@omen.foundation/node-microservice-runtime 0.1.63 → 0.1.64

package/dist/auth.cjs

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthManager = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_url_1 = require("node:url");
+const errors_js_1 = require("./errors.js");
+class AuthManager {
+    constructor(env, requester) {
+        this.env = env;
+        this.requester = requester;
+    }
+    async authenticate() {
+        if (this.env.secret) {
+            await this.authenticateWithRealmSecret();
+            return;
+        }
+        if (this.env.refreshToken) {
+            await this.authenticateWithRefreshToken();
+            return;
+        }
+        throw new errors_js_1.AuthenticationError('Neither SECRET nor REFRESH_TOKEN is configured.');
+    }
+    async authenticateWithRealmSecret() {
+        var _a, _b;
+        const nonce = await this.requester.request('get', 'gateway/nonce');
+        if (!(nonce === null || nonce === void 0 ? void 0 : nonce.nonce)) {
+            throw new errors_js_1.AuthenticationError('Gateway did not provide a nonce for authentication.');
+        }
+        const signature = this.calculateRealmSignature((_a = this.env.secret) !== null && _a !== void 0 ? _a : '', nonce.nonce);
+        const body = {
+            cid: this.env.cid,
+            pid: this.env.pid,
+            signature,
+        };
+        const response = await this.requester.request('post', 'gateway/auth', body);
+        if (!response || response.result !== 'ok') {
+            throw new errors_js_1.AuthenticationError(`Realm secret authentication failed with result=${(_b = response === null || response === void 0 ? void 0 : response.result) !== null && _b !== void 0 ? _b : 'unknown'}.`);
+        }
+    }
+    async authenticateWithRefreshToken() {
+        var _a;
+        const accessToken = await this.exchangeRefreshToken();
+        const body = {
+            cid: this.env.cid,
+            pid: this.env.pid,
+            token: accessToken,
+        };
+        const response = await this.requester.request('post', 'gateway/auth', body);
+        if (!response || response.result !== 'ok') {
+            throw new errors_js_1.AuthenticationError(`Refresh-token authentication failed with result=${(_a = response === null || response === void 0 ? void 0 : response.result) !== null && _a !== void 0 ? _a : 'unknown'}.`);
+        }
+    }
+    calculateRealmSignature(secret, nonce) {
+        const hash = (0, node_crypto_1.createHash)('md5');
+        hash.update(secret + nonce, 'utf8');
+        return hash.digest('base64');
+    }
+    async exchangeRefreshToken() {
+        var _a;
+        if (!this.env.refreshToken) {
+            throw new errors_js_1.AuthenticationError('REFRESH_TOKEN missing.');
+        }
+        const baseUrl = this.hostToHttpUrl();
+        const tokenUrl = new node_url_1.URL('/basic/auth/token', baseUrl).toString();
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+                'beam-scope': `${this.env.cid}.${this.env.pid}`,
+            },
+            body: JSON.stringify({
+                grant_type: 'refresh_token',
+                refresh_token: this.env.refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            throw new errors_js_1.AuthenticationError(`Failed to retrieve access token. status=${response.status}`);
+        }
+        const payload = (await response.json());
+        if (!payload.access_token) {
+            throw new errors_js_1.AuthenticationError(`Refresh-token exchange failed: ${(_a = payload.error) !== null && _a !== void 0 ? _a : 'unknown error'}`);
+        }
+        return payload.access_token;
+    }
+    hostToHttpUrl() {
+        const host = this.env.host.replace(/\/socket$/, '');
+        if (host.startsWith('wss://')) {
+            return `https://${host.substring('wss://'.length)}`;
+        }
+        if (host.startsWith('ws://')) {
+            return `http://${host.substring('ws://'.length)}`;
+        }
+        return host;
+    }
+}
+exports.AuthManager = AuthManager;