@riligar/auth-elysia 1.0.4

package/dist/index.esm.js

@@ -0,0 +1,404 @@
+import { Elysia } from 'elysia';
+
+/**
+ * @riligar/auth-elysia
+ * Plugin de autenticação para ElysiaJS - Auth-as-a-Service
+ */
+
+
+/**
+ * Configuração padrão do plugin
+ */
+const DEFAULT_CONFIG = {
+    prefix: '/auth',
+    secretKey: process.env.AUTH_SECRET_KEY || 'your-secret-key',
+    apiUrl: process.env.AUTH_API_URL || 'https://manager.myauth.click',
+    cookieName: 'auth-token',
+    cookieOptions: {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: 86400, // 24 horas
+    },
+    excludePaths: ['/auth/login', '/auth/register', '/auth/session'],
+    onUnauthorized: set => {
+        set.status = 401;
+        return { error: 'Unauthorized', message: 'Token inválido ou expirado' }
+    },
+};
+
+/**
+ * Cliente Auth com verificação JWT local + JWKS
+ */
+class RiLiGarAuthClient {
+    constructor(baseUrl, secretKey) {
+        this.baseUrl = baseUrl;
+        this.secretKey = secretKey;
+        // 🚀 Cache para JWKS (chaves públicas)
+        this.jwksCache = null;
+        this.jwksCacheExpiry = 0;
+        this.jwksCacheTTL = 3600000; // 1 hora em ms
+    }
+
+    // 🔑 Buscar e cachear JWKS
+    async getJWKS() {
+        const now = Date.now();
+
+        // Retorna cache se ainda válido
+        if (this.jwksCache && now < this.jwksCacheExpiry) {
+            return this.jwksCache
+        }
+
+        try {
+            const response = await fetch(`${this.baseUrl}/.well-known/jwks.json`);
+            if (response.ok) {
+                this.jwksCache = await response.json();
+                this.jwksCacheExpiry = now + this.jwksCacheTTL;
+                return this.jwksCache
+            }
+        } catch (error) {
+            console.warn('JWKS fetch failed, falling back to remote verification:', error.message);
+        }
+
+        return null
+    }
+
+    // ⚡ Verificação JWT local (usando crypto nativo do Bun)
+    async verifyJWTLocal(token) {
+        try {
+            const jwks = await this.getJWKS();
+            if (!jwks?.keys?.length) return null
+
+            // Decode JWT header para pegar kid e alg
+            const [headerB64] = token.split('.');
+            const header = JSON.parse(atob(headerB64));
+
+            // Encontrar a chave correspondente
+            const jwk = jwks.keys.find(k => k.kid === header.kid || k.alg === header.alg);
+            if (!jwk) return null
+
+            // Preparar dados para verificação
+            const [headerB64Url, payloadB64Url, signatureB64Url] = token.split('.');
+            const data = new TextEncoder().encode(`${headerB64Url}.${payloadB64Url}`);
+
+            const signature = new Uint8Array(Array.from(atob(signatureB64Url.replace(/-/g, '+').replace(/_/g, '/'))).map(c => c.charCodeAt(0)));
+
+            let key;
+            let algorithm;
+
+            // Suporte para diferentes algoritmos
+            if (header.alg === 'HS256' || jwk.kty === 'oct') {
+                // HMAC com secret key
+                const secret = new TextEncoder().encode(this.secretKey);
+                key = await crypto.subtle.importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+                algorithm = 'HMAC';
+            } else if (header.alg === 'RS256' || jwk.kty === 'RSA') {
+                // RSA com chave pública JWKS
+                if (!jwk.n || !jwk.e) return null
+
+                // Converter base64url para ArrayBuffer
+                const nBuffer = this.base64urlToArrayBuffer(jwk.n);
+                const eBuffer = this.base64urlToArrayBuffer(jwk.e);
+
+                key = await crypto.subtle.importKey(
+                    'jwk',
+                    {
+                        kty: 'RSA',
+                        n: jwk.n,
+                        e: jwk.e,
+                        alg: 'RS256',
+                        use: 'sig',
+                    },
+                    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+                    false,
+                    ['verify']
+                );
+                algorithm = 'RSASSA-PKCS1-v1_5';
+            } else {
+                console.warn('Algoritmo JWT não suportado:', header.alg);
+                return null
+            }
+
+            // Verificar assinatura
+            const isValid = await crypto.subtle.verify(algorithm, key, signature, data);
+            if (!isValid) return null
+
+            // Decode payload
+            const payload = JSON.parse(atob(payloadB64Url));
+
+            // Verificar expiração
+            if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+                return null
+            }
+
+            return payload
+        } catch (error) {
+            console.warn('JWT local verification failed:', error.message);
+            return null
+        }
+    }
+
+    // Utilitário para converter base64url para ArrayBuffer
+    base64urlToArrayBuffer(base64url) {
+        const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+        const padding = '='.repeat((4 - (base64.length % 4)) % 4);
+        const base64WithPadding = base64 + padding;
+
+        const binaryString = atob(base64WithPadding);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        return bytes.buffer
+    }
+
+    // ⚡ Verificar sessão OTIMIZADA (local + fallback remoto)
+    async verifySession(sessionToken) {
+        // 🚀 Primeira tentativa: Verificação local com JWKS
+        const localResult = await this.verifyJWTLocal(sessionToken);
+        if (localResult) {
+            return {
+                user: localResult,
+                verified_locally: true,
+                cached: true,
+            }
+        }
+
+        // 🔄 Fallback: Verificação remota
+        try {
+            const response = await fetch(`${this.baseUrl}/auth/session`, {
+                headers: {
+                    Authorization: `Bearer ${sessionToken}`,
+                    'X-API-Key': this.secretKey,
+                },
+            });
+
+            if (response.ok) {
+                const result = await response.json();
+                return {
+                    ...result,
+                    verified_locally: false,
+                    cached: false,
+                }
+            }
+        } catch (error) {
+            console.warn('Remote session verification failed:', error.message);
+        }
+
+        return null
+    }
+}
+
+/**
+ * Utilitário para fazer requisições HTTP
+ */
+async function fetchAuth(url, options = {}) {
+    try {
+        const response = await fetch(url, {
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers,
+            },
+            ...options,
+        });
+
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`)
+        }
+
+        return await response.json()
+    } catch (error) {
+        console.error('Auth fetch error:', error);
+        throw error
+    }
+}
+
+/**
+ * Middleware de autenticação JWT com verificação JWKS local
+ */
+function createAuthMiddleware(config, authClient) {
+    return async ({ request, set, cookie }) => {
+        // Verificar se a rota deve ser excluída da autenticação
+        const path = new URL(request.url).pathname;
+        if (config.excludePaths.some(excluded => path.startsWith(excluded))) {
+            return
+        }
+
+        // Buscar token no cookie ou header Authorization
+        let token = cookie[config.cookieName]?.value;
+
+        if (!token) {
+            const authHeader = request.headers.get('authorization');
+            if (authHeader?.startsWith('Bearer ')) {
+                token = authHeader.substring(7);
+            }
+        }
+
+        if (!token) {
+            return config.onUnauthorized(set)
+        }
+
+        try {
+            // ⚡ Verificação otimizada com JWKS local + fallback remoto
+            const userSession = await authClient.verifySession(token);
+
+            if (!userSession) {
+                return config.onUnauthorized(set)
+            }
+
+            // Adicionar usuário ao contexto da requisição
+            request.user = userSession.user;
+            request.authMeta = {
+                verified_locally: userSession.verified_locally,
+                cached: userSession.cached,
+            };
+        } catch (error) {
+            return config.onUnauthorized(set)
+        }
+    }
+}
+
+/**
+ * Plugin principal de autenticação
+ */
+function authPlugin(userConfig = {}) {
+    const config = { ...DEFAULT_CONFIG, ...userConfig };
+
+    // Instanciar cliente Auth
+    const authClient = new RiLiGarAuthClient(config.apiUrl, config.secretKey);
+
+    return new Elysia({ name: 'auth-plugin' })
+        .derive(({ request }) => ({
+            user: request.user || null,
+            authMeta: request.authMeta || null,
+        }))
+        .onBeforeHandle(createAuthMiddleware(config, authClient))
+        .group(config.prefix, app =>
+            app
+                // Rota de login
+                .post('/login', async ({ body, set, cookie }) => {
+                    try {
+                        const { email, password } = body;
+
+                        if (!email || !password) {
+                            set.status = 400;
+                            return { error: 'Email e senha são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-in/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({ email, password }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        });
+
+                        if (response.token) {
+                            cookie[config.cookieName].set({
+                                value: response.token,
+                                ...config.cookieOptions,
+                            });
+                        }
+
+                        return {
+                            message: 'Login realizado com sucesso!',
+                            user: response.user,
+                            token: response.token,
+                            session: response.session,
+                        }
+                    } catch (error) {
+                        set.status = 401;
+                        return { error: 'Login failed', message: error.message }
+                    }
+                })
+
+                // Rota de registro
+                .post('/register', async ({ body, set }) => {
+                    try {
+                        const { email, password, name, organizationId } = body;
+
+                        if (!email || !password || !name) {
+                            set.status = 400;
+                            return { error: 'Email, senha e nome são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-up/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({
+                                email,
+                                password,
+                                name,
+                                ...(organizationId && { organizationId }),
+                            }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        });
+
+                        return {
+                            message: 'Usuário registrado com sucesso!',
+                            user: {
+                                id: response.user?.id,
+                                email: response.user?.email,
+                                name: response.user?.name,
+                            },
+                        }
+                    } catch (error) {
+                        set.status = 400;
+                        return { error: 'Registration failed', message: error.message }
+                    }
+                })
+
+                // Rota de logout
+                .post('/logout', async ({ cookie, set, headers }) => {
+                    try {
+                        const token = headers.authorization?.replace('Bearer ', '') || cookie[config.cookieName]?.value;
+
+                        if (token) {
+                            // Fazer logout no servidor de auth
+                            await fetchAuth(`${config.apiUrl}/auth/sign-out`, {
+                                method: 'POST',
+                                headers: {
+                                    Authorization: `Bearer ${token}`,
+                                    'X-API-Key': config.secretKey,
+                                },
+                            }).catch(() => {
+                                // Ignorar erros do logout remoto
+                            });
+                        }
+
+                        // Remover cookie local
+                        cookie[config.cookieName].remove();
+
+                        return { message: 'Logout realizado com sucesso!' }
+                    } catch (error) {
+                        set.status = 400;
+                        return { error: 'Erro ao fazer logout', message: error.message }
+                    }
+                })
+
+                // Verificar sessão (substitui o /refresh)
+                .get('/session', ({ user, authMeta, set }) => {
+                    if (!user) {
+                        set.status = 401;
+                        return { error: 'Not authenticated' }
+                    }
+                    return {
+                        user,
+                        meta: authMeta,
+                        verified_at: new Date().toISOString(),
+                    }
+                })
+
+                // Status do usuário atual
+                .get('/me', ({ user, set }) => {
+                    if (!user) {
+                        set.status = 401;
+                        return { error: 'Not authenticated' }
+                    }
+                    return { user }
+                })
+        )
+}
+
+export { DEFAULT_CONFIG, RiLiGarAuthClient, authPlugin, authPlugin as default, fetchAuth };