@revealui/core 0.3.0 → 0.5.0

package/dist/security/auth.js

@@ -1,257 +0,0 @@
-/**
- * Authentication Utilities
- *
- * OAuth support, password hashing, and two-factor authentication.
- * JWT-based auth was removed — session auth is handled by @revealui/auth.
- */
-import { createHmac, timingSafeEqual } from 'node:crypto';
-/**
- * OAuth provider configurations
- */
-export const OAuthProviders = {
-    google: {
-        authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
-        tokenUrl: 'https://oauth2.googleapis.com/token',
-        userInfoUrl: 'https://www.googleapis.com/oauth2/v2/userinfo',
-        scope: ['openid', 'email', 'profile'],
-    },
-    github: {
-        authorizationUrl: 'https://github.com/login/oauth/authorize',
-        tokenUrl: 'https://github.com/login/oauth/access_token',
-        userInfoUrl: 'https://api.github.com/user',
-        scope: ['user:email'],
-    },
-    microsoft: {
-        authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
-        tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
-        userInfoUrl: 'https://graph.microsoft.com/v1.0/me',
-        scope: ['openid', 'email', 'profile'],
-    },
-};
-/**
- * OAuth client
- */
-export class OAuthClient {
-    config;
-    constructor(config) {
-        // Provider defaults fill in missing fields; user-provided config takes precedence
-        this.config = {
-            ...OAuthProviders[config.provider],
-            ...config,
-        };
-    }
-    /**
-     * Get authorization URL
-     */
-    getAuthorizationUrl(state) {
-        const params = new URLSearchParams({
-            client_id: this.config.clientId,
-            redirect_uri: this.config.redirectUri,
-            response_type: 'code',
-            scope: (this.config.scope || []).join(' '),
-        });
-        if (state) {
-            params.append('state', state);
-        }
-        return `${this.config.authorizationUrl}?${params.toString()}`;
-    }
-    /**
-     * Exchange code for token
-     */
-    async exchangeCodeForToken(code) {
-        if (!this.config.tokenUrl)
-            throw new Error('tokenUrl is required for OAuth');
-        const response = await fetch(this.config.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                client_id: this.config.clientId,
-                client_secret: this.config.clientSecret,
-                code,
-                grant_type: 'authorization_code',
-                redirect_uri: this.config.redirectUri,
-            }),
-        });
-        if (!response.ok) {
-            let detail = '';
-            try {
-                const body = await response.text();
-                detail = `: ${response.status} ${body.slice(0, 200)}`;
-            }
-            catch {
-                detail = `: ${response.status}`;
-            }
-            throw new Error(`Failed to exchange code for token${detail}`);
-        }
-        return response.json();
-    }
-    /**
-     * Get user info
-     */
-    async getUserInfo(accessToken) {
-        if (!this.config.userInfoUrl)
-            throw new Error('userInfoUrl is required for OAuth');
-        const response = await fetch(this.config.userInfoUrl, {
-            headers: {
-                // biome-ignore lint/style/useNamingConvention: HTTP header convention
-                Authorization: `Bearer ${accessToken}`,
-            },
-        });
-        if (!response.ok) {
-            let detail = '';
-            try {
-                const body = await response.text();
-                detail = `: ${response.status} ${body.slice(0, 200)}`;
-            }
-            catch {
-                detail = `: ${response.status}`;
-            }
-            throw new Error(`Failed to fetch user info${detail}`);
-        }
-        return response.json();
-    }
-}
-/**
- * Password hashing utilities
- *
- * Uses PBKDF2 with a random salt for secure password hashing.
- *
- * @deprecated Use `@revealui/auth` instead — it uses bcrypt which is more
- * resistant to GPU brute-force attacks. This PBKDF2 implementation will be
- * removed in a future major version.
- */
-const PH_ITERATIONS = 100000;
-const PH_KEY_LENGTH = 64;
-const PH_DIGEST = 'sha512';
-/**
- * Hash password with PBKDF2 and random salt
- */
-async function hashPassword(password) {
-    const { pbkdf2, randomBytes: rb } = await import('node:crypto');
-    const salt = rb(16).toString('hex');
-    return new Promise((resolve, reject) => {
-        pbkdf2(password, salt, PH_ITERATIONS, PH_KEY_LENGTH, PH_DIGEST, (err, derivedKey) => {
-            if (err)
-                reject(err);
-            else
-                resolve(`${salt}:${derivedKey.toString('hex')}`);
-        });
-    });
-}
-/**
- * Verify password against stored hash
- */
-async function verifyPassword(password, storedHash) {
-    const { pbkdf2, timingSafeEqual: tse } = await import('node:crypto');
-    const [salt, hash] = storedHash.split(':');
-    if (!(salt && hash)) {
-        return false;
-    }
-    return new Promise((resolve, reject) => {
-        pbkdf2(password, salt, PH_ITERATIONS, PH_KEY_LENGTH, PH_DIGEST, (err, derivedKey) => {
-            if (err)
-                reject(err);
-            else {
-                const derived = Buffer.from(derivedKey.toString('hex'), 'utf-8');
-                const expected = Buffer.from(hash, 'utf-8');
-                if (derived.length !== expected.length) {
-                    resolve(false);
-                }
-                else {
-                    resolve(tse(derived, expected));
-                }
-            }
-        });
-    });
-}
-export const PasswordHasher = {
-    hash: hashPassword,
-    verify: verifyPassword,
-};
-/**
- * Two-factor authentication
- */
-/**
- * Base32 encode
- */
-function base32Encode(buffer) {
-    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-    let result = '';
-    let bits = 0;
-    let value = 0;
-    for (const byte of buffer) {
-        if (byte === undefined)
-            continue;
-        value = (value << 8) | byte;
-        bits += 8;
-        while (bits >= 5) {
-            result += alphabet[(value >>> (bits - 5)) & 31];
-            bits -= 5;
-        }
-    }
-    if (bits > 0) {
-        result += alphabet[(value << (5 - bits)) & 31];
-    }
-    return result;
-}
-/**
- * HMAC-SHA1 implementation for TOTP
- */
-function totpHmac(key, message) {
-    const hmacDigest = createHmac('sha1', key).update(message).digest();
-    return new Uint8Array(hmacDigest);
-}
-/**
- * Generate TOTP secret
- */
-function generateSecret() {
-    const crypto = globalThis.crypto;
-    if (!crypto) {
-        throw new Error('Crypto API not available');
-    }
-    const buffer = new Uint8Array(20);
-    crypto.getRandomValues(buffer);
-    return base32Encode(buffer);
-}
-/**
- * Generate TOTP code
- */
-function generateCode(secret, timestamp) {
-    const time = Math.floor((timestamp || Date.now()) / 30000);
-    const hmacDigest = totpHmac(secret, time.toString());
-    // biome-ignore lint/style/noNonNullAssertion: HMAC-SHA1 always produces 20 bytes; buffer indices are guaranteed valid
-    const offset = hmacDigest[hmacDigest.length - 1] & 0x0f;
-    // biome-ignore lint/style/noNonNullAssertion: HMAC-SHA1 always produces 20 bytes; buffer indices are guaranteed valid
-    const b0 = hmacDigest[offset] & 0x7f;
-    // biome-ignore lint/style/noNonNullAssertion: HMAC-SHA1 always produces 20 bytes; buffer indices are guaranteed valid
-    const b1 = hmacDigest[offset + 1] & 0xff;
-    // biome-ignore lint/style/noNonNullAssertion: HMAC-SHA1 always produces 20 bytes; buffer indices are guaranteed valid
-    const b2 = hmacDigest[offset + 2] & 0xff;
-    // biome-ignore lint/style/noNonNullAssertion: HMAC-SHA1 always produces 20 bytes; buffer indices are guaranteed valid
-    const b3 = hmacDigest[offset + 3] & 0xff;
-    const code = ((b0 << 24) | (b1 << 16) | (b2 << 8) | b3) % 1000000;
-    return code.toString().padStart(6, '0');
-}
-/**
- * Verify TOTP code
- */
-function verifyCode(secret, code, window = 1) {
-    const timestamp = Date.now();
-    // Check current and adjacent time windows
-    for (let i = -window; i <= window; i++) {
-        const testTime = timestamp + i * 30000;
-        const testCode = generateCode(secret, testTime);
-        if (testCode.length === code.length &&
-            timingSafeEqual(Buffer.from(testCode), Buffer.from(code))) {
-            return true;
-        }
-    }
-    return false;
-}
-export const TwoFactorAuth = {
-    generateSecret,
-    generateCode,
-    verifyCode,
-};

package/dist/security/authorization.d.ts

@@ -1,211 +0,0 @@
-/**
- * Authorization System
- *
- * Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC)
- */
-export interface Permission {
-    resource: string;
-    action: string;
-    conditions?: Record<string, unknown>;
-}
-export interface Role {
-    id: string;
-    name: string;
-    description?: string;
-    permissions: Permission[];
-    inherits?: string[];
-}
-export interface Policy {
-    id: string;
-    name: string;
-    effect: 'allow' | 'deny';
-    resources: string[];
-    actions: string[];
-    conditions?: PolicyCondition[];
-    priority?: number;
-}
-export interface PolicyCondition {
-    field: string;
-    operator: 'eq' | 'ne' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'contains';
-    value: unknown;
-}
-export interface AuthorizationContext {
-    user: {
-        id: string;
-        roles: string[];
-        attributes?: Record<string, unknown>;
-    };
-    resource?: {
-        type: string;
-        id?: string;
-        owner?: string;
-        attributes?: Record<string, unknown>;
-    };
-    environment?: {
-        time?: Date;
-        ip?: string;
-        userAgent?: string;
-    };
-}
-/**
- * Authorization system
- */
-export declare class AuthorizationSystem {
-    private roles;
-    private policies;
-    /**
-     * Register role
-     */
-    registerRole(role: Role): void;
-    /**
-     * Get role
-     */
-    getRole(roleId: string): Role | undefined;
-    /**
-     * Register policy
-     */
-    registerPolicy(policy: Policy): void;
-    /**
-     * Check if user has permission (RBAC)
-     */
-    hasPermission(userRoles: string[], resource: string, action: string): boolean;
-    /**
-     * Check access with policies (ABAC)
-     */
-    checkAccess(context: AuthorizationContext, resource: string, action: string): {
-        allowed: boolean;
-        reason?: string;
-    };
-    /**
-     * Get all permissions for roles
-     */
-    private getUserPermissions;
-    /**
-     * Get applicable policies
-     */
-    private getApplicablePolicies;
-    /**
-     * Match resource pattern
-     */
-    private matchesResource;
-    /**
-     * Match action pattern
-     */
-    private matchesAction;
-    /**
-     * Evaluate policy conditions
-     */
-    private evaluateConditions;
-    /**
-     * Get value from context
-     */
-    private getContextValue;
-    /**
-     * Evaluate single condition
-     */
-    private evaluateCondition;
-    /**
-     * Check if user owns resource
-     */
-    ownsResource(userId: string, resource: {
-        owner?: string;
-    }): boolean;
-    /**
-     * Clear all roles and policies
-     */
-    clear(): void;
-}
-/**
- * Global authorization instance
- */
-export declare const authorization: AuthorizationSystem;
-/**
- * Common roles — aligned with DB schema (`users.role` column)
- * and `UserRoleSchema` in @revealui/contracts.
- *
- * Values: owner | admin | editor | viewer | agent | contributor
- */
-export declare const CommonRoles: Record<string, Role>;
-/**
- * Permission builder
- */
-export declare class PermissionBuilder {
-    private permission;
-    resource(resource: string): this;
-    action(action: string): this;
-    conditions(conditions: Record<string, unknown>): this;
-    build(): Permission;
-}
-/**
- * Policy builder
- */
-export declare class PolicyBuilder {
-    private policy;
-    id(id: string): this;
-    name(name: string): this;
-    allow(): this;
-    deny(): this;
-    resources(...resources: string[]): this;
-    actions(...actions: string[]): this;
-    condition(field: string, operator: PolicyCondition['operator'], value: unknown): this;
-    priority(priority: number): this;
-    build(): Policy;
-}
-/**
- * Authorization decorators
- */
-export declare function RequirePermission(resource: string, action: string): (_target: object, _propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
-export declare function RequireRole(requiredRole: string): (_target: object, _propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
-/**
- * Authorization middleware
- */
-export declare function createAuthorizationMiddleware<TRequest = unknown>(getUser: (request: TRequest) => {
-    id: string;
-    roles: string[];
-}, resource: string, action: string): (request: TRequest, next: () => Promise<unknown>) => Promise<unknown>;
-/**
- * Resource ownership check
- */
-export declare function canAccessResource(userId: string, userRoles: string[], resource: {
-    type: string;
-    id?: string;
-    owner?: string;
-}, action: string): boolean;
-/**
- * Attribute-based access control helper
- */
-export declare function checkAttributeAccess(context: AuthorizationContext, resource: string, action: string, requiredAttributes?: Record<string, unknown>): boolean;
-/**
- * Permission cache for performance
- */
-export declare class PermissionCache {
-    private cache;
-    private ttl;
-    private maxEntries;
-    constructor(ttl?: number, maxEntries?: number);
-    /**
-     * Get cached permission
-     */
-    get(userId: string, resource: string, action: string): boolean | undefined;
-    /**
-     * Set cached permission
-     */
-    set(userId: string, resource: string, action: string, allowed: boolean): void;
-    /**
-     * Clear cache for user
-     */
-    clearUser(userId: string): void;
-    /**
-     * Clear all cache
-     */
-    clear(): void;
-    /**
-     * Get cache key
-     */
-    private getCacheKey;
-}
-/**
- * Global permission cache
- */
-export declare const permissionCache: PermissionCache;
-//# sourceMappingURL=authorization.d.ts.map

package/dist/security/authorization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/security/authorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,UAAU,CAAC;IACxE,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,IAAI,CAAC;QACZ,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,QAAQ,CAAkC;IAElD;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI9B;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIzC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpC;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAY7E;;OAEG;IACH,WAAW,CACT,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAyBxC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA4B1B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgB7B;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAgBvB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmCzB;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO;IAInE;;OAEG;IACH,KAAK,IAAI,IAAI;CAId;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,qBAA4B,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CA8Db,CAAC;AAEjC;;GAEG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAA2B;IAE7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAKrD,KAAK,IAAI,UAAU;CAOpB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAKZ;IAEF,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKpB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,KAAK,IAAI,IAAI;IAKb,IAAI,IAAI,IAAI;IAKZ,SAAS,CAAC,GAAG,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAKvC,OAAO,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAKnC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IASrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKhC,KAAK,IAAI,MAAM;CAOhB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IACxD,SAAS,MAAM,EAAE,cAAc,MAAM,EAAE,YAAY,kBAAkB,wBAe9E;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,IACtC,SAAS,MAAM,EAAE,cAAc,MAAM,EAAE,YAAY,kBAAkB,wBAe9E;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,GAAG,OAAO,EAC9D,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,IAEN,SAAS,QAAQ,EAAE,MAAM,MAAM,OAAO,CAAC,OAAO,CAAC,sBASxD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,EACnB,QAAQ,EAAE;IACR,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,MAAM,EAAE,MAAM,GACb,OAAO,CAYT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3C,OAAO,CAkBT;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAmE;IAChF,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,UAAU,CAAS;gBAEf,GAAG,GAAE,MAAe,EAAE,UAAU,GAAE,MAAe;IAM7D;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAiB1E;;OAEG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IA0B7E;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ/B;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACH,OAAO,CAAC,WAAW;CAGpB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,iBAAwB,CAAC"}