@rudderjs/passport 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Suleiman Shahbari
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/Passport.d.ts

@@ -0,0 +1,41 @@
+export interface PassportScope {
+    id: string;
+    description: string;
+}
+export declare class Passport {
+    private static _scopes;
+    private static _tokenLifetime;
+    private static _refreshTokenLifetime;
+    private static _personalTokenLifetime;
+    private static _keyPath;
+    private static _privateKey;
+    private static _publicKey;
+    /** Define available OAuth scopes. */
+    static tokensCan(scopes: Record<string, string>): void;
+    /** Check if a scope is defined. */
+    static hasScope(id: string): boolean;
+    /** Get all defined scopes. */
+    static scopes(): PassportScope[];
+    /** Validate a list of scopes — returns only the valid ones. */
+    static validScopes(requested: string[]): string[];
+    static tokensExpireIn(ms: number): void;
+    static refreshTokensExpireIn(ms: number): void;
+    static personalAccessTokensExpireIn(ms: number): void;
+    static tokenLifetime(): number;
+    static refreshTokenLifetime(): number;
+    static personalTokenLifetime(): number;
+    /** Set the directory where RSA keys are stored. */
+    static loadKeysFrom(path: string): void;
+    /** Get the configured key path. */
+    static keyPath(): string;
+    /** Set keys directly (from environment variables). */
+    static setKeys(privateKey: string, publicKey: string): void;
+    /** Load keys from files or env. Returns { privateKey, publicKey }. */
+    static keys(): Promise<{
+        privateKey: string;
+        publicKey: string;
+    }>;
+    /** @internal */
+    static reset(): void;
+}
+//# sourceMappingURL=Passport.d.ts.map

package/dist/Passport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passport.d.ts","sourceRoot":"","sources":["../src/Passport.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAW,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,MAAM,CAAC,OAAO,CAA4B;IAClD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAiC;IAC9D,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAA2B;IAC/D,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAA+B;IACpE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAY;IACnC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAsB;IAChD,OAAO,CAAC,MAAM,CAAC,UAAU,CAAsB;IAI/C,qCAAqC;IACrC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAMtD,mCAAmC;IACnC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIpC,8BAA8B;IAC9B,MAAM,CAAC,MAAM,IAAI,aAAa,EAAE;IAIhC,+DAA+D;IAC/D,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAMjD,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IACvC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAC9C,MAAM,CAAC,4BAA4B,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAErD,MAAM,CAAC,aAAa,IAAI,MAAM;IAC9B,MAAM,CAAC,oBAAoB,IAAI,MAAM;IACrC,MAAM,CAAC,qBAAqB,IAAI,MAAM;IAItC,mDAAmD;IACnD,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAEvC,mCAAmC;IACnC,MAAM,CAAC,OAAO,IAAI,MAAM;IAExB,sDAAsD;IACtD,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAK3D,sEAAsE;WACzD,IAAI,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BvE,gBAAgB;IAChB,MAAM,CAAC,KAAK,IAAI,IAAI;CASrB"}

package/dist/Passport.js

@@ -0,0 +1,77 @@
+// ─── Passport Configuration Singleton ─────────────────────
+export class Passport {
+    static _scopes = new Map();
+    static _tokenLifetime = 15 * 24 * 60 * 60 * 1000; // 15 days
+    static _refreshTokenLifetime = 30 * 24 * 60 * 60 * 1000; // 30 days
+    static _personalTokenLifetime = 6 * 30 * 24 * 60 * 60 * 1000; // ~6 months
+    static _keyPath = 'storage';
+    static _privateKey = null;
+    static _publicKey = null;
+    // ── Scopes ──────────────────────────────────────────────
+    /** Define available OAuth scopes. */
+    static tokensCan(scopes) {
+        for (const [id, description] of Object.entries(scopes)) {
+            this._scopes.set(id, description);
+        }
+    }
+    /** Check if a scope is defined. */
+    static hasScope(id) {
+        return this._scopes.has(id);
+    }
+    /** Get all defined scopes. */
+    static scopes() {
+        return [...this._scopes.entries()].map(([id, description]) => ({ id, description }));
+    }
+    /** Validate a list of scopes — returns only the valid ones. */
+    static validScopes(requested) {
+        return requested.filter(s => this._scopes.has(s) || s === '*');
+    }
+    // ── Lifetimes ───────────────────────────────────────────
+    static tokensExpireIn(ms) { this._tokenLifetime = ms; }
+    static refreshTokensExpireIn(ms) { this._refreshTokenLifetime = ms; }
+    static personalAccessTokensExpireIn(ms) { this._personalTokenLifetime = ms; }
+    static tokenLifetime() { return this._tokenLifetime; }
+    static refreshTokenLifetime() { return this._refreshTokenLifetime; }
+    static personalTokenLifetime() { return this._personalTokenLifetime; }
+    // ── Keys ────────────────────────────────────────────────
+    /** Set the directory where RSA keys are stored. */
+    static loadKeysFrom(path) { this._keyPath = path; }
+    /** Get the configured key path. */
+    static keyPath() { return this._keyPath; }
+    /** Set keys directly (from environment variables). */
+    static setKeys(privateKey, publicKey) {
+        this._privateKey = privateKey;
+        this._publicKey = publicKey;
+    }
+    /** Load keys from files or env. Returns { privateKey, publicKey }. */
+    static async keys() {
+        // Prefer explicitly set keys (from env vars)
+        if (this._privateKey && this._publicKey) {
+            return { privateKey: this._privateKey, publicKey: this._publicKey };
+        }
+        // Load from filesystem
+        const { readFile } = await import('node:fs/promises');
+        const { join } = await import('node:path');
+        const privatePath = join(process.cwd(), this._keyPath, 'oauth-private.key');
+        const publicPath = join(process.cwd(), this._keyPath, 'oauth-public.key');
+        const [privateKey, publicKey] = await Promise.all([
+            readFile(privatePath, 'utf8'),
+            readFile(publicPath, 'utf8'),
+        ]);
+        this._privateKey = privateKey;
+        this._publicKey = publicKey;
+        return { privateKey, publicKey };
+    }
+    // ── Reset (testing) ─────────────────────────────────────
+    /** @internal */
+    static reset() {
+        this._scopes.clear();
+        this._tokenLifetime = 15 * 24 * 60 * 60 * 1000;
+        this._refreshTokenLifetime = 30 * 24 * 60 * 60 * 1000;
+        this._personalTokenLifetime = 6 * 30 * 24 * 60 * 60 * 1000;
+        this._keyPath = 'storage';
+        this._privateKey = null;
+        this._publicKey = null;
+    }
+}
+//# sourceMappingURL=Passport.js.map

package/dist/Passport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Passport.js","sourceRoot":"","sources":["../src/Passport.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAO7D,MAAM,OAAO,QAAQ;IACX,MAAM,CAAC,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC1C,MAAM,CAAC,cAAc,GAAS,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAG,UAAU;IACnE,MAAM,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAE,UAAU;IACnE,MAAM,CAAC,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,YAAY;IACzE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC3B,MAAM,CAAC,WAAW,GAAkB,IAAI,CAAA;IACxC,MAAM,CAAC,UAAU,GAAkB,IAAI,CAAA;IAE/C,2DAA2D;IAE3D,qCAAqC;IACrC,MAAM,CAAC,SAAS,CAAC,MAA8B;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,MAAM,CAAC,QAAQ,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,MAAM;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,WAAW,CAAC,SAAmB;QACpC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAA;IAChE,CAAC;IAED,2DAA2D;IAE3D,MAAM,CAAC,cAAc,CAAC,EAAU,IAAU,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA,CAAC,CAAC;IACpE,MAAM,CAAC,qBAAqB,CAAC,EAAU,IAAU,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAA,CAAC,CAAC;IAClF,MAAM,CAAC,4BAA4B,CAAC,EAAU,IAAU,IAAI,CAAC,sBAAsB,GAAG,EAAE,CAAA,CAAC,CAAC;IAE1F,MAAM,CAAC,aAAa,KAAa,OAAO,IAAI,CAAC,cAAc,CAAA,CAAC,CAAC;IAC7D,MAAM,CAAC,oBAAoB,KAAa,OAAO,IAAI,CAAC,qBAAqB,CAAA,CAAC,CAAC;IAC3E,MAAM,CAAC,qBAAqB,KAAa,OAAO,IAAI,CAAC,sBAAsB,CAAA,CAAC,CAAC;IAE7E,2DAA2D;IAE3D,mDAAmD;IACnD,MAAM,CAAC,YAAY,CAAC,IAAY,IAAU,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA,CAAC,CAAC;IAEhE,mCAAmC;IACnC,MAAM,CAAC,OAAO,KAAa,OAAO,IAAI,CAAC,QAAQ,CAAA,CAAC,CAAC;IAEjD,sDAAsD;IACtD,MAAM,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB;QAClD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAK,CAAC,IAAI;QACf,6CAA6C;QAC7C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAA;QACrE,CAAC;QAED,uBAAuB;QACvB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;QAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAC3E,MAAM,UAAU,GAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;QAE1E,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;YAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;SAC7B,CAAC,CAAA;QAEF,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;QAE3B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;IAClC,CAAC;IAED,2DAA2D;IAE3D,gBAAgB;IAChB,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,cAAc,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACrD,IAAI,CAAC,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACrD,IAAI,CAAC,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC1D,IAAI,CAAC,QAAQ,GAAK,SAAS,CAAA;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;QACvB,IAAI,CAAC,UAAU,GAAI,IAAI,CAAA;IACzB,CAAC"}

package/dist/commands/client.d.ts

@@ -0,0 +1,16 @@
+import { OAuthClient } from '../models/OAuthClient.js';
+export interface CreateClientOpts {
+    name: string;
+    redirectUri?: string;
+    grantTypes?: string[];
+    confidential?: boolean;
+}
+/**
+ * Create an OAuth client programmatically.
+ * Returns the client and the plain-text secret (if confidential).
+ */
+export declare function createClient(opts: CreateClientOpts): Promise<{
+    client: OAuthClient;
+    secret: string | null;
+}>;
+//# sourceMappingURL=client.d.ts.map

package/dist/commands/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/commands/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAU,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAG,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAClE,MAAM,EAAE,WAAW,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB,CAAC,CAsBD"}

package/dist/commands/client.js

@@ -0,0 +1,25 @@
+import { OAuthClient } from '../models/OAuthClient.js';
+/**
+ * Create an OAuth client programmatically.
+ * Returns the client and the plain-text secret (if confidential).
+ */
+export async function createClient(opts) {
+    const { randomBytes, createHash } = await import('node:crypto');
+    const confidential = opts.confidential ?? true;
+    let plainSecret = null;
+    let hashedSecret = null;
+    if (confidential) {
+        plainSecret = randomBytes(32).toString('hex');
+        hashedSecret = createHash('sha256').update(plainSecret).digest('hex');
+    }
+    const client = await OAuthClient.create({
+        name: opts.name,
+        secret: hashedSecret,
+        redirectUris: JSON.stringify(opts.redirectUri ? [opts.redirectUri] : []),
+        grantTypes: JSON.stringify(opts.grantTypes ?? ['authorization_code']),
+        scopes: JSON.stringify([]),
+        confidential,
+    });
+    return { client, secret: plainSecret };
+}
+//# sourceMappingURL=client.js.map

package/dist/commands/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/commands/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAStD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAsB;IAIvD,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IAE/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAA;IAC9C,IAAI,WAAW,GAAkB,IAAI,CAAA;IACrC,IAAI,YAAY,GAAkB,IAAI,CAAA;IAEtC,IAAI,YAAY,EAAE,CAAC;QACjB,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC7C,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;QACtC,IAAI,EAAU,IAAI,CAAC,IAAI;QACvB,MAAM,EAAQ,YAAY;QAC1B,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,UAAU,EAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACvE,MAAM,EAAQ,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,YAAY;KACc,CAAgB,CAAA;IAE5C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AACxC,CAAC"}

package/dist/commands/keys.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Generate RSA keypair for JWT signing.
+ * Writes to storage/oauth-private.key and storage/oauth-public.key.
+ */
+export declare function generateKeys(opts?: {
+    force?: boolean;
+}): Promise<{
+    privatePath: string;
+    publicPath: string;
+}>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/commands/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBvH"}

package/dist/commands/keys.js

@@ -0,0 +1,27 @@
+import { Passport } from '../Passport.js';
+/**
+ * Generate RSA keypair for JWT signing.
+ * Writes to storage/oauth-private.key and storage/oauth-public.key.
+ */
+export async function generateKeys(opts = {}) {
+    const { generateKeyPairSync } = await import('node:crypto');
+    const { writeFile, mkdir } = await import('node:fs/promises');
+    const { existsSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const keyDir = join(process.cwd(), Passport.keyPath());
+    const privatePath = join(keyDir, 'oauth-private.key');
+    const publicPath = join(keyDir, 'oauth-public.key');
+    if (!opts.force && existsSync(privatePath)) {
+        throw new Error(`Keys already exist at ${privatePath}. Use --force to overwrite.`);
+    }
+    const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+        modulusLength: 4096,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    await mkdir(keyDir, { recursive: true });
+    await writeFile(privatePath, privateKey, { mode: 0o600 });
+    await writeFile(publicPath, publicKey, { mode: 0o644 });
+    return { privatePath, publicPath };
+}
+//# sourceMappingURL=keys.js.map

package/dist/commands/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE;IAC/D,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;IAC3D,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAA;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IACrD,MAAM,UAAU,GAAI,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;IAEpD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yBAAyB,WAAW,6BAA6B,CAAC,CAAA;IACpF,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC3D,aAAa,EAAE,IAAI;QACnB,iBAAiB,EAAG,EAAE,IAAI,EAAE,MAAM,EAAG,MAAM,EAAE,KAAK,EAAE;QACpD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAA;IAEF,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACzD,MAAM,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAEvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAA;AACpC,CAAC"}

package/dist/commands/purge.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Remove expired and revoked tokens from the database.
+ * Returns counts of purged records.
+ */
+export declare function purgeTokens(): Promise<{
+    accessTokens: number;
+    refreshTokens: number;
+    authCodes: number;
+    deviceCodes: number;
+}>;
+//# sourceMappingURL=purge.d.ts.map

package/dist/commands/purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.d.ts","sourceRoot":"","sources":["../../src/commands/purge.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC;IAC3C,YAAY,EAAG,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAM,MAAM,CAAA;IACrB,WAAW,EAAI,MAAM,CAAA;CACtB,CAAC,CA2CD"}

package/dist/commands/purge.js

@@ -0,0 +1,48 @@
+import { AccessToken } from '../models/AccessToken.js';
+import { RefreshToken } from '../models/RefreshToken.js';
+import { AuthCode } from '../models/AuthCode.js';
+import { DeviceCode } from '../models/DeviceCode.js';
+/**
+ * Remove expired and revoked tokens from the database.
+ * Returns counts of purged records.
+ */
+export async function purgeTokens() {
+    const now = new Date();
+    // Purge expired/revoked access tokens
+    const expiredAccess = await AccessToken.query()
+        .where('expiresAt', '<', now)
+        .orWhere('revoked', true)
+        .get();
+    for (const t of expiredAccess) {
+        await AccessToken.delete(t.id);
+    }
+    // Purge expired/revoked refresh tokens
+    const expiredRefresh = await RefreshToken.query()
+        .where('expiresAt', '<', now)
+        .orWhere('revoked', true)
+        .get();
+    for (const t of expiredRefresh) {
+        await RefreshToken.delete(t.id);
+    }
+    // Purge expired auth codes
+    const expiredCodes = await AuthCode.query()
+        .where('expiresAt', '<', now)
+        .get();
+    for (const c of expiredCodes) {
+        await AuthCode.delete(c.id);
+    }
+    // Purge expired device codes
+    const expiredDevices = await DeviceCode.query()
+        .where('expiresAt', '<', now)
+        .get();
+    for (const d of expiredDevices) {
+        await DeviceCode.delete(d.id);
+    }
+    return {
+        accessTokens: expiredAccess.length,
+        refreshTokens: expiredRefresh.length,
+        authCodes: expiredCodes.length,
+        deviceCodes: expiredDevices.length,
+    };
+}
+//# sourceMappingURL=purge.js.map

package/dist/commands/purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.js","sourceRoot":"","sources":["../../src/commands/purge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAM/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IAEtB,sCAAsC;IACtC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE;SAC5C,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,GAAG,EAAmB,CAAA;IACzB,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,WAAW,CAAC,MAAM,CAAE,CAAS,CAAC,EAAY,CAAC,CAAA;IACnD,CAAC;IAED,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE;SAC9C,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,GAAG,EAAoB,CAAA;IAC1B,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,YAAY,CAAC,MAAM,CAAE,CAAS,CAAC,EAAY,CAAC,CAAA;IACpD,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE;SACxC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,GAAG,EAAgB,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,MAAM,CAAE,CAAS,CAAC,EAAY,CAAC,CAAA;IAChD,CAAC;IAED,6BAA6B;IAC7B,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE;SAC5C,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC;SAC5B,GAAG,EAAkB,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,MAAM,CAAE,CAAS,CAAC,EAAY,CAAC,CAAA;IAClD,CAAC;IAED,OAAO;QACL,YAAY,EAAG,aAAa,CAAC,MAAM;QACnC,aAAa,EAAE,cAAc,CAAC,MAAM;QACpC,SAAS,EAAM,YAAY,CAAC,MAAM;QAClC,WAAW,EAAI,cAAc,CAAC,MAAM;KACrC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+import { ServiceProvider } from '@rudderjs/core';
+export { Passport } from './Passport.js';
+export type { PassportScope } from './Passport.js';
+export { createToken, verifyToken, decodeToken } from './token.js';
+export type { JwtHeader, JwtPayload } from './token.js';
+export { OAuthClient } from './models/OAuthClient.js';
+export { AccessToken } from './models/AccessToken.js';
+export { RefreshToken } from './models/RefreshToken.js';
+export { AuthCode } from './models/AuthCode.js';
+export { DeviceCode } from './models/DeviceCode.js';
+export { BearerMiddleware, RequireBearer } from './middleware/bearer.js';
+export { scope } from './middleware/scope.js';
+export { generateKeys } from './commands/keys.js';
+export { createClient } from './commands/client.js';
+export type { CreateClientOpts } from './commands/client.js';
+export { purgeTokens } from './commands/purge.js';
+export interface PassportConfig {
+    /** Directory where RSA keys are stored (default: 'storage') */
+    keyPath?: string;
+    /** Or set keys directly from env vars */
+    privateKey?: string;
+    publicKey?: string;
+    /** Access token lifetime in ms (default: 15 days) */
+    tokensExpireIn?: number;
+    /** Refresh token lifetime in ms (default: 30 days) */
+    refreshTokensExpireIn?: number;
+    /** Personal access token lifetime in ms (default: ~6 months) */
+    personalAccessTokensExpireIn?: number;
+    /** OAuth scopes: { scopeId: 'description' } */
+    scopes?: Record<string, string>;
+}
+export declare class PassportProvider extends ServiceProvider {
+    register(): void;
+    boot(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAU,MAAM,gBAAgB,CAAA;AAIxD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAClE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAIjD,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAID,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,QAAQ,IAAI,IAAI;IAEV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAmG5B"}

package/dist/index.js

@@ -0,0 +1,112 @@
+import { ServiceProvider, config } from '@rudderjs/core';
+// ─── Re-exports ───────────────────────────────────────────
+export { Passport } from './Passport.js';
+export { createToken, verifyToken, decodeToken } from './token.js';
+export { OAuthClient } from './models/OAuthClient.js';
+export { AccessToken } from './models/AccessToken.js';
+export { RefreshToken } from './models/RefreshToken.js';
+export { AuthCode } from './models/AuthCode.js';
+export { DeviceCode } from './models/DeviceCode.js';
+export { BearerMiddleware, RequireBearer } from './middleware/bearer.js';
+export { scope } from './middleware/scope.js';
+export { generateKeys } from './commands/keys.js';
+export { createClient } from './commands/client.js';
+export { purgeTokens } from './commands/purge.js';
+// ─── Service Provider ─────────────────────────────────────
+export class PassportProvider extends ServiceProvider {
+    register() { }
+    async boot() {
+        const { Passport } = await import('./Passport.js');
+        const cfg = config('passport');
+        // Configure keys
+        if (cfg.privateKey && cfg.publicKey) {
+            Passport.setKeys(cfg.privateKey, cfg.publicKey);
+        }
+        else if (cfg.keyPath) {
+            Passport.loadKeysFrom(cfg.keyPath);
+        }
+        // Configure lifetimes
+        if (cfg.tokensExpireIn)
+            Passport.tokensExpireIn(cfg.tokensExpireIn);
+        if (cfg.refreshTokensExpireIn)
+            Passport.refreshTokensExpireIn(cfg.refreshTokensExpireIn);
+        if (cfg.personalAccessTokensExpireIn)
+            Passport.personalAccessTokensExpireIn(cfg.personalAccessTokensExpireIn);
+        // Configure scopes
+        if (cfg.scopes)
+            Passport.tokensCan(cfg.scopes);
+        this.app.instance('passport', Passport);
+        // Register CLI commands
+        try {
+            const { rudder } = await import('@rudderjs/core');
+            rudder.command('passport:keys', async (args) => {
+                const force = args.includes('--force');
+                const { generateKeys } = await import('./commands/keys.js');
+                const { privatePath, publicPath } = await generateKeys({ force });
+                console.log(`  RSA keys generated:`);
+                console.log(`    Private: ${privatePath}`);
+                console.log(`    Public:  ${publicPath}`);
+            }).description('Generate RSA encryption keys for OAuth tokens');
+            rudder.command('passport:client', async (args) => {
+                const name = args[0] ?? 'My App';
+                const isPublic = args.includes('--public');
+                const isDevice = args.includes('--device');
+                const isPersonal = args.includes('--personal');
+                const grantTypes = isDevice
+                    ? ['urn:ietf:params:oauth:grant-type:device_code']
+                    : isPersonal
+                        ? ['personal_access']
+                        : ['authorization_code'];
+                const { createClient } = await import('./commands/client.js');
+                const { client, secret } = await createClient({
+                    name,
+                    confidential: !isPublic && !isDevice,
+                    grantTypes,
+                });
+                console.log(`  OAuth client created:`);
+                console.log(`    Client ID: ${client.id}`);
+                console.log(`    Name:      ${client.name}`);
+                if (secret) {
+                    console.log(`    Secret:    ${secret}`);
+                    console.log(`    (Store this secret — it won't be shown again.)`);
+                }
+            }).description('Create a new OAuth client');
+            rudder.command('passport:purge', async () => {
+                const { purgeTokens } = await import('./commands/purge.js');
+                const counts = await purgeTokens();
+                const total = counts.accessTokens + counts.refreshTokens + counts.authCodes + counts.deviceCodes;
+                console.log(`  Purged ${total} expired/revoked record(s):`);
+                console.log(`    Access tokens:  ${counts.accessTokens}`);
+                console.log(`    Refresh tokens: ${counts.refreshTokens}`);
+                console.log(`    Auth codes:     ${counts.authCodes}`);
+                console.log(`    Device codes:   ${counts.deviceCodes}`);
+            }).description('Remove expired tokens and auth codes');
+            // Register make:* scaffolder for passport
+            try {
+                const { registerMakeSpecs } = await import('@rudderjs/rudder');
+                registerMakeSpecs({
+                    command: 'make:passport-client',
+                    description: 'Create a new OAuth client seeder',
+                    label: 'Passport client seeder created',
+                    directory: 'app/Seeders',
+                    stub: (className) => `import { createClient } from '@rudderjs/passport'
+
+export async function ${className.replace(/Seeder$/, '').toLowerCase()}Clients(): Promise<void> {
+  // Create a confidential client (server-side apps)
+  const { client, secret } = await createClient({
+    name: 'My Application',
+    redirectUri: 'http://localhost:3000/callback',
+    grantTypes: ['authorization_code', 'refresh_token'],
+  })
+  console.log('Client ID:', (client as any).id)
+  console.log('Secret:', secret)
+}
+`,
+                });
+            }
+            catch { /* rudder not available */ }
+        }
+        catch { /* rudder not available */ }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAExD,6DAA6D;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAGxC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGlE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAoBjD,6DAA6D;AAE7D,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,QAAQ,KAAU,CAAC;IAEnB,KAAK,CAAC,IAAI;QACR,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAA;QAElD,MAAM,GAAG,GAAG,MAAM,CAAiB,UAAU,CAAC,CAAA;QAE9C,iBAAiB;QACjB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;QACjD,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QAED,sBAAsB;QACtB,IAAI,GAAG,CAAC,cAAc;YAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACnE,IAAI,GAAG,CAAC,qBAAqB;YAAE,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAA;QACxF,IAAI,GAAG,CAAC,4BAA4B;YAAE,QAAQ,CAAC,4BAA4B,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAA;QAE7G,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM;YAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAE9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAEvC,wBAAwB;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAEjD,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,IAAc,EAAE,EAAE;gBACvD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBACtC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAA;gBAC3D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;gBACjE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;gBACpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,WAAW,EAAE,CAAC,CAAA;gBAC1C,OAAO,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAA;YAC3C,CAAC,CAAC,CAAC,WAAW,CAAC,+CAA+C,CAAC,CAAA;YAE/D,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAc,EAAE,EAAE;gBACzD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAA;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;gBAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;gBAE9C,MAAM,UAAU,GAAG,QAAQ;oBACzB,CAAC,CAAC,CAAC,8CAA8C,CAAC;oBAClD,CAAC,CAAC,UAAU;wBACV,CAAC,CAAC,CAAC,iBAAiB,CAAC;wBACrB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;gBAE5B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;gBAC7D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC;oBAC5C,IAAI;oBACJ,YAAY,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ;oBACpC,UAAU;iBACX,CAAC,CAAA;gBAEF,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;gBACtC,OAAO,CAAC,GAAG,CAAC,kBAAmB,MAAc,CAAC,EAAE,EAAE,CAAC,CAAA;gBACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC5C,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAA;oBACvC,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAA;YAE3C,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC1C,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;gBAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAA;gBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CAAA;gBAChG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,6BAA6B,CAAC,CAAA;gBAC3D,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;gBACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAA;gBAC1D,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;gBACtD,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YAC1D,CAAC,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAA;YAEtD,0CAA0C;YAC1C,IAAI,CAAC;gBACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;gBAC9D,iBAAiB,CAAC;oBAChB,OAAO,EAAM,sBAAsB;oBACnC,WAAW,EAAE,kCAAkC;oBAC/C,KAAK,EAAQ,gCAAgC;oBAC7C,SAAS,EAAI,aAAa;oBAC1B,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;;wBAEP,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;;;;;;;;;;CAUrE;iBACQ,CAAC,CAAA;YACJ,CAAC;YAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/middleware/bearer.d.ts

@@ -0,0 +1,12 @@
+import type { MiddlewareHandler } from '@rudderjs/contracts';
+/**
+ * Middleware that authenticates via Bearer token (JWT).
+ * Validates the JWT signature, checks expiration, checks revocation in DB.
+ * Attaches user to the request if valid. Does not block unauthenticated requests.
+ */
+export declare function BearerMiddleware(): MiddlewareHandler;
+/**
+ * Middleware that requires a valid Bearer token. Returns 401 if missing/invalid.
+ */
+export declare function RequireBearer(): MiddlewareHandler;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/middleware/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/middleware/bearer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAI5D;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CAkDpD;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,iBAAiB,CAgDjD"}

package/dist/middleware/bearer.js

@@ -0,0 +1,111 @@
+import { verifyToken } from '../token.js';
+import { AccessToken } from '../models/AccessToken.js';
+/**
+ * Middleware that authenticates via Bearer token (JWT).
+ * Validates the JWT signature, checks expiration, checks revocation in DB.
+ * Attaches user to the request if valid. Does not block unauthenticated requests.
+ */
+export function BearerMiddleware() {
+    return async function BearerMiddleware(req, _res, next) {
+        const authHeader = req.headers['authorization'];
+        if (!authHeader?.startsWith('Bearer ')) {
+            await next();
+            return;
+        }
+        const jwt = authHeader.slice(7).trim();
+        try {
+            const payload = await verifyToken(jwt);
+            // Check revocation in DB
+            const token = await AccessToken.query()
+                .where('id', payload.jti)
+                .first();
+            if (!token || token.revoked) {
+                await next();
+                return;
+            }
+            // Attach token info to the raw request
+            const raw = req.raw;
+            raw['__passport_token'] = token;
+            raw['__passport_scopes'] = payload.scopes;
+            raw['__passport_user_id'] = payload.sub;
+            // Resolve user if we have a userId
+            if (payload.sub) {
+                try {
+                    const { app } = await import('@rudderjs/core');
+                    const manager = app().make('auth.manager');
+                    const user = await manager.guard().provider.retrieveById(payload.sub);
+                    if (user) {
+                        const plain = {};
+                        for (const [k, v] of Object.entries(user)) {
+                            if (typeof v !== 'function' && k !== 'password')
+                                plain[k] = v;
+                        }
+                        raw['__rjs_user'] = plain;
+                        try {
+                            req['user'] = plain;
+                        }
+                        catch { /* read-only */ }
+                    }
+                }
+                catch { /* auth not available */ }
+            }
+        }
+        catch {
+            // Invalid JWT — continue without auth
+        }
+        await next();
+    };
+}
+/**
+ * Middleware that requires a valid Bearer token. Returns 401 if missing/invalid.
+ */
+export function RequireBearer() {
+    return async function RequireBearer(req, res, next) {
+        const authHeader = req.headers['authorization'];
+        if (!authHeader?.startsWith('Bearer ')) {
+            res.status(401).json({ error: 'unauthenticated', message: 'Bearer token required.' });
+            return;
+        }
+        const jwt = authHeader.slice(7).trim();
+        try {
+            const payload = await verifyToken(jwt);
+            // Check revocation
+            const token = await AccessToken.query()
+                .where('id', payload.jti)
+                .first();
+            if (!token || token.revoked) {
+                res.status(401).json({ error: 'unauthenticated', message: 'Token has been revoked.' });
+                return;
+            }
+            const raw = req.raw;
+            raw['__passport_token'] = token;
+            raw['__passport_scopes'] = payload.scopes;
+            raw['__passport_user_id'] = payload.sub;
+            if (payload.sub) {
+                try {
+                    const { app } = await import('@rudderjs/core');
+                    const manager = app().make('auth.manager');
+                    const user = await manager.guard().provider.retrieveById(payload.sub);
+                    if (user) {
+                        const plain = {};
+                        for (const [k, v] of Object.entries(user)) {
+                            if (typeof v !== 'function' && k !== 'password')
+                                plain[k] = v;
+                        }
+                        raw['__rjs_user'] = plain;
+                        try {
+                            req['user'] = plain;
+                        }
+                        catch { /* read-only */ }
+                    }
+                }
+                catch { /* auth not available */ }
+            }
+            await next();
+        }
+        catch {
+            res.status(401).json({ error: 'unauthenticated', message: 'Invalid or expired token.' });
+        }
+    };
+}
+//# sourceMappingURL=bearer.js.map

package/dist/middleware/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/middleware/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI;QACpD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAuB,CAAA;QACrE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,EAAE,CAAA;YACZ,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAEtC,yBAAyB;YACzB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE;iBACpC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;iBACxB,KAAK,EAAwB,CAAA;YAEhC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,EAAE,CAAA;gBACZ,OAAM;YACR,CAAC;YAED,uCAAuC;YACvC,MAAM,GAAG,GAAG,GAAG,CAAC,GAA8B,CAAA;YAC9C,GAAG,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAA;YAC/B,GAAG,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAA;YACzC,GAAG,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAA;YAEvC,mCAAmC;YACnC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;oBAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAA4E,cAAc,CAAC,CAAA;oBACrH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrE,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,KAAK,GAA4B,EAAE,CAAA;wBACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;4BACrE,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU;gCAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;wBAC/D,CAAC;wBACD,GAAG,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;wBACzB,IAAI,CAAC;4BAAE,GAA0C,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC/F,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,UAAU,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAuB,CAAA;QACrE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAA;YACrF,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAEtC,mBAAmB;YACnB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE;iBACpC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;iBACxB,KAAK,EAAwB,CAAA;YAEhC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAA;gBACtF,OAAM;YACR,CAAC;YAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAA8B,CAAA;YAC9C,GAAG,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAA;YAC/B,GAAG,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAA;YACzC,GAAG,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,GAAG,CAAA;YAEvC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAA;oBAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAA4E,cAAc,CAAC,CAAA;oBACrH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;oBACrE,IAAI,IAAI,EAAE,CAAC;wBACT,MAAM,KAAK,GAA4B,EAAE,CAAA;wBACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;4BACrE,IAAI,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,UAAU;gCAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;wBAC/D,CAAC;wBACD,GAAG,CAAC,YAAY,CAAC,GAAG,KAAK,CAAA;wBACzB,IAAI,CAAC;4BAAE,GAA0C,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;wBAAC,CAAC;wBAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;oBAC/F,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAA;QAC1F,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}