@superfunctions/auth 0.1.0 → 0.1.1

package/README.md

@@ -106,7 +106,7 @@ const auth = createAuthFn({
 });
 
 const library = createMyLibrary({
-  auth,
+  auth: auth.provider,
   // ... other config
 });
 ```

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @superfunctions/auth - Framework-agnostic authentication abstraction layer
+ */
+export type { AuthSession, AuthProvider, AuthProviderConfig, } from './types.js';
+export { AuthError, AuthenticationError, AuthorizationError, InvalidCredentialsError, ExpiredCredentialsError, } from './types.js';
+export { createAuthMiddleware, createResourceAuthMiddleware, } from './middleware.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+/**
+ * @superfunctions/auth - Framework-agnostic authentication abstraction layer
+ */
+// Errors
+export { AuthError, AuthenticationError, AuthorizationError, InvalidCredentialsError, ExpiredCredentialsError, } from './types.js';
+// Middleware utilities
+export { createAuthMiddleware, createResourceAuthMiddleware, } from './middleware.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,SAAS;AACT,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,uBAAuB;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Middleware utilities for integrating auth with @superfunctions/http
+ */
+import type { AuthProvider, AuthSession } from './types.js';
+/**
+ * Create authentication middleware for @superfunctions/http
+ *
+ * This middleware authenticates requests using the provided auth provider
+ * and attaches the session to the context.
+ *
+ * @example
+ * ```typescript
+ * import { createAuthMiddleware } from '@superfunctions/auth';
+ * import { createRouter } from '@superfunctions/http';
+ *
+ * const authMiddleware = createAuthMiddleware(authProvider);
+ *
+ * const router = createRouter({
+ *   middleware: [authMiddleware],
+ *   routes: [...]
+ * });
+ * ```
+ */
+export declare function createAuthMiddleware<TSession extends AuthSession>(provider: AuthProvider<TSession>, options?: {
+    /** Skip authentication for specific paths */
+    skipPaths?: string[];
+    /** Custom context key for session (default: 'auth') */
+    contextKey?: string;
+}): (request: Request, context: any, next: () => Promise<Response>) => Promise<Response>;
+/**
+ * Create resource authorization middleware
+ *
+ * This middleware checks if the authenticated session has access to a specific resource.
+ * Requires that authentication middleware has already run.
+ *
+ * @example
+ * ```typescript
+ * import { createResourceAuthMiddleware } from '@superfunctions/auth';
+ *
+ * const resourceAuth = createResourceAuthMiddleware(authProvider, {
+ *   resourceHeader: 'x-project-id'
+ * });
+ * ```
+ */
+export declare function createResourceAuthMiddleware<TSession extends AuthSession>(provider: AuthProvider<TSession>, options?: {
+    /** Header name containing the resource ID (default: 'x-resource-id') */
+    resourceHeader?: string;
+    /** Custom context key where session is stored (default: 'auth') */
+    contextKey?: string;
+    /** Skip paths that don't require resource authorization */
+    skipPaths?: string[];
+}): (request: Request, context: any, next: () => Promise<Response>) => Promise<Response>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,SAAS,WAAW,EAC/D,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,EAChC,OAAO,CAAC,EAAE;IACR,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,IAMC,SAAS,OAAO,EAChB,SAAS,GAAG,EACZ,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAmBrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,SAAS,WAAW,EACvE,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,EAChC,OAAO,CAAC,EAAE;IACR,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,IAOC,SAAS,OAAO,EAChB,SAAS,GAAG,EACZ,MAAM,MAAM,OAAO,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,QAAQ,CAAC,CAuCrB"}

package/dist/middleware.js

@@ -0,0 +1,96 @@
+/**
+ * Middleware utilities for integrating auth with @superfunctions/http
+ */
+import { AuthenticationError, AuthorizationError } from './types.js';
+/**
+ * Create authentication middleware for @superfunctions/http
+ *
+ * This middleware authenticates requests using the provided auth provider
+ * and attaches the session to the context.
+ *
+ * @example
+ * ```typescript
+ * import { createAuthMiddleware } from '@superfunctions/auth';
+ * import { createRouter } from '@superfunctions/http';
+ *
+ * const authMiddleware = createAuthMiddleware(authProvider);
+ *
+ * const router = createRouter({
+ *   middleware: [authMiddleware],
+ *   routes: [...]
+ * });
+ * ```
+ */
+export function createAuthMiddleware(provider, options) {
+    const skipPaths = options?.skipPaths || [];
+    const contextKey = options?.contextKey || 'auth';
+    return async (request, context, next) => {
+        // Check if path should skip authentication
+        const url = new URL(request.url);
+        if (skipPaths.some(path => url.pathname === path || url.pathname.endsWith(path))) {
+            return next();
+        }
+        // Authenticate request
+        const session = await provider.authenticate(request);
+        if (!session) {
+            throw new AuthenticationError('Authentication required');
+        }
+        // Attach session to context
+        context[contextKey] = session;
+        return next();
+    };
+}
+/**
+ * Create resource authorization middleware
+ *
+ * This middleware checks if the authenticated session has access to a specific resource.
+ * Requires that authentication middleware has already run.
+ *
+ * @example
+ * ```typescript
+ * import { createResourceAuthMiddleware } from '@superfunctions/auth';
+ *
+ * const resourceAuth = createResourceAuthMiddleware(authProvider, {
+ *   resourceHeader: 'x-project-id'
+ * });
+ * ```
+ */
+export function createResourceAuthMiddleware(provider, options) {
+    const resourceHeader = options?.resourceHeader || 'x-resource-id';
+    const contextKey = options?.contextKey || 'auth';
+    const skipPaths = options?.skipPaths || [];
+    return async (request, context, next) => {
+        // Check if path should skip resource authorization
+        const url = new URL(request.url);
+        if (skipPaths.some(path => url.pathname === path || url.pathname.endsWith(path))) {
+            return next();
+        }
+        const session = context[contextKey];
+        // If no session exists, skip (auth middleware should have already handled this)
+        if (!session) {
+            return next();
+        }
+        // Get resource ID from header
+        const resourceId = request.headers.get(resourceHeader);
+        if (!resourceId) {
+            throw new AuthorizationError(`Missing ${resourceHeader} header`);
+        }
+        // Check authorization using provider if it supports it
+        if (provider.authorize) {
+            const authorized = await provider.authorize(session, resourceId);
+            if (!authorized) {
+                throw new AuthorizationError('Access denied to resource');
+            }
+        }
+        else {
+            // Default: check if resource ID is in session's resourceIds
+            if (!session.resourceIds.includes(resourceId)) {
+                throw new AuthorizationError('Access denied to resource');
+            }
+        }
+        // Store resource ID in context for convenience
+        context.resourceId = resourceId;
+        return next();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgC,EAChC,OAKC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC;IAEjD,OAAO,KAAK,EACV,OAAgB,EAChB,OAAY,EACZ,IAA6B,EACV,EAAE;QACrB,2CAA2C;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAErD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,4BAA4B;QAC5B,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;QAE9B,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgC,EAChC,OAOC;IAED,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,IAAI,eAAe,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAE3C,OAAO,KAAK,EACV,OAAgB,EAChB,OAAY,EACZ,IAA6B,EACV,EAAE;QACrB,mDAAmD;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAa,CAAC;QAEhD,gFAAgF;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,8BAA8B;QAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,WAAW,cAAc,SAAS,CAAC,CAAC;QACnE,CAAC;QAED,uDAAuD;QACvD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4DAA4D;YAC5D,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAEhC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Core type definitions for the authentication abstraction layer
+ */
+/**
+ * Authenticated session data returned by auth providers
+ */
+export interface AuthSession<TMetadata = any> {
+    /** Unique identifier for the authenticated entity (user, API key, etc.) */
+    id: string;
+    /** Type of authentication (e.g., 'api-key', 'session', 'jwt', 'oauth') */
+    type: string;
+    /** Resource IDs this session has access to (e.g., project IDs, organization IDs) */
+    resourceIds: string[];
+    /** Optional: Scopes or permissions */
+    scopes?: string[];
+    /** Optional: Expiration timestamp */
+    expiresAt?: Date;
+    /** Optional: Additional metadata */
+    metadata?: TMetadata;
+}
+/**
+ * Core authentication provider interface
+ * All auth implementations must conform to this interface
+ */
+export interface AuthProvider<TSession extends AuthSession = AuthSession> {
+    /**
+     * Authenticate a request and return session data
+     * Returns null if authentication fails
+     */
+    authenticate(request: Request): Promise<TSession | null>;
+    /**
+     * Optional: Validate if a session has access to a specific resource
+     */
+    authorize?(session: TSession, resourceId: string): Promise<boolean>;
+    /**
+     * Optional: Revoke/invalidate a session
+     */
+    revoke?(sessionId: string): Promise<void>;
+}
+/**
+ * Common configuration options for auth providers
+ */
+export interface AuthProviderConfig {
+    /** Optional: Custom header names for authentication */
+    headers?: {
+        authorization?: string;
+        resourceId?: string;
+    };
+    /** Optional: Skip authentication for specific paths */
+    skipPaths?: string[];
+}
+export declare class AuthError extends Error {
+    code: string;
+    statusCode: number;
+    constructor(message: string, code: string, statusCode?: number);
+}
+export declare class AuthenticationError extends AuthError {
+    constructor(message?: string);
+}
+export declare class AuthorizationError extends AuthError {
+    constructor(message?: string);
+}
+export declare class InvalidCredentialsError extends AuthError {
+    constructor(message?: string);
+}
+export declare class ExpiredCredentialsError extends AuthError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH;;GAEG;AACH,MAAM,WAAW,WAAW,CAAC,SAAS,GAAG,GAAG;IAC1C,2EAA2E;IAC3E,EAAE,EAAE,MAAM,CAAC;IAEX,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IAEb,oFAAoF;IACpF,WAAW,EAAE,MAAM,EAAE,CAAC;IAEtB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,qCAAqC;IACrC,SAAS,CAAC,EAAE,IAAI,CAAC;IAEjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAMD;;;GAGG;AACH,MAAM,WAAW,YAAY,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW;IACtE;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEzD;;OAEG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpE;;OAEG;IACH,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAMD,qBAAa,SAAU,SAAQ,KAAK;IACE,IAAI,EAAE,MAAM;IAAS,UAAU,EAAE,MAAM;gBAA/D,OAAO,EAAE,MAAM,EAAS,IAAI,EAAE,MAAM,EAAS,UAAU,GAAE,MAAY;CAIlF;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,GAAE,MAAgC;CAItD;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,GAAE,MAAwB;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,GAAE,MAA8B;CAIpD;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,GAAE,MAA8B;CAIpD"}

package/dist/types.js

@@ -0,0 +1,41 @@
+/**
+ * Core type definitions for the authentication abstraction layer
+ */
+// ============================================================================
+// Auth Errors
+// ============================================================================
+export class AuthError extends Error {
+    code;
+    statusCode;
+    constructor(message, code, statusCode = 401) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.name = 'AuthError';
+    }
+}
+export class AuthenticationError extends AuthError {
+    constructor(message = 'Authentication failed') {
+        super(message, 'AUTHENTICATION_FAILED', 401);
+        this.name = 'AuthenticationError';
+    }
+}
+export class AuthorizationError extends AuthError {
+    constructor(message = 'Access denied') {
+        super(message, 'AUTHORIZATION_FAILED', 403);
+        this.name = 'AuthorizationError';
+    }
+}
+export class InvalidCredentialsError extends AuthError {
+    constructor(message = 'Invalid credentials') {
+        super(message, 'INVALID_CREDENTIALS', 401);
+        this.name = 'InvalidCredentialsError';
+    }
+}
+export class ExpiredCredentialsError extends AuthError {
+    constructor(message = 'Credentials expired') {
+        super(message, 'EXPIRED_CREDENTIALS', 401);
+        this.name = 'ExpiredCredentialsError';
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAyEH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,OAAO,SAAU,SAAQ,KAAK;IACE;IAAqB;IAAzD,YAAY,OAAe,EAAS,IAAY,EAAS,aAAqB,GAAG;QAC/E,KAAK,CAAC,OAAO,CAAC,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAQ;QAAS,eAAU,GAAV,UAAU,CAAc;QAE/E,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,UAAkB,uBAAuB;QACnD,KAAK,CAAC,OAAO,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,UAAkB,eAAe;QAC3C,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD,YAAY,UAAkB,qBAAqB;QACjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD,YAAY,UAAkB,qBAAqB;QACjD,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superfunctions/auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Framework-agnostic authentication abstraction layer for Superfunctions libraries",
   "type": "module",
   "main": "./dist/index.js",