@owox/idp-better-auth 0.5.0

package/dist/services/page-service.js

@@ -0,0 +1,331 @@
+import { TemplateService } from './template-service.js';
+export class PageService {
+    authenticationService;
+    userManagementService;
+    cryptoService;
+    constructor(authenticationService, userManagementService, cryptoService) {
+        this.authenticationService = authenticationService;
+        this.userManagementService = userManagementService;
+        this.cryptoService = cryptoService;
+    }
+    async signInPage(req, res) {
+        try {
+            const session = await this.authenticationService.getSession(req);
+            if (session) {
+                res.redirect('/');
+                return;
+            }
+        }
+        catch (error) {
+            console.error('Error checking authentication for sign-in page:', error);
+            res.send(TemplateService.renderSignIn());
+            return;
+        }
+        res.send(TemplateService.renderSignIn());
+    }
+    async setupPasswordPage(req, res) {
+        try {
+            const session = await this.authenticationService.getSession(req);
+            if (!session || !session.user) {
+                res.redirect('/auth/sign-in?error=Invalid or expired magic link');
+                return;
+            }
+            res.send(TemplateService.renderPasswordSetup());
+        }
+        catch (error) {
+            console.error('Error loading password setup page:', error);
+            res.redirect('/auth/sign-in');
+        }
+    }
+    async setPassword(req, res) {
+        const { password, confirmPassword } = req.body;
+        if (!password || password !== confirmPassword) {
+            res.status(400).send('Passwords do not match');
+            return;
+        }
+        try {
+            const session = await this.authenticationService.getSession(req);
+            if (!session || !session.user) {
+                res.redirect('/auth/sign-in');
+                return;
+            }
+            try {
+                await this.authenticationService.setPassword(password, req);
+                //TODO: this is not working
+                res.setHeader('Set-Cookie', `refreshToken=${session.session.token}; Path=/; HttpOnly; SameSite=Strict`);
+                res.send(TemplateService.renderPasswordSuccess());
+            }
+            catch (error) {
+                if (error instanceof Error && error.message === 'User already has a password') {
+                    res.status(400).send('User already has a password');
+                }
+                else {
+                    console.error('Failed to set password:', error);
+                    res.status(500).send('Failed to set password. Please try again.');
+                }
+            }
+        }
+        catch (error) {
+            console.error('Password update failed:', error);
+            res.status(500).send('Failed to set password');
+        }
+    }
+    async magicLinkSuccess(req, res) {
+        try {
+            if (req.query.error) {
+                res.redirect(`/auth/sign-in?error=Magic link verification failed: ${req.query.error}`);
+                return;
+            }
+            const session = await this.authenticationService.getSession(req);
+            if (!session || !session.user || !req.query.role) {
+                res.redirect('/auth/sign-in?error=Invalid magic link');
+                return;
+            }
+            let role;
+            try {
+                role = await this.cryptoService.decrypt(req.query.role);
+            }
+            catch (error) {
+                console.error('Failed to decrypt role:', error);
+                res.redirect('/auth/sign-in?error=Invalid magic link');
+                return;
+            }
+            if (this.userManagementService) {
+                try {
+                    if (session?.user?.id) {
+                        if (!session.user.name && session.user.email) {
+                            const generatedName = this.generateNameFromEmail(session.user.email);
+                            await this.userManagementService.updateUserName(session.user.id, generatedName);
+                        }
+                        await this.userManagementService.addMemberToOrganization(req, role);
+                    }
+                }
+                catch (error) {
+                    console.error('Failed to ensure user in organization after magic link success:', error);
+                    throw new Error(`Failed to ensure user in organization after magic link success: ${error instanceof Error ? error.message : 'Unknown error'}`);
+                }
+            }
+            res.redirect('/auth/setup-password');
+        }
+        catch (error) {
+            console.error('Magic link success handler failed:', error);
+            res.redirect('/auth/sign-in?error=Something went wrong');
+        }
+    }
+    registerRoutes(express) {
+        try {
+            express.get('/auth/setup-password', this.setupPasswordPage.bind(this));
+            express.post('/auth/set-password', this.setPassword.bind(this));
+            express.get('/auth/magic-link-success', this.magicLinkSuccess.bind(this));
+            express.get('/auth', (req, res) => {
+                res.redirect('/auth/dashboard');
+            });
+            express.get('/auth/dashboard', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminDashboard.bind(this));
+            express.get('/auth/user/:id', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminUserDetails.bind(this));
+            express.get('/auth/add-user', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminAddUserPage.bind(this));
+            express.post('/auth/add-user', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminAddUser.bind(this));
+            express.post('/auth/delete-user/:id', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminDeleteUser.bind(this));
+            express.post('/auth/generate-magic-link', this.authenticationService.requireAuthMiddleware.bind(this.authenticationService), this.adminGenerateMagicLink.bind(this));
+        }
+        catch (error) {
+            console.error('Failed to register page routes:', error);
+            throw new Error('Failed to register page routes');
+        }
+    }
+    async adminDashboard(req, res) {
+        try {
+            const session = await this.authenticationService.getSession(req);
+            const currentUserEmail = session?.user?.email || 'Unknown User';
+            const users = await this.userManagementService.getUsersForAdmin();
+            const html = TemplateService.renderAdminDashboard(users, currentUserEmail);
+            res.send(html);
+        }
+        catch (error) {
+            console.error('Error loading admin dashboard:', error);
+            res.status(500).send('Error loading dashboard');
+        }
+    }
+    async adminUserDetails(req, res) {
+        try {
+            const userId = req.params.id;
+            if (!userId) {
+                res.status(400).send('User ID is required');
+                return;
+            }
+            const user = await this.userManagementService.getUserDetails(userId);
+            if (!user) {
+                res.status(404).send('User not found');
+                return;
+            }
+            // Get current user role to determine if delete button should be shown
+            const session = await this.authenticationService.getSession(req);
+            const currentUserRole = session?.user?.id
+                ? await this.userManagementService.getUserRole(session.user.id)
+                : null;
+            const html = TemplateService.renderUserDetails(user, currentUserRole);
+            res.send(html);
+        }
+        catch (error) {
+            console.error('Error loading user details:', error);
+            res.status(500).send('Error loading user details');
+        }
+    }
+    async adminAddUserPage(req, res) {
+        try {
+            // Get current user role to determine available roles for invitation
+            const session = await this.authenticationService.getSession(req);
+            if (!session?.user?.id) {
+                res.redirect('/auth/sign-in');
+                return;
+            }
+            const currentUserRole = await this.userManagementService.getUserRole(session.user.id);
+            if (!currentUserRole) {
+                res.status(403).send('Access denied');
+                return;
+            }
+            if (!this.userManagementService.isValidRole(currentUserRole)) {
+                res.status(403).send('Access denied');
+                return;
+            }
+            const allowedRoles = this.userManagementService.getAllowedRolesForInvite(currentUserRole);
+            const html = TemplateService.renderAddUser(allowedRoles);
+            res.send(html);
+        }
+        catch (error) {
+            console.error('Error loading add user page:', error);
+            res.status(500).send('Error loading page');
+        }
+    }
+    async adminAddUser(req, res) {
+        try {
+            const { email, role } = req.body;
+            if (!email || !role) {
+                res.status(400).json({ error: 'Email and role are required' });
+                return;
+            }
+            // Validate role
+            if (!this.userManagementService.isValidRole(role)) {
+                res.status(400).json({ error: 'Invalid role' });
+                return;
+            }
+            // Get current user role and check permissions
+            const session = await this.authenticationService.getSession(req);
+            if (!session?.user?.id) {
+                res.status(401).json({ error: 'Unauthorized' });
+                return;
+            }
+            const currentUserRole = await this.userManagementService.getUserRole(session.user.id);
+            if (!currentUserRole || !this.userManagementService.isValidRole(currentUserRole)) {
+                res.status(403).json({ error: 'Access denied' });
+                return;
+            }
+            // Check if current user can invite target role
+            if (!this.userManagementService.canInviteRole(currentUserRole, role)) {
+                res.status(403).json({
+                    error: `You don't have permission to invite users with role: ${role}`,
+                });
+                return;
+            }
+            const magicLink = await this.userManagementService.generateMagicLinkForUser(email, role);
+            res.json({
+                success: true,
+                magicLink,
+                email,
+                role,
+            });
+        }
+        catch (error) {
+            console.error('Error adding user:', error);
+            res.status(500).json({ error: 'Failed to generate magic link' });
+        }
+    }
+    async adminDeleteUser(req, res) {
+        try {
+            const userId = req.params.id;
+            if (!userId) {
+                res.status(400).json({ error: 'User ID is required' });
+                return;
+            }
+            // Check if current user has admin role
+            const session = await this.authenticationService.getSession(req);
+            if (!session || !session.user) {
+                res.status(401).json({ error: 'Unauthorized' });
+                return;
+            }
+            const currentUserRole = await this.userManagementService.getUserRole(session.user.id);
+            if (currentUserRole !== 'admin') {
+                res.status(403).json({ error: 'Only admins can delete users' });
+                return;
+            }
+            await this.userManagementService.removeUser(userId);
+            res.json({ success: true });
+        }
+        catch (error) {
+            console.error('Error deleting user:', error);
+            res.status(500).json({ error: 'Failed to delete user' });
+        }
+    }
+    async adminGenerateMagicLink(req, res) {
+        try {
+            const { userId, email, role } = req.body || {};
+            if (!email || !role) {
+                res.status(400).json({ error: 'Email and role are required' });
+                return;
+            }
+            // Validate role
+            if (!this.userManagementService.isValidRole(role)) {
+                res.status(400).json({ error: 'Invalid role' });
+                return;
+            }
+            // Get current user role and check permissions
+            const session = await this.authenticationService.getSession(req);
+            if (!session?.user?.id) {
+                res.status(401).json({ error: 'Unauthorized' });
+                return;
+            }
+            const currentUserRole = await this.userManagementService.getUserRole(session.user.id);
+            if (!currentUserRole || !this.userManagementService.isValidRole(currentUserRole)) {
+                res.status(403).json({ error: 'Access denied' });
+                return;
+            }
+            // Check if current user can invite target role
+            if (!this.userManagementService.canInviteRole(currentUserRole, role)) {
+                res.status(403).json({
+                    error: `You don't have permission to generate magic link for role: ${role}`,
+                });
+                return;
+            }
+            const magicLink = await this.userManagementService.generateMagicLinkForUser(email, role);
+            res.json({
+                success: true,
+                magicLink,
+                userId,
+                email,
+                role,
+            });
+        }
+        catch (error) {
+            console.error('Error generating magic link:', error);
+            res.status(500).json({ error: 'Failed to generate magic link' });
+        }
+    }
+    generateNameFromEmail(email) {
+        try {
+            const parts = email.split('@');
+            const localPart = parts[0];
+            if (!localPart) {
+                return email; // Fallback to full email
+            }
+            // Convert dots and underscores to spaces and capitalize
+            return localPart
+                .replace(/[._]/g, ' ')
+                .split(' ')
+                .map(word => word.charAt(0).toUpperCase() + word.slice(1).toLowerCase())
+                .join(' ');
+        }
+        catch (error) {
+            console.error('Error generating name from email:', error);
+            return email; // Fallback to full email
+        }
+    }
+}

package/dist/services/request-handler-service.d.ts

@@ -0,0 +1,10 @@
+import { createBetterAuthConfig } from '../auth/auth-config.js';
+import { type Express, type Request as ExpressRequest } from 'express';
+export declare class RequestHandlerService {
+    private readonly auth;
+    private static readonly AUTH_ROUTE_PREFIX;
+    constructor(auth: Awaited<ReturnType<typeof createBetterAuthConfig>>);
+    setupBetterAuthHandler(expressApp: Express): void;
+    convertExpressToFetchRequest(req: ExpressRequest): Request;
+}
+//# sourceMappingURL=request-handler-service.d.ts.map

package/dist/services/request-handler-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-handler-service.d.ts","sourceRoot":"","sources":["../../src/services/request-handler-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,OAAO,IAAI,cAAc,EAG/B,MAAM,SAAS,CAAC;AAEjB,qBAAa,qBAAqB;IAGpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAuB;gBAEnC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;IAErF,sBAAsB,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI;IAwBjD,4BAA4B,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO;CAwB3D"}

package/dist/services/request-handler-service.js

@@ -0,0 +1,50 @@
+export class RequestHandlerService {
+    auth;
+    static AUTH_ROUTE_PREFIX = '/auth/better-auth';
+    constructor(auth) {
+        this.auth = auth;
+    }
+    setupBetterAuthHandler(expressApp) {
+        expressApp.use(async (req, res, next) => {
+            if (!req.path.startsWith(RequestHandlerService.AUTH_ROUTE_PREFIX)) {
+                return next();
+            }
+            try {
+                const fetchRequest = this.convertExpressToFetchRequest(req);
+                const response = await this.auth.handler(fetchRequest);
+                response.headers.forEach((value, key) => {
+                    res.set(key, value);
+                });
+                res.status(response.status);
+                const body = await response.text();
+                res.send(body);
+            }
+            catch (error) {
+                console.error('Auth handler error:', error);
+                res.status(500).json({ error: 'Internal server error' });
+            }
+        });
+    }
+    convertExpressToFetchRequest(req) {
+        try {
+            const url = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
+            const method = req.method;
+            const headers = new Headers();
+            for (const [key, value] of Object.entries(req.headers)) {
+                if (typeof value === 'string') {
+                    headers.set(key, value);
+                }
+            }
+            const fetchRequest = new Request(url, {
+                method,
+                headers,
+                body: method !== 'GET' && method !== 'HEAD' ? JSON.stringify(req.body) : undefined,
+            });
+            return fetchRequest;
+        }
+        catch (error) {
+            console.error('Failed to convert Express request to Fetch request:', error);
+            throw new Error('Failed to convert request format');
+        }
+    }
+}

package/dist/services/template-service.d.ts

@@ -0,0 +1,28 @@
+export declare class TemplateService {
+    private static getTemplatePath;
+    static loadTemplate(templateName: string): string;
+    private static getOwoxTailwindConfig;
+    static renderSignIn(): string;
+    static renderPasswordSetup(): string;
+    static renderPasswordSuccess(): string;
+    static renderAdminDashboard(users: Array<{
+        id: string;
+        email: string;
+        name: string | null;
+        role: string;
+        createdAt: string;
+        updatedAt: string | null;
+    }>, currentUserEmail: string): string;
+    static renderUserDetails(user: {
+        id: string;
+        email: string;
+        name: string | null;
+        role: string;
+        createdAt: string;
+        updatedAt: string | null;
+        organizationId: string | null;
+    }, currentUserRole?: string | null): string;
+    static renderAddUser(allowedRoles?: string[]): string;
+    private static formatDate;
+}
+//# sourceMappingURL=template-service.d.ts.map

package/dist/services/template-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-service.d.ts","sourceRoot":"","sources":["../../src/services/template-service.ts"],"names":[],"mappings":"AAKA,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,eAAe;WAYhB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAKxD,OAAO,CAAC,MAAM,CAAC,qBAAqB;WAyDtB,YAAY,IAAI,MAAM;WAItB,mBAAmB,IAAI,MAAM;WAI7B,qBAAqB,IAAI,MAAM;WAI/B,oBAAoB,CAChC,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,CAAC,EACF,gBAAgB,EAAE,MAAM,GACvB,MAAM;WAoEK,iBAAiB,CAC7B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,EACD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC9B,MAAM;WAiCK,aAAa,CAAC,YAAY,GAAE,MAAM,EAAkC,GAAG,MAAM;IAa3F,OAAO,CAAC,MAAM,CAAC,UAAU;CAc1B"}

package/dist/services/template-service.js

@@ -0,0 +1,198 @@
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+export class TemplateService {
+    static getTemplatePath(templateName) {
+        const currentDir = dirname(fileURLToPath(import.meta.url));
+        const distPath = join(currentDir, '..', 'templates', templateName);
+        if (existsSync(distPath)) {
+            return distPath;
+        }
+        const srcPath = join(currentDir, '..', '..', 'src', 'templates', templateName);
+        return srcPath;
+    }
+    static loadTemplate(templateName) {
+        const templatePath = this.getTemplatePath(templateName);
+        return readFileSync(templatePath, 'utf-8');
+    }
+    static getOwoxTailwindConfig() {
+        return `
+    tailwind.config = {
+      theme: {
+        extend: {
+          colors: {
+            // OWOX Design System Colors
+            background: "oklch(1 0 0)",
+            foreground: "oklch(0.3346 0.0123 279.25)",
+            card: "oklch(1 0 0)",
+            'card-foreground': "oklch(0.3346 0.0123 279.25)",
+            primary: {
+              DEFAULT: "oklch(0.6179 0.2295 250.87)",
+              hover: "oklch(0.54 0.23 250.87)",
+              foreground: "oklch(0.985 0 0)",
+            },
+            secondary: {
+              DEFAULT: "oklch(0.97 0 0)",
+              foreground: "oklch(0.205 0 0)",
+            },
+            muted: {
+              DEFAULT: "oklch(0.97 0 0)",
+              foreground: "oklch(0.5148 0.0128 274.72)",
+            },
+            accent: {
+              DEFAULT: "oklch(0.97 0 0)",
+              foreground: "oklch(0.205 0 0)",
+            },
+            destructive: {
+              DEFAULT: "oklch(0.577 0.245 27.325)",
+              foreground: "oklch(0.985 0 0)",
+            },
+            border: "oklch(0.922 0 0)",
+            input: "oklch(0.922 0 0)",
+            ring: "oklch(0.708 0 0)",
+            success: {
+              DEFAULT: "oklch(0.647 0.165 142.495)",
+              foreground: "oklch(0.985 0 0)",
+            },
+            'brand-blue': {
+              50: "oklch(0.985 0.03 250.87)",
+              100: "oklch(0.955 0.05 250.87)",
+              200: "oklch(0.9 0.08 250.87)",
+              300: "oklch(0.8 0.14 250.87)",
+              400: "oklch(0.7 0.19 250.87)",
+              500: "oklch(0.6179 0.2295 250.87)",
+              600: "oklch(0.54 0.23 250.87)",
+              700: "oklch(0.44 0.2 250.87)",
+              800: "oklch(0.36 0.17 250.87)",
+              900: "oklch(0.28 0.14 250.87)",
+            },
+          },
+        },
+      },
+    }`;
+    }
+    static renderSignIn() {
+        return this.loadTemplate('sign-in.html');
+    }
+    static renderPasswordSetup() {
+        return this.loadTemplate('password-setup.html');
+    }
+    static renderPasswordSuccess() {
+        return this.loadTemplate('password-success.html');
+    }
+    static renderAdminDashboard(users, currentUserEmail) {
+        const template = this.loadTemplate('admin-dashboard.html');
+        // Calculate stats
+        const totalUsers = users.length;
+        const activeUsers = users.length; // For now, all users are considered active
+        const adminUsers = users.filter(u => u.role === 'admin').length;
+        // Generate user rows
+        const userRows = users
+            .map(user => {
+            const getRoleBadgeClasses = (role) => {
+                switch (role) {
+                    case 'admin':
+                        return 'bg-primary text-primary-foreground';
+                    case 'editor':
+                        return 'bg-success text-success-foreground';
+                    case 'viewer':
+                        return 'bg-muted text-muted-foreground';
+                    default:
+                        return 'bg-muted text-muted-foreground';
+                }
+            };
+            const roleBadgeClasses = getRoleBadgeClasses(user.role);
+            const formattedCreatedAt = this.formatDate(user.createdAt);
+            const formattedUpdatedAt = user.updatedAt ? this.formatDate(user.updatedAt) : 'Never';
+            return `
+        <tr class="table-row">
+          <td class="px-6 py-4 whitespace-nowrap">
+            <div class="flex items-center">
+              <div class="flex-shrink-0 h-10 w-10">
+                <div class="h-10 w-10 rounded-full bg-muted flex items-center justify-center">
+                  <svg class="h-5 w-5 text-muted-foreground" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M16 7a4 4 0 11-8 0 4 4 0 018 0zM12 14a7 7 0 00-7 7h14a7 7 0 00-7-7z"></path>
+                  </svg>
+                </div>
+              </div>
+              <div class="ml-4">
+                <div class="text-sm font-medium text-foreground">${user.name || 'No name'}</div>
+                <div class="text-sm text-muted-foreground">${user.email}</div>
+              </div>
+            </div>
+          </td>
+          <td class="px-6 py-4 whitespace-nowrap">
+            <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium ${roleBadgeClasses}">
+              ${user.role}
+            </span>
+          </td>
+          <td class="px-6 py-4 whitespace-nowrap text-sm text-foreground">${formattedCreatedAt}</td>
+          <td class="px-6 py-4 whitespace-nowrap text-sm text-foreground">${formattedUpdatedAt}</td>
+          <td class="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
+            <a href="/auth/user/${user.id}" class="text-primary hover:text-primary/80 font-medium transition-colors">View</a>
+          </td>
+        </tr>
+      `;
+        })
+            .join('');
+        return template
+            .replace('{{TOTAL_USERS}}', totalUsers.toString())
+            .replace('{{ACTIVE_USERS}}', activeUsers.toString())
+            .replace('{{ADMIN_USERS}}', adminUsers.toString())
+            .replace('{{USERS_ROWS}}', userRows)
+            .replace('{{CURRENT_USER_EMAIL}}', currentUserEmail);
+    }
+    static renderUserDetails(user, currentUserRole) {
+        const template = this.loadTemplate('admin-user-details.html');
+        const getRoleBadgeClasses = (role) => {
+            switch (role) {
+                case 'admin':
+                    return 'bg-primary text-primary-foreground';
+                case 'editor':
+                    return 'bg-success text-success-foreground';
+                case 'viewer':
+                    return 'bg-muted text-muted-foreground';
+                default:
+                    return 'bg-muted text-muted-foreground';
+            }
+        };
+        const roleBadgeClasses = getRoleBadgeClasses(user.role);
+        // Show delete button only if current user is admin
+        const showDeleteButton = currentUserRole === 'admin';
+        const deleteButtonHtml = showDeleteButton ? '' : 'style="display: none;"';
+        return template
+            .replace(/{{USER_ID}}/g, user.id)
+            .replace(/{{USER_NAME}}/g, user.name || 'No name set')
+            .replace(/{{USER_EMAIL}}/g, user.email)
+            .replace(/{{USER_ROLE}}/g, user.role)
+            .replace(/{{ROLE_BADGE_CLASSES}}/g, roleBadgeClasses)
+            .replace('{{ORGANIZATION_ID}}', user.organizationId || 'Default Organization')
+            .replace('{{CREATED_AT}}', this.formatDate(user.createdAt))
+            .replace('{{UPDATED_AT}}', user.updatedAt ? this.formatDate(user.updatedAt) : 'Never')
+            .replace('{{DELETE_BUTTON_STYLE}}', deleteButtonHtml);
+    }
+    static renderAddUser(allowedRoles = ['admin', 'editor', 'viewer']) {
+        const template = this.loadTemplate('admin-add-user.html');
+        // Generate role options based on allowed roles
+        const roleOptions = allowedRoles
+            .map(role => `<option value="${role}">${role.charAt(0).toUpperCase() + role.slice(1)}</option>`)
+            .join('');
+        return template.replace('{{ROLE_OPTIONS}}', roleOptions);
+    }
+    static formatDate(dateString) {
+        try {
+            const date = new Date(dateString);
+            return date.toLocaleString('en-US', {
+                year: 'numeric',
+                month: 'short',
+                day: 'numeric',
+                hour: '2-digit',
+                minute: '2-digit',
+            });
+        }
+        catch {
+            return dateString;
+        }
+    }
+}

package/dist/services/token-service.d.ts

@@ -0,0 +1,15 @@
+import { createBetterAuthConfig } from '../auth/auth-config.js';
+import { CryptoService } from './crypto-service.js';
+import { Payload, AuthResult } from '@owox/idp-protocol';
+export declare class TokenService {
+    private readonly auth;
+    private readonly cryptoService;
+    private static readonly DEFAULT_ORGANIZATION_ID;
+    constructor(auth: Awaited<ReturnType<typeof createBetterAuthConfig>>, cryptoService: CryptoService);
+    introspectToken(token: string): Promise<Payload | null>;
+    parseToken(token: string): Promise<Payload | null>;
+    verifyToken(token: string): Promise<Payload | null>;
+    refreshToken(refreshToken: string): Promise<AuthResult>;
+    revokeToken(token: string): Promise<void>;
+}
+//# sourceMappingURL=token-service.d.ts.map

package/dist/services/token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-service.d.ts","sourceRoot":"","sources":["../../src/services/token-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEzD,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAkB;gBAG9C,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,EACxD,aAAa,EAAE,aAAa;IAGzC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA6BvD,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAIlD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IA6BnD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuBvD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBhD"}