@riligar/auth-elysia 1.0.4

package/src/index.js

@@ -0,0 +1,407 @@
+/**
+ * @riligar/auth-elysia
+ * Plugin de autenticação para ElysiaJS - Auth-as-a-Service
+ */
+
+import { Elysia } from 'elysia'
+
+/**
+ * Configuração padrão do plugin
+ */
+const DEFAULT_CONFIG = {
+    prefix: '/auth',
+    secretKey: process.env.AUTH_SECRET_KEY || 'your-secret-key',
+    apiUrl: process.env.AUTH_API_URL || 'https://manager.myauth.click',
+    cookieName: 'auth-token',
+    cookieOptions: {
+        httpOnly: true,
+        secure: process.env.NODE_ENV === 'production',
+        sameSite: 'lax',
+        maxAge: 86400, // 24 horas
+    },
+    excludePaths: ['/auth/login', '/auth/register', '/auth/session'],
+    onUnauthorized: set => {
+        set.status = 401
+        return { error: 'Unauthorized', message: 'Token inválido ou expirado' }
+    },
+}
+
+/**
+ * Cliente Auth com verificação JWT local + JWKS
+ */
+class RiLiGarAuthClient {
+    constructor(baseUrl, secretKey) {
+        this.baseUrl = baseUrl
+        this.secretKey = secretKey
+        // 🚀 Cache para JWKS (chaves públicas)
+        this.jwksCache = null
+        this.jwksCacheExpiry = 0
+        this.jwksCacheTTL = 3600000 // 1 hora em ms
+    }
+
+    // 🔑 Buscar e cachear JWKS
+    async getJWKS() {
+        const now = Date.now()
+
+        // Retorna cache se ainda válido
+        if (this.jwksCache && now < this.jwksCacheExpiry) {
+            return this.jwksCache
+        }
+
+        try {
+            const response = await fetch(`${this.baseUrl}/.well-known/jwks.json`)
+            if (response.ok) {
+                this.jwksCache = await response.json()
+                this.jwksCacheExpiry = now + this.jwksCacheTTL
+                return this.jwksCache
+            }
+        } catch (error) {
+            console.warn('JWKS fetch failed, falling back to remote verification:', error.message)
+        }
+
+        return null
+    }
+
+    // ⚡ Verificação JWT local (usando crypto nativo do Bun)
+    async verifyJWTLocal(token) {
+        try {
+            const jwks = await this.getJWKS()
+            if (!jwks?.keys?.length) return null
+
+            // Decode JWT header para pegar kid e alg
+            const [headerB64] = token.split('.')
+            const header = JSON.parse(atob(headerB64))
+
+            // Encontrar a chave correspondente
+            const jwk = jwks.keys.find(k => k.kid === header.kid || k.alg === header.alg)
+            if (!jwk) return null
+
+            // Preparar dados para verificação
+            const [headerB64Url, payloadB64Url, signatureB64Url] = token.split('.')
+            const data = new TextEncoder().encode(`${headerB64Url}.${payloadB64Url}`)
+
+            const signature = new Uint8Array(Array.from(atob(signatureB64Url.replace(/-/g, '+').replace(/_/g, '/'))).map(c => c.charCodeAt(0)))
+
+            let key
+            let algorithm
+
+            // Suporte para diferentes algoritmos
+            if (header.alg === 'HS256' || jwk.kty === 'oct') {
+                // HMAC com secret key
+                const secret = new TextEncoder().encode(this.secretKey)
+                key = await crypto.subtle.importKey('raw', secret, { name: 'HMAC', hash: 'SHA-256' }, false, ['verify'])
+                algorithm = 'HMAC'
+            } else if (header.alg === 'RS256' || jwk.kty === 'RSA') {
+                // RSA com chave pública JWKS
+                if (!jwk.n || !jwk.e) return null
+
+                // Converter base64url para ArrayBuffer
+                const nBuffer = this.base64urlToArrayBuffer(jwk.n)
+                const eBuffer = this.base64urlToArrayBuffer(jwk.e)
+
+                key = await crypto.subtle.importKey(
+                    'jwk',
+                    {
+                        kty: 'RSA',
+                        n: jwk.n,
+                        e: jwk.e,
+                        alg: 'RS256',
+                        use: 'sig',
+                    },
+                    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+                    false,
+                    ['verify']
+                )
+                algorithm = 'RSASSA-PKCS1-v1_5'
+            } else {
+                console.warn('Algoritmo JWT não suportado:', header.alg)
+                return null
+            }
+
+            // Verificar assinatura
+            const isValid = await crypto.subtle.verify(algorithm, key, signature, data)
+            if (!isValid) return null
+
+            // Decode payload
+            const payload = JSON.parse(atob(payloadB64Url))
+
+            // Verificar expiração
+            if (payload.exp && payload.exp < Math.floor(Date.now() / 1000)) {
+                return null
+            }
+
+            return payload
+        } catch (error) {
+            console.warn('JWT local verification failed:', error.message)
+            return null
+        }
+    }
+
+    // Utilitário para converter base64url para ArrayBuffer
+    base64urlToArrayBuffer(base64url) {
+        const base64 = base64url.replace(/-/g, '+').replace(/_/g, '/')
+        const padding = '='.repeat((4 - (base64.length % 4)) % 4)
+        const base64WithPadding = base64 + padding
+
+        const binaryString = atob(base64WithPadding)
+        const bytes = new Uint8Array(binaryString.length)
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i)
+        }
+        return bytes.buffer
+    }
+
+    // ⚡ Verificar sessão OTIMIZADA (local + fallback remoto)
+    async verifySession(sessionToken) {
+        // 🚀 Primeira tentativa: Verificação local com JWKS
+        const localResult = await this.verifyJWTLocal(sessionToken)
+        if (localResult) {
+            return {
+                user: localResult,
+                verified_locally: true,
+                cached: true,
+            }
+        }
+
+        // 🔄 Fallback: Verificação remota
+        try {
+            const response = await fetch(`${this.baseUrl}/auth/session`, {
+                headers: {
+                    Authorization: `Bearer ${sessionToken}`,
+                    'X-API-Key': this.secretKey,
+                },
+            })
+
+            if (response.ok) {
+                const result = await response.json()
+                return {
+                    ...result,
+                    verified_locally: false,
+                    cached: false,
+                }
+            }
+        } catch (error) {
+            console.warn('Remote session verification failed:', error.message)
+        }
+
+        return null
+    }
+}
+
+/**
+ * Utilitário para fazer requisições HTTP
+ */
+async function fetchAuth(url, options = {}) {
+    try {
+        const response = await fetch(url, {
+            headers: {
+                'Content-Type': 'application/json',
+                ...options.headers,
+            },
+            ...options,
+        })
+
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`)
+        }
+
+        return await response.json()
+    } catch (error) {
+        console.error('Auth fetch error:', error)
+        throw error
+    }
+}
+
+/**
+ * Middleware de autenticação JWT com verificação JWKS local
+ */
+function createAuthMiddleware(config, authClient) {
+    return async ({ request, set, cookie }) => {
+        // Verificar se a rota deve ser excluída da autenticação
+        const path = new URL(request.url).pathname
+        if (config.excludePaths.some(excluded => path.startsWith(excluded))) {
+            return
+        }
+
+        // Buscar token no cookie ou header Authorization
+        let token = cookie[config.cookieName]?.value
+
+        if (!token) {
+            const authHeader = request.headers.get('authorization')
+            if (authHeader?.startsWith('Bearer ')) {
+                token = authHeader.substring(7)
+            }
+        }
+
+        if (!token) {
+            return config.onUnauthorized(set)
+        }
+
+        try {
+            // ⚡ Verificação otimizada com JWKS local + fallback remoto
+            const userSession = await authClient.verifySession(token)
+
+            if (!userSession) {
+                return config.onUnauthorized(set)
+            }
+
+            // Adicionar usuário ao contexto da requisição
+            request.user = userSession.user
+            request.authMeta = {
+                verified_locally: userSession.verified_locally,
+                cached: userSession.cached,
+            }
+        } catch (error) {
+            return config.onUnauthorized(set)
+        }
+    }
+}
+
+/**
+ * Plugin principal de autenticação
+ */
+export function authPlugin(userConfig = {}) {
+    const config = { ...DEFAULT_CONFIG, ...userConfig }
+
+    // Instanciar cliente Auth
+    const authClient = new RiLiGarAuthClient(config.apiUrl, config.secretKey)
+
+    return new Elysia({ name: 'auth-plugin' })
+        .derive(({ request }) => ({
+            user: request.user || null,
+            authMeta: request.authMeta || null,
+        }))
+        .onBeforeHandle(createAuthMiddleware(config, authClient))
+        .group(config.prefix, app =>
+            app
+                // Rota de login
+                .post('/login', async ({ body, set, cookie }) => {
+                    try {
+                        const { email, password } = body
+
+                        if (!email || !password) {
+                            set.status = 400
+                            return { error: 'Email e senha são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-in/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({ email, password }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        })
+
+                        if (response.token) {
+                            cookie[config.cookieName].set({
+                                value: response.token,
+                                ...config.cookieOptions,
+                            })
+                        }
+
+                        return {
+                            message: 'Login realizado com sucesso!',
+                            user: response.user,
+                            token: response.token,
+                            session: response.session,
+                        }
+                    } catch (error) {
+                        set.status = 401
+                        return { error: 'Login failed', message: error.message }
+                    }
+                })
+
+                // Rota de registro
+                .post('/register', async ({ body, set }) => {
+                    try {
+                        const { email, password, name, organizationId } = body
+
+                        if (!email || !password || !name) {
+                            set.status = 400
+                            return { error: 'Email, senha e nome são obrigatórios' }
+                        }
+
+                        const response = await fetchAuth(`${config.apiUrl}/auth/sign-up/email`, {
+                            method: 'POST',
+                            body: JSON.stringify({
+                                email,
+                                password,
+                                name,
+                                ...(organizationId && { organizationId }),
+                            }),
+                            headers: {
+                                'X-API-Key': config.secretKey,
+                            },
+                        })
+
+                        return {
+                            message: 'Usuário registrado com sucesso!',
+                            user: {
+                                id: response.user?.id,
+                                email: response.user?.email,
+                                name: response.user?.name,
+                            },
+                        }
+                    } catch (error) {
+                        set.status = 400
+                        return { error: 'Registration failed', message: error.message }
+                    }
+                })
+
+                // Rota de logout
+                .post('/logout', async ({ cookie, set, headers }) => {
+                    try {
+                        const token = headers.authorization?.replace('Bearer ', '') || cookie[config.cookieName]?.value
+
+                        if (token) {
+                            // Fazer logout no servidor de auth
+                            await fetchAuth(`${config.apiUrl}/auth/sign-out`, {
+                                method: 'POST',
+                                headers: {
+                                    Authorization: `Bearer ${token}`,
+                                    'X-API-Key': config.secretKey,
+                                },
+                            }).catch(() => {
+                                // Ignorar erros do logout remoto
+                            })
+                        }
+
+                        // Remover cookie local
+                        cookie[config.cookieName].remove()
+
+                        return { message: 'Logout realizado com sucesso!' }
+                    } catch (error) {
+                        set.status = 400
+                        return { error: 'Erro ao fazer logout', message: error.message }
+                    }
+                })
+
+                // Verificar sessão (substitui o /refresh)
+                .get('/session', ({ user, authMeta, set }) => {
+                    if (!user) {
+                        set.status = 401
+                        return { error: 'Not authenticated' }
+                    }
+                    return {
+                        user,
+                        meta: authMeta,
+                        verified_at: new Date().toISOString(),
+                    }
+                })
+
+                // Status do usuário atual
+                .get('/me', ({ user, set }) => {
+                    if (!user) {
+                        set.status = 401
+                        return { error: 'Not authenticated' }
+                    }
+                    return { user }
+                })
+        )
+}
+
+// Exportar configuração padrão e utilitários
+export { DEFAULT_CONFIG, fetchAuth, RiLiGarAuthClient }
+
+// Export default para compatibilidade
+export default authPlugin

package/src/types.d.ts

@@ -0,0 +1,52 @@
+export interface AuthConfig {
+    prefix?: string;
+    secretKey?: string;
+    apiUrl?: string;
+    cookieName?: string;
+    cookieOptions?: {
+        httpOnly?: boolean;
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none';
+        maxAge?: number;
+    };
+    excludePaths?: string[];
+    onUnauthorized?: (set: any) => any;
+}
+
+export interface User {
+    id: string;
+    email: string;
+    name?: string;
+    role?: string;
+    permissions?: string[];
+    memberships?: OrganizationMembership[];
+    [key: string]: any;
+}
+
+export interface OrganizationMembership {
+    organizationId: string;
+    role: string;
+    organization?: {
+        id: string;
+        name: string;
+        [key: string]: any;
+    };
+}
+
+export interface AuthMeta {
+    verified_locally: boolean;
+    cached: boolean;
+}
+
+export interface AuthResponse {
+    token?: string;
+    user?: User;
+    session?: any;
+    message?: string;
+    error?: string;
+    meta?: AuthMeta;
+}
+
+export function authPlugin(config?: AuthConfig): any;
+export const DEFAULT_CONFIG: AuthConfig;
+export function fetchAuth(url: string, options?: RequestInit): Promise<any>;