@technomoron/apicore-server 1.0.0-beta.1

package/dist/cjs/token/base.cjs

@@ -0,0 +1,120 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenStore = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+function normalizeScope(scope) {
+    if (!scope) {
+        return undefined;
+    }
+    if (Array.isArray(scope)) {
+        return scope.filter((entry) => typeof entry === 'string' && entry.length > 0);
+    }
+    return scope
+        .split(/\s+/)
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+}
+function normalizeRefreshTtlSeconds(value) {
+    if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
+        return Math.floor(value);
+    }
+    if (typeof value === 'string') {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed) && parsed > 0) {
+            return Math.floor(parsed);
+        }
+    }
+    return undefined;
+}
+function normalizeTokenInternal(input) {
+    if (!input.refreshToken) {
+        throw new Error('refreshToken is required');
+    }
+    if (!input.accessToken) {
+        throw new Error('accessToken is required');
+    }
+    if (input.userId === undefined || input.userId === null) {
+        throw new Error('userId is required');
+    }
+    const userId = String(input.userId);
+    const ruid = input.ruid === undefined || input.ruid === null ? undefined : String(input.ruid);
+    const expires = input.expires ? new Date(input.expires) : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+    if (Number.isNaN(expires.getTime())) {
+        throw new Error(`Invalid token expiry value: ${String(input.expires)}`);
+    }
+    const issuedAt = input.issuedAt ? new Date(input.issuedAt) : new Date();
+    const lastSeenAt = input.lastSeenAt ? new Date(input.lastSeenAt) : issuedAt;
+    const scope = normalizeScope(input.scope);
+    const refreshTtlSeconds = normalizeRefreshTtlSeconds(input.refreshTtlSeconds);
+    const status = input.status === 'revoked' ? 'revoked' : expires.getTime() < Date.now() ? 'expired' : 'active';
+    const sessionCookie = typeof input.sessionCookie === 'boolean' ? input.sessionCookie : false;
+    return {
+        accessToken: input.accessToken,
+        refreshToken: input.refreshToken,
+        userId,
+        clientId: typeof input.clientId === 'string' && input.clientId.length > 0 ? input.clientId : undefined,
+        domain: typeof input.domain === 'string' ? input.domain : '',
+        fingerprint: typeof input.fingerprint === 'string' ? input.fingerprint : '',
+        label: typeof input.label === 'string' ? input.label : '',
+        browser: typeof input.browser === 'string' ? input.browser : '',
+        device: typeof input.device === 'string' ? input.device : '',
+        ip: typeof input.ip === 'string' ? input.ip : '',
+        os: typeof input.os === 'string' ? input.os : '',
+        loginType: typeof input.loginType === 'string' && input.loginType.length > 0 ? input.loginType : undefined,
+        scope,
+        refreshTtlSeconds,
+        expires,
+        issuedAt,
+        lastSeenAt,
+        status,
+        ruid,
+        sessionCookie
+    };
+}
+/** Base contract for token/session persistence backends plus shared JWT helpers. */
+class TokenStore {
+    // Instance helpers
+    normalizeToken(token) {
+        return normalizeTokenInternal(token);
+    }
+    // JWT helpers live on TokenStore so every adapter automatically exposes
+    // signing/verification without additional wiring.
+    jwtSign(payload, secret, expiresInSeconds, options) {
+        const opts = { ...(options ?? {}), expiresIn: expiresInSeconds };
+        try {
+            const token = jsonwebtoken_1.default.sign(payload, secret, opts);
+            return { success: true, token };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    jwtVerify(token, secret, options) {
+        try {
+            const data = jsonwebtoken_1.default.verify(token, secret, options ?? {});
+            return { success: true, data };
+        }
+        catch (error) {
+            if (error instanceof jsonwebtoken_1.default.TokenExpiredError) {
+                return { success: false, expired: true, error: 'Token expired' };
+            }
+            return { success: false, expired: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    jwtDecode(token, options) {
+        try {
+            const data = jsonwebtoken_1.default.decode(token, options ?? {});
+            if (data === null) {
+                return { success: false, error: 'Invalid token format' };
+            }
+            return { success: true, data };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+}
+exports.TokenStore = TokenStore;

package/dist/cjs/token/base.d.ts

@@ -0,0 +1,46 @@
+import type { Token } from './types.js';
+import type { DecodeOptions, SignOptions, VerifyOptions } from 'jsonwebtoken';
+export interface JwtSignResult {
+    success: boolean;
+    token?: string;
+    error?: string;
+}
+export type JwtSignPayload = string | Buffer | Record<string, unknown>;
+export interface JwtVerifyResult<T> {
+    success: boolean;
+    data?: T;
+    expired?: boolean;
+    error?: string;
+}
+export interface JwtDecodeResult<T> {
+    success: boolean;
+    data?: T;
+    error?: string;
+}
+/** Base contract for token/session persistence backends plus shared JWT helpers. */
+export declare abstract class TokenStore {
+    /** Create/persist a token record. */
+    abstract save(record: Token): Promise<void>;
+    /** Read a token record by partial query. */
+    abstract get(query: Partial<Token>, opts?: {
+        includeExpired?: boolean;
+    }): Promise<Token | null>;
+    /** Delete token records matching a partial query. */
+    abstract delete(query: Partial<Token>): Promise<number>;
+    /** Update a token identified by refresh token. */
+    abstract update(update: Partial<Token> & {
+        refreshToken: string;
+    }): Promise<boolean>;
+    /** List tokens for a specific user. */
+    abstract list(userId: string | number, opts?: {
+        limit?: number;
+        offset?: number;
+        includeExpired?: boolean;
+    }): Promise<Token[]>;
+    /** Close underlying resources. */
+    abstract close(): Promise<void>;
+    normalizeToken(token: Partial<Token>): Token;
+    jwtSign(payload: JwtSignPayload, secret: string, expiresInSeconds: number, options?: SignOptions): JwtSignResult;
+    jwtVerify<T>(token: string, secret: string, options?: VerifyOptions): JwtVerifyResult<T>;
+    jwtDecode<T>(token: string, options?: DecodeOptions): JwtDecodeResult<T>;
+}

package/dist/cjs/token/memory.cjs

@@ -0,0 +1,234 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryTokenStore = void 0;
+const base_js_1 = require("./base.cjs");
+function comparableUserId(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return String(value);
+}
+function cloneToken(record) {
+    return {
+        ...record,
+        scope: record.scope ? [...record.scope] : undefined,
+        expires: record.expires ? new Date(record.expires) : undefined,
+        issuedAt: record.issuedAt ? new Date(record.issuedAt) : undefined,
+        lastSeenAt: record.lastSeenAt ? new Date(record.lastSeenAt) : undefined
+    };
+}
+function matchesQuery(record, query, includeExpired) {
+    if (query.refreshToken !== undefined && record.refreshToken !== query.refreshToken) {
+        return false;
+    }
+    if (query.accessToken !== undefined && record.accessToken !== query.accessToken) {
+        return false;
+    }
+    if (query.userId !== undefined && comparableUserId(record.userId) !== comparableUserId(query.userId)) {
+        return false;
+    }
+    if (query.clientId !== undefined && record.clientId !== query.clientId) {
+        return false;
+    }
+    if (query.domain !== undefined && (record.domain ?? '') !== (query.domain ?? '')) {
+        return false;
+    }
+    if (query.fingerprint !== undefined && (record.fingerprint ?? '') !== (query.fingerprint ?? '')) {
+        return false;
+    }
+    if (query.loginType !== undefined && record.loginType !== (query.loginType ?? undefined)) {
+        return false;
+    }
+    if (query.label !== undefined && record.label !== query.label) {
+        return false;
+    }
+    if (!includeExpired) {
+        const expiresTime = record.expires ? record.expires.getTime() : Infinity;
+        if (expiresTime < Date.now()) {
+            return false;
+        }
+    }
+    return true;
+}
+class MemoryTokenStore extends base_js_1.TokenStore {
+    constructor(options = {}) {
+        super();
+        this.tokens = new Map();
+        this.tokensByUser = new Map();
+        this.maxTokens =
+            typeof options.maxTokens === 'number' && Number.isFinite(options.maxTokens) && options.maxTokens > 0
+                ? Math.floor(options.maxTokens)
+                : undefined;
+    }
+    indexToken(token) {
+        const userId = comparableUserId(token.userId);
+        if (!userId) {
+            return;
+        }
+        let userTokens = this.tokensByUser.get(userId);
+        if (!userTokens) {
+            userTokens = new Set();
+            this.tokensByUser.set(userId, userTokens);
+        }
+        userTokens.add(token.refreshToken);
+    }
+    unindexToken(token) {
+        const userId = comparableUserId(token.userId);
+        if (!userId) {
+            return;
+        }
+        const userTokens = this.tokensByUser.get(userId);
+        if (!userTokens) {
+            return;
+        }
+        userTokens.delete(token.refreshToken);
+        if (userTokens.size === 0) {
+            this.tokensByUser.delete(userId);
+        }
+    }
+    removeByRefreshToken(refreshToken) {
+        const existing = this.tokens.get(refreshToken);
+        if (!existing) {
+            return;
+        }
+        this.unindexToken(existing);
+        this.tokens.delete(refreshToken);
+    }
+    async save(record) {
+        const stored = this.normalizeToken(record);
+        const normalizedUserId = comparableUserId(stored.userId);
+        if (!normalizedUserId) {
+            throw new Error('userId is required');
+        }
+        const domainProvided = record.domain !== undefined;
+        const fingerprintProvided = record.fingerprint !== undefined;
+        const userRefreshTokens = [...(this.tokensByUser.get(normalizedUserId) ?? [])];
+        for (const refreshToken of userRefreshTokens) {
+            const existing = this.tokens.get(refreshToken);
+            if (!existing) {
+                continue;
+            }
+            if (comparableUserId(existing.userId) !== normalizedUserId) {
+                continue;
+            }
+            if (record.clientId && existing.clientId !== record.clientId) {
+                continue;
+            }
+            if (domainProvided && existing.domain !== stored.domain) {
+                continue;
+            }
+            if (fingerprintProvided && existing.fingerprint !== stored.fingerprint) {
+                continue;
+            }
+            this.removeByRefreshToken(existing.refreshToken);
+        }
+        this.removeByRefreshToken(stored.refreshToken);
+        this.tokens.set(stored.refreshToken, stored);
+        this.indexToken(stored);
+        this.enforceCapacity();
+    }
+    async get(query, opts) {
+        if (!query.refreshToken && !query.accessToken && query.userId === undefined) {
+            throw new Error('At least one token lookup field must be provided');
+        }
+        const includeExpired = opts?.includeExpired ?? false;
+        if (query.refreshToken) {
+            const record = this.tokens.get(query.refreshToken);
+            return record && matchesQuery(record, query, includeExpired) ? cloneToken(record) : null;
+        }
+        for (const token of this.tokens.values()) {
+            if (matchesQuery(token, query, includeExpired)) {
+                return cloneToken(token);
+            }
+        }
+        return null;
+    }
+    async delete(query) {
+        if (!query.refreshToken && !query.accessToken && query.userId === undefined && !query.clientId) {
+            return 0;
+        }
+        let removed = 0;
+        const refreshTokens = [...this.tokens.keys()];
+        for (const refreshToken of refreshTokens) {
+            const token = this.tokens.get(refreshToken);
+            if (token && matchesQuery(token, query, true)) {
+                this.removeByRefreshToken(refreshToken);
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+    async update(params) {
+        const token = this.tokens.get(params.refreshToken);
+        if (!token) {
+            return false;
+        }
+        if (params.clientId && token.clientId !== params.clientId) {
+            return false;
+        }
+        const merged = { ...token };
+        const maybeAssign = (key) => {
+            const value = params[key];
+            if (value !== undefined && value !== null) {
+                merged[key] = value;
+            }
+        };
+        maybeAssign('accessToken');
+        maybeAssign('expires');
+        maybeAssign('issuedAt');
+        maybeAssign('lastSeenAt');
+        maybeAssign('scope');
+        maybeAssign('label');
+        maybeAssign('domain');
+        maybeAssign('fingerprint');
+        maybeAssign('browser');
+        maybeAssign('device');
+        maybeAssign('ip');
+        maybeAssign('os');
+        maybeAssign('refreshTtlSeconds');
+        maybeAssign('loginType');
+        maybeAssign('sessionCookie');
+        const normalized = this.normalizeToken(merged);
+        const previousUserId = token.userId;
+        const previousRefreshToken = token.refreshToken;
+        const userChanged = comparableUserId(previousUserId) !== comparableUserId(normalized.userId);
+        Object.assign(token, normalized);
+        if (userChanged || previousRefreshToken !== token.refreshToken) {
+            this.unindexToken({ ...token, userId: previousUserId, refreshToken: previousRefreshToken });
+            this.indexToken(token);
+            if (previousRefreshToken !== token.refreshToken) {
+                this.tokens.delete(previousRefreshToken);
+                this.tokens.set(token.refreshToken, token);
+            }
+        }
+        return true;
+    }
+    async list(userId, opts = {}) {
+        const includeExpired = opts.includeExpired ?? false;
+        const normalizedUserId = comparableUserId(userId);
+        const userRefreshTokens = normalizedUserId ? [...(this.tokensByUser.get(normalizedUserId) ?? [])] : [];
+        const filtered = userRefreshTokens
+            .map((refreshToken) => this.tokens.get(refreshToken))
+            .filter((token) => Boolean(token))
+            .filter((token) => matchesQuery(token, { userId: normalizedUserId }, includeExpired));
+        const offset = opts.offset ?? 0;
+        const limit = opts.limit ?? filtered.length;
+        return filtered.slice(offset, offset + limit).map(cloneToken);
+    }
+    async close() {
+        return;
+    }
+    enforceCapacity() {
+        if (!this.maxTokens) {
+            return;
+        }
+        while (this.tokens.size > this.maxTokens) {
+            const oldestRefresh = this.tokens.keys().next().value;
+            if (!oldestRefresh) {
+                return;
+            }
+            this.removeByRefreshToken(oldestRefresh);
+        }
+    }
+}
+exports.MemoryTokenStore = MemoryTokenStore;

package/dist/cjs/token/memory.d.ts

@@ -0,0 +1,29 @@
+import { TokenStore } from './base.js';
+import type { Token } from './types.js';
+export interface MemoryTokenStoreOptions {
+    maxTokens?: number;
+}
+export declare class MemoryTokenStore extends TokenStore {
+    private readonly tokens;
+    private readonly tokensByUser;
+    private readonly maxTokens?;
+    constructor(options?: MemoryTokenStoreOptions);
+    private indexToken;
+    private unindexToken;
+    private removeByRefreshToken;
+    save(record: Token): Promise<void>;
+    get(query: Partial<Token>, opts?: {
+        includeExpired?: boolean;
+    }): Promise<Token | null>;
+    delete(query: Partial<Token>): Promise<number>;
+    update(params: Partial<Token> & {
+        refreshToken: string;
+    }): Promise<boolean>;
+    list(userId: string | number, opts?: {
+        limit?: number;
+        offset?: number;
+        includeExpired?: boolean;
+    }): Promise<Token[]>;
+    close(): Promise<void>;
+    private enforceCapacity;
+}