@riligar/auth-elysia 1.0.4

package/dist/index.js

@@ -0,0 +1,412 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var elysia = require('elysia');
+
+/**
+ * @riligar/auth-elysia
+ * Plugin de autenticação para ElysiaJS - Auth-as-a-Service
+ */
+
+
+/**
+ * Configuração padrão do plugin
+ */
+const DEFAULT_CONFIG = {
+    prefix: '/auth',
+    secretKey: process.env.AUTH_SECRET_KEY || 'your-secret-key',
+    apiUrl: process.env.AUTH_API_URL || 'https://manager.myauth.click',
+    cookieName: 'auth-token',
+    cookieOptions: {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: 86400, // 24 horas
+    },
+    excludePaths: ['/auth/login', '/auth/register', '/auth/session'],
+    onUnauthorized: set => {
+        set.status = 401;
+        return { error: 'Unauthorized', message: 'Token inválido ou expirado' }
+    },
+};
+
+/**
+ * Cliente Auth com verificação JWT local + JWKS
+ */
+class RiLiGarAuthClient {
+    constructor(baseUrl, secretKey) {
+        this.baseUrl = baseUrl;
+        this.secretKey = secretKey;
+        // 🚀 Cache para JWKS (chaves públicas)
+        this.jwksCache = null;
+        this.jwksCacheExpiry = 0;
+        this.jwksCacheTTL = 3600000; // 1 hora em ms
+    }
+
+    // 🔑 Buscar e cachear JWKS
+    async getJWKS() {
+        const now = Date.now();
+
+        // Retorna cache se ainda válido
+        if (this.jwksCache && now < this.jwksCacheExpiry) {
+            return this.jwksCache
+        }
+
+        try {
+            const response = await fetch(`${this.baseUrl}/.well-known/jwks.json`);
+            if (response.ok) {
+                this.jwksCache = await response.json();
+                this.jwksCacheExpiry = now + this.jwksCacheTTL;
+                return this.jwksCache
+            }
+        } catch (error) {
+            console.warn('JWKS fetch failed, falling back to remote verification:', error.message);
+        }
+
+        return null
+    }
+
+    // ⚡ Verificação JWT local (usando crypto nativo do Bun)
+    async verifyJWTLocal(token) {
+        try {
+            const jwks = await this.getJWKS();
+            if (!jwks?.keys?.length) return null
+
+            // Decode JWT header para pegar kid e alg
+            const [headerB64] = token.split('.');
+            const header = JSON.parse(atob(headerB64));
+
+            // Encontrar a chave correspondente
+            const jwk = jwks.keys.find(k => k.kid === header.kid || k.alg === header.alg);
+            if (!jwk) return null
+
+            // Preparar dados para verificação
+            const [headerB64Url, payloadB64Url, signatureB64Url] = token.split('.');
+            const data = new TextEncoder().encode(`${headerB64Url}.${payloadB64Url}`);
+
+            const signature = new Uint8Array(Array.from(atob(signatureB64Url.replace(/-/g, '+').replace(/_/g, '/'))).map(c => c.charCodeAt(0)));
+
+            let key;
+            let algorithm;
+
+            // Suporte para diferentes algoritmos
+            if (header.alg === 'HS256' || jwk.kty === 'oct') {
+                // HMAC com secret key
+                const secret = new TextEncoder().encode(this.secretKey);
+                key = await crypto.subtle.importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
+                algorithm = 'HMAC';
+            } else if (header.alg === 'RS256' || jwk.kty === 'RSA') {
+                // RSA com chave pública JWKS
+                if (!jwk.n || !jwk.e) return null
+
+                // Converter base64url para ArrayBuffer
+                const nBuffer = this.base64urlToArrayBuffer(jwk.n);
+                const eBuffer = this.base64urlToArrayBuffer(jwk.e);
+
+                key = await crypto.subtle.importKey(
+                    'jwk',
+                    {
+                        kty: 'RSA',
+                        n: jwk.n,
+                        e: jwk.e,
+                        alg: 'RS256',
+                        use: 'sig',
+                    },
+                    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+                    false,
+                    ['verify']
+                );
+                algorithm = 'RSASSA-PKCS1-v1_5';
+            } else {
+                console.warn('Algoritmo JWT não suportado:', header.alg);
+                return null
+            }
+
+            // Verificar assinatura
+            const isValid = await crypto.subtle.verify(algorithm, key, signature, data);
+            if (!isValid) return null
+
+            // Decode payload
+            const payload = JSON.parse(atob(payloadB64Url));
+
+            // Verificar expiração
+            if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+                return null
+            }
+
+            return payload
+        } catch (error) {
+            console.warn('JWT local verification failed:', error.message);
+            return null
+        }
+    }
+
+    // Utilitário para converter base64url para ArrayBuffer
+    base64urlToArrayBuffer(base64url) {
+        const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/');
+        const padding = '='.repeat((4 - (base64.length % 4)) % 4);
+        const base64WithPadding = base64 + padding;
+
+        const binaryString = atob(base64WithPadding);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        return bytes.buffer
+    }
+
+    // ⚡ Verificar sessão OTIMIZADA (local + fallback remoto)
+    async verifySession(sessionToken) {
+        // 🚀 Primeira tentativa: Verificação local com JWKS
+        const localResult = await this.verifyJWTLocal(sessionToken);
+        if (localResult) {
+            return {
+                user: localResult,
+                verified_locally: true,
+                cached: true,
+            }
+        }
+
+        // 🔄 Fallback: Verificação remota
+        try {
+            const response = await fetch(`${this.baseUrl}/auth/session`, {
+                headers: {
+                    Authorization: `Bearer ${sessionToken}`,
+                    'X-API-Key': this.secretKey,
+                },
+            });
+
+            if (response.ok) {
+                const result = await response.json();
+                return {
+                    ...result,
+                    verified_locally: false,
+                    cached: false,
+                }
+            }
+        } catch (error) {
+            console.warn('Remote session verification failed:', error.message);
+        }
+
+        return null
+    }
+}
+
+/**
+ * Utilitário para fazer requisições HTTP
+ */
+async function fetchAuth(url, options = {}) {
+    try {
+        const response = await fetch(url, {
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers,
+            },
+            ...options,
+        });
+
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`)
+        }
+
+        return await response.json()
+    } catch (error) {
+        console.error('Auth fetch error:', error);
+        throw error
+    }
+}
+
+/**
+ * Middleware de autenticação JWT com verificação JWKS local
+ */
+function createAuthMiddleware(config, authClient) {
+    return async ({ request, set, cookie }) => {
+        // Verificar se a rota deve ser excluída da autenticação
+        const path = new URL(request.url).pathname;
+        if (config.excludePaths.some(excluded => path.startsWith(excluded))) {
+            return
+        }
+
+        // Buscar token no cookie ou header Authorization
+        let token = cookie[config.cookieName]?.value;
+
+        if (!token) {
+            const authHeader = request.headers.get('authorization');
+            if (authHeader?.startsWith('Bearer ')) {
+                token = authHeader.substring(7);
+            }
+        }
+
+        if (!token) {
+            return config.onUnauthorized(set)
+        }
+
+        try {
+            // ⚡ Verificação otimizada com JWKS local + fallback remoto
+            const userSession = await authClient.verifySession(token);
+
+            if (!userSession) {
+                return config.onUnauthorized(set)
+            }
+
+            // Adicionar usuário ao contexto da requisição
+            request.user = userSession.user;
+            request.authMeta = {
+                verified_locally: userSession.verified_locally,
+                cached: userSession.cached,
+            };
+        } catch (error) {
+            return config.onUnauthorized(set)
+        }
+    }
+}
+
+/**
+ * Plugin principal de autenticação
+ */
+function authPlugin(userConfig = {}) {
+    const config = { ...DEFAULT_CONFIG, ...userConfig };
+
+    // Instanciar cliente Auth
+    const authClient = new RiLiGarAuthClient(config.apiUrl, config.secretKey);
+
+    return new elysia.Elysia({ name: 'auth-plugin' })
+        .derive(({ request }) => ({
+            user: request.user || null,
+            authMeta: request.authMeta || null,
+        }))
+        .onBeforeHandle(createAuthMiddleware(config, authClient))
+        .group(config.prefix, app =>
+            app
+                // Rota de login
+                .post('/login', async ({ body, set, cookie }) => {
+                    try {
+                        const { email, password } = body;
+
+                        if (!email || !password) {
+                            set.status = 400;
+                            return { error: 'Email e senha são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-in/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({ email, password }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        });
+
+                        if (response.token) {
+                            cookie[config.cookieName].set({
+                                value: response.token,
+                                ...config.cookieOptions,
+                            });
+                        }
+
+                        return {
+                            message: 'Login realizado com sucesso!',
+                            user: response.user,
+                            token: response.token,
+                            session: response.session,
+                        }
+                    } catch (error) {
+                        set.status = 401;
+                        return { error: 'Login failed', message: error.message }
+                    }
+                })
+
+                // Rota de registro
+                .post('/register', async ({ body, set }) => {
+                    try {
+                        const { email, password, name, organizationId } = body;
+
+                        if (!email || !password || !name) {
+                            set.status = 400;
+                            return { error: 'Email, senha e nome são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-up/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({
+                                email,
+                                password,
+                                name,
+                                ...(organizationId && { organizationId }),
+                            }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        });
+
+                        return {
+                            message: 'Usuário registrado com sucesso!',
+                            user: {
+                                id: response.user?.id,
+                                email: response.user?.email,
+                                name: response.user?.name,
+                            },
+                        }
+                    } catch (error) {
+                        set.status = 400;
+                        return { error: 'Registration failed', message: error.message }
+                    }
+                })
+
+                // Rota de logout
+                .post('/logout', async ({ cookie, set, headers }) => {
+                    try {
+                        const token = headers.authorization?.replace('Bearer ', '') || cookie[config.cookieName]?.value;
+
+                        if (token) {
+                            // Fazer logout no servidor de auth
+                            await fetchAuth(`${config.apiUrl}/auth/sign-out`, {
+                                method: 'POST',
+                                headers: {
+                                    Authorization: `Bearer ${token}`,
+                                    'X-API-Key': config.secretKey,
+                                },
+                            }).catch(() => {
+                                // Ignorar erros do logout remoto
+                            });
+                        }
+
+                        // Remover cookie local
+                        cookie[config.cookieName].remove();
+
+                        return { message: 'Logout realizado com sucesso!' }
+                    } catch (error) {
+                        set.status = 400;
+                        return { error: 'Erro ao fazer logout', message: error.message }
+                    }
+                })
+
+                // Verificar sessão (substitui o /refresh)
+                .get('/session', ({ user, authMeta, set }) => {
+                    if (!user) {
+                        set.status = 401;
+                        return { error: 'Not authenticated' }
+                    }
+                    return {
+                        user,
+                        meta: authMeta,
+                        verified_at: new Date().toISOString(),
+                    }
+                })
+
+                // Status do usuário atual
+                .get('/me', ({ user, set }) => {
+                    if (!user) {
+                        set.status = 401;
+                        return { error: 'Not authenticated' }
+                    }
+                    return { user }
+                })
+        )
+}
+
+exports.DEFAULT_CONFIG = DEFAULT_CONFIG;
+exports.RiLiGarAuthClient = RiLiGarAuthClient;
+exports.authPlugin = authPlugin;
+exports.default = authPlugin;
+exports.fetchAuth = fetchAuth;

package/package.json

@@ -0,0 +1,66 @@
+{
+    "name": "@riligar/auth-elysia",
+    "version": "1.0.4",
+    "type": "module",
+    "description": "Auth SDK for ElysiaJS with JWT and JWKS",
+    "main": "dist/index.js",
+    "module": "dist/index.esm.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.esm.js",
+            "require": "./dist/index.js"
+        }
+    },
+    "files": [
+        "dist",
+        "src"
+    ],
+    "scripts": {
+        "build": "rollup -c",
+        "dev": "rollup -c -w",
+        "test": "bun test",
+        "prepublishOnly": "bun run build",
+        "release": "semantic-release",
+        "release:dry-run": "semantic-release --dry-run"
+    },
+    "dependencies": {
+        "elysia": "^1.0.0"
+    },
+    "devDependencies": {
+        "@rollup/plugin-node-resolve": "^15.2.3",
+        "@rollup/plugin-commonjs": "^25.0.7",
+        "@rollup/plugin-typescript": "^11.1.6",
+        "@semantic-release/changelog": "^6.0.3",
+        "@semantic-release/git": "^10.0.1",
+        "@semantic-release/github": "^11.0.3",
+        "@semantic-release/npm": "^12.0.1",
+        "conventional-changelog-conventionalcommits": "^9.0.0",
+        "rollup": "^4.9.6",
+        "semantic-release": "^24.2.5",
+        "typescript": "^5.3.3",
+        "tslib": "^2.6.2"
+    },
+    "peerDependencies": {
+        "elysia": ">=1.0.0"
+    },
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/riligar-solutions/auth-elysia.git"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "keywords": [
+        "elysia",
+        "auth",
+        "middleware",
+        "plugin",
+        "jwt",
+        "authentication",
+        "riligar"
+    ],
+    "author": "Riligar",
+    "license": "MIT"
+}