@plumbus/core 0.1.0

package/dist/auth/__tests__/saml-adapter.test.js

@@ -0,0 +1,188 @@
+import { createSign, generateKeyPairSync } from 'node:crypto';
+import { describe, expect, it } from 'vitest';
+import { createSamlAdapter } from '../saml-adapter.js';
+const IDP_ENTITY_ID = 'https://idp.example.com';
+const SP_ENTITY_ID = 'https://app.example.com';
+// Generate a test RSA key pair for signing assertions
+const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+const certPem = publicKey.export({ type: 'spki', format: 'pem' });
+// Use SPKI public key format (real certs would be X.509, but crypto.createPublicKey accepts SPKI too)
+const certForAdapter = certPem;
+function futureISO(minutes) {
+    return new Date(Date.now() + minutes * 60 * 1000).toISOString();
+}
+function pastISO(minutes) {
+    return new Date(Date.now() - minutes * 60 * 1000).toISOString();
+}
+/** Build a minimal SAML Response XML with attributes. */
+function buildSamlResponse(opts) {
+    const issuer = opts.issuer ?? IDP_ENTITY_ID;
+    const audience = opts.audience ?? SP_ENTITY_ID;
+    const nameId = opts.nameId ?? 'user@example.com';
+    const notBefore = opts.notBefore ?? pastISO(1);
+    const notOnOrAfter = opts.notOnOrAfter ?? futureISO(10);
+    let attributeStatements = '';
+    if (opts.attributes) {
+        const attrXml = Object.entries(opts.attributes)
+            .map(([name, values]) => {
+            const valXml = values
+                .map((v) => `<saml:AttributeValue>${v}</saml:AttributeValue>`)
+                .join('');
+            return `<saml:Attribute Name="${name}">${valXml}</saml:Attribute>`;
+        })
+            .join('');
+        attributeStatements = `<saml:AttributeStatement>${attrXml}</saml:AttributeStatement>`;
+    }
+    const assertionBody = `<saml:Issuer>${issuer}</saml:Issuer>
+<saml:Conditions NotBefore="${notBefore}" NotOnOrAfter="${notOnOrAfter}">
+<saml:AudienceRestriction><saml:Audience>${audience}</saml:Audience></saml:AudienceRestriction>
+</saml:Conditions>
+<saml:Subject><saml:NameID>${nameId}</saml:NameID></saml:Subject>
+${attributeStatements}`;
+    if (opts.skipSignature) {
+        return `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+<saml:Assertion>${assertionBody}</saml:Assertion>
+</samlp:Response>`;
+    }
+    // Sign the assertion content
+    return signSamlResponse(assertionBody);
+}
+/** Sign a SAML response using RSA-SHA256 with enveloped signature. */
+function signSamlResponse(assertionBody) {
+    // Build the SignedInfo referencing the assertion digest
+    const signedInfo = `<ds:SignedInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod>
+<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></ds:SignatureMethod>
+<ds:Reference><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></ds:DigestMethod><ds:DigestValue>placeholder</ds:DigestValue></ds:Reference>
+</ds:SignedInfo>`;
+    const signer = createSign('RSA-SHA256');
+    signer.update(signedInfo);
+    const signatureValue = signer.sign(privateKey, 'base64');
+    const signature = `<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+${signedInfo}
+<ds:SignatureValue>${signatureValue}</ds:SignatureValue>
+</ds:Signature>`;
+    return `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+<saml:Assertion>${assertionBody}${signature}</saml:Assertion>
+</samlp:Response>`;
+}
+function toBase64(xml) {
+    return Buffer.from(xml).toString('base64');
+}
+describe('createSamlAdapter', () => {
+    const adapter = createSamlAdapter({
+        idpCertificate: certForAdapter,
+        issuer: IDP_ENTITY_ID,
+        audience: SP_ENTITY_ID,
+    });
+    describe('processSamlResponse', () => {
+        it('validates a signed SAML response and extracts identity', () => {
+            const xml = buildSamlResponse({
+                nameId: 'user-42@example.com',
+                attributes: {
+                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress': [
+                        'user-42@example.com',
+                    ],
+                    'http://schemas.microsoft.com/ws/2008/06/identity/claims/role': ['admin', 'user'],
+                },
+            });
+            const result = adapter.processSamlResponse(toBase64(xml));
+            expect(result).not.toBeNull();
+            expect(result?.nameId).toBe('user-42@example.com');
+            expect(result?.roles).toEqual(['admin', 'user']);
+            expect(result?.provider).toBe('saml');
+        });
+        it('rejects response with wrong issuer', () => {
+            const xml = buildSamlResponse({ issuer: 'https://evil.example.com' });
+            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
+        });
+        it('rejects response with wrong audience', () => {
+            const xml = buildSamlResponse({ audience: 'https://other-app.example.com' });
+            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
+        });
+        it('rejects unsigned responses', () => {
+            const xml = buildSamlResponse({ skipSignature: true });
+            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
+        });
+        it('rejects expired conditions', () => {
+            const xml = buildSamlResponse({
+                notBefore: pastISO(30),
+                notOnOrAfter: pastISO(20),
+            });
+            expect(adapter.processSamlResponse(toBase64(xml))).toBeNull();
+        });
+        it('extracts NameID as default userId', () => {
+            const xml = buildSamlResponse({ nameId: 'default-user-id' });
+            const result = adapter.processSamlResponse(toBase64(xml));
+            expect(result?.userId).toBe('default-user-id');
+            expect(result?.nameId).toBe('default-user-id');
+        });
+        it('prefers userId from attributes over NameID', () => {
+            const xml = buildSamlResponse({
+                nameId: 'nameid-value',
+                attributes: {
+                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier': ['attr-user-id'],
+                },
+            });
+            const result = adapter.processSamlResponse(toBase64(xml));
+            expect(result?.userId).toBe('attr-user-id');
+        });
+        it('extracts tenantId from attributes', () => {
+            const xml = buildSamlResponse({
+                attributes: {
+                    'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/tenantid': ['tenant-abc'],
+                },
+            });
+            const result = adapter.processSamlResponse(toBase64(xml));
+            expect(result?.tenantId).toBe('tenant-abc');
+        });
+        it('returns null for invalid base64', () => {
+            expect(adapter.processSamlResponse('not-valid-base64!!!')).toBeNull();
+        });
+    });
+    describe('authenticate (Bearer mode)', () => {
+        it('returns null for missing header', async () => {
+            expect(await adapter.authenticate(undefined)).toBeNull();
+        });
+        it('returns null for non-Bearer header', async () => {
+            expect(await adapter.authenticate('Basic abc123')).toBeNull();
+        });
+        it('validates a Bearer token containing base64-encoded SAML assertion', async () => {
+            const xml = buildSamlResponse({ nameId: 'bearer-user' });
+            const encoded = toBase64(xml);
+            const result = await adapter.authenticate(`Bearer ${encoded}`);
+            expect(result?.userId).toBe('bearer-user');
+            expect(result?.provider).toBe('saml');
+        });
+        it('returns null for Bearer token without SAML content', async () => {
+            const encoded = Buffer.from('not xml').toString('base64');
+            expect(await adapter.authenticate(`Bearer ${encoded}`)).toBeNull();
+        });
+    });
+    describe('custom attribute mapping', () => {
+        it('maps attributes using custom configuration', () => {
+            const customAdapter = createSamlAdapter({
+                idpCertificate: certForAdapter,
+                issuer: IDP_ENTITY_ID,
+                audience: SP_ENTITY_ID,
+                attributeMapping: {
+                    userId: 'custom_user_id',
+                    roles: 'custom_roles',
+                    tenantId: 'custom_org',
+                },
+            });
+            const xml = buildSamlResponse({
+                attributes: {
+                    custom_user_id: ['custom-42'],
+                    custom_roles: ['editor'],
+                    custom_org: ['org-99'],
+                },
+            });
+            const result = customAdapter.processSamlResponse(toBase64(xml));
+            expect(result?.userId).toBe('custom-42');
+            expect(result?.roles).toEqual(['editor']);
+            expect(result?.tenantId).toBe('org-99');
+        });
+    });
+});
+//# sourceMappingURL=saml-adapter.test.js.map

package/dist/auth/__tests__/saml-adapter.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-adapter.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/saml-adapter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,YAAY,GAAG,yBAAyB,CAAC;AAE/C,sDAAsD;AACtD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;AACtF,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;AAE5E,sGAAsG;AACtG,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED,yDAAyD;AACzD,SAAS,iBAAiB,CAAC,IAQ1B;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IAExD,IAAI,mBAAmB,GAAG,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,MAAM;iBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,wBAAwB,CAAC;iBAC7D,IAAI,CAAC,EAAE,CAAC,CAAC;YACZ,OAAO,yBAAyB,IAAI,KAAK,MAAM,mBAAmB,CAAC;QACrE,CAAC,CAAC;aACD,IAAI,CAAC,EAAE,CAAC,CAAC;QACZ,mBAAmB,GAAG,4BAA4B,OAAO,4BAA4B,CAAC;IACxF,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,MAAM;8BAChB,SAAS,mBAAmB,YAAY;2CAC3B,QAAQ;;6BAEtB,MAAM;EACjC,mBAAmB,EAAE,CAAC;IAEtB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO;kBACO,aAAa;kBACb,CAAC;IACjB,CAAC;IAED,6BAA6B;IAC7B,OAAO,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,sEAAsE;AACtE,SAAS,gBAAgB,CAAC,aAAqB;IAC7C,wDAAwD;IACxD,MAAM,UAAU,GAAG;;;;iBAIJ,CAAC;IAEhB,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAEzD,MAAM,SAAS,GAAG;EAClB,UAAU;qBACS,cAAc;gBACnB,CAAC;IAEf,OAAO;kBACS,aAAa,GAAG,SAAS;kBACzB,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,cAAc,EAAE,cAAc;QAC9B,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE;oBACV,oEAAoE,EAAE;wBACpE,qBAAqB;qBACtB;oBACD,8DAA8D,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;iBAClF;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAE1D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACjD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC7E,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtB,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;aAC1B,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,MAAM,EAAE,cAAc;gBACtB,UAAU,EAAE;oBACV,sEAAsE,EAAE,CAAC,cAAc,CAAC;iBACzF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,UAAU,EAAE;oBACV,gEAAgE,EAAE,CAAC,YAAY,CAAC;iBACjF;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;YACjF,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,aAAa,GAAG,iBAAiB,CAAC;gBACtC,cAAc,EAAE,cAAc;gBAC9B,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,YAAY;gBACtB,gBAAgB,EAAE;oBAChB,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,cAAc;oBACrB,QAAQ,EAAE,YAAY;iBACvB;aACF,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,iBAAiB,CAAC;gBAC5B,UAAU,EAAE;oBACV,cAAc,EAAE,CAAC,WAAW,CAAC;oBAC7B,YAAY,EAAE,CAAC,QAAQ,CAAC;oBACxB,UAAU,EAAE,CAAC,QAAQ,CAAC;iBACvB;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/scim.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scim.test.d.ts.map

package/dist/auth/__tests__/scim.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/scim.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/scim.test.js

@@ -0,0 +1,306 @@
+import { describe, expect, it, vi } from 'vitest';
+import { createScimService } from '../scim.js';
+function createMockRepo(initial = []) {
+    const store = new Map();
+    let nextId = 1;
+    for (const u of initial) {
+        const id = u.id ?? String(nextId++);
+        store.set(id, { ...u, id });
+    }
+    return {
+        create: vi.fn(async (user) => {
+            const id = String(nextId++);
+            const record = { ...user, id };
+            store.set(id, record);
+            return record;
+        }),
+        findById: vi.fn(async (id) => store.get(id) ?? null),
+        findByExternalId: vi.fn(async (externalId) => {
+            for (const u of store.values()) {
+                if (u.externalId === externalId)
+                    return u;
+            }
+            return null;
+        }),
+        findByUserName: vi.fn(async (userName) => {
+            for (const u of store.values()) {
+                if (u.userName === userName)
+                    return u;
+            }
+            return null;
+        }),
+        update: vi.fn(async (id, updates) => {
+            const existing = store.get(id);
+            if (!existing)
+                throw new Error('not found');
+            const updated = { ...existing, ...updates };
+            store.set(id, updated);
+            return updated;
+        }),
+        deactivate: vi.fn(async (id) => {
+            const existing = store.get(id);
+            if (existing) {
+                store.set(id, { ...existing, active: false });
+            }
+        }),
+        list: vi.fn(async (startIndex, count) => {
+            const all = [...store.values()];
+            const start = startIndex - 1; // SCIM is 1-indexed
+            return { users: all.slice(start, start + count), total: all.length };
+        }),
+    };
+}
+const AUTH = 'Bearer scim-secret-token';
+const BASE_URL = 'https://app.example.com/scim/v2';
+function createService(initial = []) {
+    const repo = createMockRepo(initial);
+    const service = createScimService({ bearerToken: 'scim-secret-token', baseUrl: BASE_URL }, repo);
+    return { service, repo };
+}
+describe('SCIM Service', () => {
+    describe('authentication', () => {
+        it('rejects requests without auth header', async () => {
+            const { service } = createService();
+            const result = await service.createUser(undefined, { userName: 'test@example.com' });
+            expect(result.status).toBe(401);
+        });
+        it('rejects requests with wrong token', async () => {
+            const { service } = createService();
+            const result = await service.createUser('Bearer wrong-token', {
+                userName: 'test@example.com',
+            });
+            expect(result.status).toBe(401);
+        });
+        it('rejects non-Bearer auth', async () => {
+            const { service } = createService();
+            const result = await service.createUser('Basic dXNlcjpwYXNz', {
+                userName: 'test@example.com',
+            });
+            expect(result.status).toBe(401);
+        });
+    });
+    describe('createUser', () => {
+        it('creates a user and returns 201 with SCIM resource', async () => {
+            const { service } = createService();
+            const result = await service.createUser(AUTH, {
+                externalId: 'ext-1',
+                userName: 'alice@example.com',
+                displayName: 'Alice',
+                emails: [{ value: 'alice@example.com', primary: true }],
+            });
+            expect(result.status).toBe(201);
+            expect(result.body).toMatchObject({
+                schemas: ['urn:ietf:params:scim:schemas:core:2.0:User'],
+                externalId: 'ext-1',
+                userName: 'alice@example.com',
+                displayName: 'Alice',
+                active: true,
+                meta: { resourceType: 'User' },
+            });
+        });
+        it('rejects duplicate externalId', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.createUser(AUTH, {
+                externalId: 'ext-1',
+                userName: 'bob@example.com',
+            });
+            expect(result.status).toBe(409);
+        });
+        it('rejects missing userName', async () => {
+            const { service } = createService();
+            const result = await service.createUser(AUTH, { externalId: 'ext-1' });
+            expect(result.status).toBe(400);
+        });
+        it('defaults displayName to userName when not provided', async () => {
+            const { service } = createService();
+            const result = await service.createUser(AUTH, {
+                externalId: 'ext-2',
+                userName: 'bob@example.com',
+            });
+            expect(result.status).toBe(201);
+            if ('displayName' in result.body) {
+                expect(result.body.displayName).toBe('bob@example.com');
+            }
+        });
+    });
+    describe('getUser', () => {
+        it('returns user by ID', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.getUser(AUTH, '1');
+            expect(result.status).toBe(200);
+            if ('userName' in result.body) {
+                expect(result.body.userName).toBe('alice@example.com');
+            }
+        });
+        it('returns 404 for missing user', async () => {
+            const { service } = createService();
+            const result = await service.getUser(AUTH, 'nonexistent');
+            expect(result.status).toBe(404);
+        });
+    });
+    describe('replaceUser', () => {
+        it('updates all fields and returns 200', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.replaceUser(AUTH, '1', {
+                externalId: 'ext-1',
+                userName: 'alice-new@example.com',
+                displayName: 'Alice New',
+                emails: [{ value: 'alice-new@example.com', primary: true }],
+                active: true,
+            });
+            expect(result.status).toBe(200);
+            if ('userName' in result.body) {
+                expect(result.body.userName).toBe('alice-new@example.com');
+                expect(result.body.displayName).toBe('Alice New');
+            }
+        });
+        it('returns 404 for missing user', async () => {
+            const { service } = createService();
+            const result = await service.replaceUser(AUTH, 'nonexistent', { userName: 'test' });
+            expect(result.status).toBe(404);
+        });
+    });
+    describe('patchUser', () => {
+        it('deactivates user via SCIM PATCH replace', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.patchUser(AUTH, '1', {
+                schemas: ['urn:ietf:params:scim:api:messages:2.0:PatchOp'],
+                Operations: [{ op: 'replace', path: 'active', value: false }],
+            });
+            expect(result.status).toBe(200);
+            if ('active' in result.body) {
+                expect(result.body.active).toBe(false);
+            }
+        });
+        it('updates displayName via PATCH', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.patchUser(AUTH, '1', {
+                Operations: [{ op: 'replace', path: 'displayName', value: 'Alice Updated' }],
+            });
+            expect(result.status).toBe(200);
+            if ('displayName' in result.body) {
+                expect(result.body.displayName).toBe('Alice Updated');
+            }
+        });
+        it('rejects missing Operations array', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.patchUser(AUTH, '1', {});
+            expect(result.status).toBe(400);
+        });
+        it('returns 404 for missing user', async () => {
+            const { service } = createService();
+            const result = await service.patchUser(AUTH, 'nonexistent', {
+                Operations: [{ op: 'replace', path: 'active', value: false }],
+            });
+            expect(result.status).toBe(404);
+        });
+    });
+    describe('deleteUser', () => {
+        it('deactivates user and returns 204', async () => {
+            const { service, repo } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.deleteUser(AUTH, '1');
+            expect(result.status).toBe(204);
+            expect(result.body).toBeUndefined();
+            expect(repo.deactivate).toHaveBeenCalledWith('1');
+        });
+        it('returns 404 for missing user', async () => {
+            const { service } = createService();
+            const result = await service.deleteUser(AUTH, 'nonexistent');
+            expect(result.status).toBe(404);
+        });
+    });
+    describe('listUsers', () => {
+        it('returns paginated user list', async () => {
+            const { service } = createService([
+                {
+                    externalId: 'ext-1',
+                    userName: 'alice@example.com',
+                    displayName: 'Alice',
+                    emails: [],
+                    active: true,
+                },
+                {
+                    externalId: 'ext-2',
+                    userName: 'bob@example.com',
+                    displayName: 'Bob',
+                    emails: [],
+                    active: true,
+                },
+            ]);
+            const result = await service.listUsers(AUTH, { startIndex: 1, count: 10 });
+            expect(result.status).toBe(200);
+            if ('totalResults' in result.body) {
+                expect(result.body.totalResults).toBe(2);
+                expect(result.body.Resources).toHaveLength(2);
+                expect(result.body.startIndex).toBe(1);
+            }
+        });
+        it('caps count at 200', async () => {
+            const { service, repo } = createService();
+            await service.listUsers(AUTH, { count: 500 });
+            expect(repo.list).toHaveBeenCalledWith(1, 200);
+        });
+        it('defaults startIndex to 1 and count to 100', async () => {
+            const { service, repo } = createService();
+            await service.listUsers(AUTH, {});
+            expect(repo.list).toHaveBeenCalledWith(1, 100);
+        });
+    });
+});
+//# sourceMappingURL=scim.test.js.map

package/dist/auth/__tests__/scim.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/scim.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAA0C,MAAM,YAAY,CAAC;AAEvF,SAAS,cAAc,CAAC,UAAsB,EAAE;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;YAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QACpD,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;oBAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;oBAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;YAC5C,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;QACF,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC,CAAC;QACF,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,oBAAoB;YAClD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,0BAA0B,CAAC;AACxC,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AAEnD,SAAS,aAAa,CAAC,UAAsB,EAAE;IAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IACjG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACrF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE;gBAC5D,QAAQ,EAAE,kBAAkB;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACvC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE;gBAC5D,QAAQ,EAAE,kBAAkB;aAC7B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YACjE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;gBAC5C,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,mBAAmB;gBAC7B,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;gBAChC,OAAO,EAAE,CAAC,4CAA4C,CAAC;gBACvD,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,mBAAmB;gBAC7B,WAAW,EAAE,OAAO;gBACpB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;gBAC5C,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;gBAC5C,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE;gBAClD,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,uBAAuB;gBACjC,WAAW,EAAE,WAAW;gBACxB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC3D,MAAM,EAAE,IAAI;aACb,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE;gBAChD,OAAO,EAAE,CAAC,+CAA+C,CAAC;gBAC1D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE;gBAChD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;aAC7E,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACxD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE;gBAC1D,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC;gBACtC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;gBAChC;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,mBAAmB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;gBACD;oBACE,UAAU,EAAE,OAAO;oBACnB,QAAQ,EAAE,iBAAiB;oBAC3B,WAAW,EAAE,KAAK;oBAClB,MAAM,EAAE,EAAE;oBACV,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,cAAc,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;YACjC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;YAC1C,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,aAAa,EAAE,CAAC;YAC1C,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/adapter.d.ts

@@ -0,0 +1,60 @@
+import type { AuthContext } from '../types/security.js';
+/**
+ * AuthAdapter normalizes an incoming request identity (e.g. a token)
+ * into a standard AuthContext.
+ */
+export interface AuthAdapter {
+    /**
+     * Extract and verify credentials from the raw authorization header value.
+     * Returns null if the token is missing or invalid.
+     */
+    authenticate(authorizationHeader: string | undefined): Promise<AuthContext | null>;
+}
+export interface JwtAdapterConfig {
+    /** Secret key for HMAC or public key for RSA/EC verification */
+    secret: string;
+    /** Expected issuer (iss claim) */
+    issuer?: string;
+    /** Expected audience (aud claim) */
+    audience?: string;
+    /**
+     * Map JWT claims to AuthContext fields.
+     * Defaults: sub→userId, roles→roles, scope→scopes, tenant_id→tenantId
+     */
+    claimMapping?: Partial<JwtClaimMapping>;
+}
+export interface JwtClaimMapping {
+    userId: string;
+    roles: string;
+    scopes: string;
+    tenantId: string;
+}
+/**
+ * JWT-based auth adapter. Decodes, verifies HMAC-SHA256 signatures,
+ * and validates JWT tokens, mapping claims to an AuthContext.
+ */
+export declare function createJwtAdapter(config: JwtAdapterConfig): AuthAdapter;
+export interface SignJwtOptions {
+    /** Secret key for HMAC-SHA256 signing */
+    secret: string;
+    /** Subject (userId) */
+    sub: string;
+    /** Roles */
+    roles?: string[];
+    /** Scopes */
+    scopes?: string[];
+    /** Tenant ID */
+    tenantId?: string;
+    /** Token expiration in seconds (default: 86400 = 24h) */
+    expiresIn?: number;
+    /** Issuer */
+    issuer?: string;
+    /** Additional claims */
+    claims?: Record<string, unknown>;
+}
+/**
+ * Sign a JWT token using HMAC-SHA256.
+ * Returns the signed token string (header.payload.signature).
+ */
+export declare function signJwt(options: SignJwtOptions): string;
+//# sourceMappingURL=adapter.d.ts.map

package/dist/auth/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/auth/adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,YAAY,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAyDtE;AA6DD,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAwBvD"}