+    email: string;
+    password: string;
+    name: string;
+}
+export interface LoginInput {
+    email: string;
+    password: string;
+    tenantId: string;
+    ipAddress?: string;
+    userAgent?: string;
+}
+export declare class AuthService {
+    private jwt;
+    private session;
+    private rbac;
+    private config;
+    constructor(config: AuthConfig);
+    register(input: RegisterInput): Promise<User>;
+    login(input: LoginInput): Promise<AuthResult>;
+    refreshToken(refreshToken: string): Promise<{
+        accessToken: string;
+        refreshToken: string;
+    } | null>;
+    logout(token: string): Promise<void>;
+    verifyToken(token: string): Promise<import("./index.js").TokenPayload | null>;
+    hasPermission(userRoles: string[], action: string, resource: string, context?: Record<string, unknown>): boolean;
+    getUserPermissions(userRoles: string[]): import("./index.js").Permission[];
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAM/C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,MAAM,CAAa;gBAEf,MAAM,EAAE,UAAU;IAOxB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB7C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAoD7C,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAOjG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,WAAW,CAAC,KAAK,EAAE,MAAM;IAI/B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO;IAIhH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE;CAGvC"}

package/dist/service.js

@@ -0,0 +1,86 @@
+// @oktis-works/auth - Authentication Service
+import { randomUUID } from 'node:crypto';
+import { getConnection } from '@oktis-works/database';
+import { hashPassword, verifyPassword } from './password/index.js';
+import { JWTService } from './jwt/index.js';
+import { SessionService } from './sessions/index.js';
+import { RBACService } from './rbac/index.js';
+export class AuthService {
+    jwt;
+    session;
+    rbac;
+    config;
+    constructor(config) {
+        this.config = config;
+        this.jwt = new JWTService(config);
+        this.session = new SessionService();
+        this.rbac = new RBACService();
+    }
+    async register(input) {
+        const sql = getConnection();
+        const existing = await sql.unsafe('SELECT id FROM users WHERE email = $1', [input.email]);
+        if (existing.length > 0) {
+            throw new Error('User with this email already exists');
+        }
+        const passwordHash = await hashPassword(input.password);
+        const result = await sql.unsafe(`INSERT INTO users (id, email, name, password_hash, status)
+       VALUES ($1, $2, $3, $4, 'ACTIVE')
+       RETURNING *`, [randomUUID(), input.email, input.name, passwordHash]);
+        return result[0];
+    }
+    async login(input) {
+        const sql = getConnection();
+        const users = await sql.unsafe('SELECT * FROM users WHERE email = $1 AND status = $2', [input.email, 'ACTIVE']);
+        if (users.length === 0) {
+            throw new Error('Invalid credentials');
+        }
+        const user = users[0];
+        const valid = await verifyPassword(input.password, user.passwordHash);
+        if (!valid) {
+            throw new Error('Invalid credentials');
+        }
+        const roles = await sql.unsafe(`SELECT r.slug
+       FROM roles r
+       JOIN tenant_users tu ON tu.role_id = r.id
+       WHERE tu.user_id = $1
+         AND tu.tenant_id = $2
+         AND tu.status = 'ACTIVE'`, [user.id, input.tenantId]);
+        const userRoles = roles.map((r) => r['slug']);
+        const tokens = await this.jwt.generateTokenPair({
+            sub: user.id,
+            email: user.email,
+            tenantId: input.tenantId,
+            roles: userRoles,
+        });
+        const session = await this.session.create(user.id, input.tenantId, {
+            ipAddress: input.ipAddress,
+            userAgent: input.userAgent,
+        });
+        await sql.unsafe('UPDATE users SET last_login_at = NOW() WHERE id = $1', [user.id]);
+        return {
+            user,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            sessionId: session.id,
+        };
+    }
+    async refreshToken(refreshToken) {
+        const payload = await this.jwt.verifyToken(refreshToken);
+        if (!payload)
+            return null;
+        return this.jwt.refreshAccessToken(refreshToken);
+    }
+    async logout(token) {
+        await this.session.delete(token);
+    }
+    async verifyToken(token) {
+        return this.jwt.verifyToken(token);
+    }
+    hasPermission(userRoles, action, resource, context) {
+        return this.rbac.hasPermission(userRoles, action, resource, context);
+    }
+    getUserPermissions(userRoles) {
+        return this.rbac.getUserPermissions(userRoles);
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAuB9C,MAAM,OAAO,WAAW;IACd,GAAG,CAAa;IAChB,OAAO,CAAiB;IACxB,IAAI,CAAc;IAClB,MAAM,CAAa;IAE3B,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAuC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B;;mBAEa,EACb,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CACtD,CAAC;QAEF,OAAO,MAAM,CAAC,CAAC,CAAoB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAE5B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAC5B,sDAAsD,EACtD,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CACxB,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAoB,CAAC;QAEzC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAC5B;;;;;kCAK4B,EAC5B,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAC1B,CAAC;QAEF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC9C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,MAAM,GAAG,CAAC,MAAM,CAAC,sDAAsD,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpF,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,aAAa,CAAC,SAAmB,EAAE,MAAc,EAAE,QAAgB,EAAE,OAAiC;QACpG,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,kBAAkB,CAAC,SAAmB;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;CACF"}

package/dist/sessions/index.d.ts

@@ -0,0 +1,22 @@
+export interface Session {
+    id: string;
+    userId: string;
+    tenantId: string;
+    token: string;
+    ipAddress?: string;
+    userAgent?: string;
+    expiresAt: Date;
+    createdAt: Date;
+}
+export declare class SessionService {
+    create(userId: string, tenantId: string, options?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<Session>;
+    getByToken(token: string): Promise<Session | null>;
+    getById(id: string): Promise<Session | null>;
+    delete(token: string): Promise<boolean>;
+    deleteAllForUser(userId: string, tenantId: string): Promise<number>;
+    cleanup(): Promise<number>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/sessions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAID,qBAAa,cAAc;IACnB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAehH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IASlD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS5C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASnE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;CAKjC"}

package/dist/sessions/index.js

@@ -0,0 +1,41 @@
+// @oktis-works/auth - Session Management
+import { randomUUID } from 'node:crypto';
+import { getConnection } from '@oktis-works/database';
+const SESSION_EXPIRY_HOURS = 7 * 24; // 7 days default
+export class SessionService {
+    async create(userId, tenantId, options) {
+        const sql = getConnection();
+        const token = randomUUID();
+        const expiresAt = new Date(Date.now() + SESSION_EXPIRY_HOURS * 3600 * 1000);
+        const result = await sql.unsafe(`INSERT INTO sessions (id, user_id, tenant_id, token, ip_address, user_agent, expires_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       RETURNING *`, [randomUUID(), userId, tenantId, token, options?.ipAddress ?? null, options?.userAgent ?? null, expiresAt.toISOString()]);
+        return result[0];
+    }
+    async getByToken(token) {
+        const sql = getConnection();
+        const result = await sql.unsafe('SELECT * FROM sessions WHERE token = $1 AND expires_at > NOW()', [token]);
+        return result[0] ?? null;
+    }
+    async getById(id) {
+        const sql = getConnection();
+        const result = await sql.unsafe('SELECT * FROM sessions WHERE id = $1 AND expires_at > NOW()', [id]);
+        return result[0] ?? null;
+    }
+    async delete(token) {
+        const sql = getConnection();
+        const result = await sql.unsafe('DELETE FROM sessions WHERE token = $1', [token]);
+        return result.count > 0;
+    }
+    async deleteAllForUser(userId, tenantId) {
+        const sql = getConnection();
+        const result = await sql.unsafe('DELETE FROM sessions WHERE user_id = $1 AND tenant_id = $2', [userId, tenantId]);
+        return result.count;
+    }
+    async cleanup() {
+        const sql = getConnection();
+        const result = await sql.unsafe('DELETE FROM sessions WHERE expires_at < NOW()');
+        return result.count;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/sessions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAatD,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,iBAAiB;AAEtD,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAoD;QACjG,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B;;mBAEa,EACb,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CACzH,CAAC;QAEF,OAAO,MAAM,CAAC,CAAC,CAAuB,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B,gEAAgE,EAChE,CAAC,KAAK,CAAC,CACR,CAAC;QACF,OAAQ,MAAM,CAAC,CAAC,CAAwB,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B,6DAA6D,EAC7D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,OAAQ,MAAM,CAAC,CAAC,CAAwB,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,uCAAuC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QACrD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAC7B,4DAA4D,EAC5D,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;CACF"}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@oktis-works/auth",
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo"
+  },
+  "dependencies": {
+    "@oktis-works/types": "0.1.0",
+    "@oktis-works/config": "0.1.0",
+    "@oktis-works/database": "0.1.0",
+    "@oktis-works/core": "0.1.0"
+  },
+  "devDependencies": {
+    "typescript": "5.7.3",
+    "@types/jsonwebtoken": "9.0.0"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/blacklotus/blacklotus-cms",
+    "directory": "packages/auth"
+  }
+}