@vercube/auth 1.2.0 → 1.3.0

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { BaseMiddleware, MiddlewareOptions } from "@vercube/core";
 //#region src/Services/AuthProvider.d.ts
-declare abstract class AuthProvider<U = unknown> {
+export declare abstract class AuthProvider<U = unknown> {
   /**
    * Validate authentication
    * @param {Request} request - The request object
@@ -17,7 +17,7 @@ declare abstract class AuthProvider<U = unknown> {
 }
 //#endregion
 //#region src/Types/AuthTypes.d.ts
-declare namespace AuthTypes {
+export declare namespace AuthTypes {
   /**
    * Middleware options for auth
    */
@@ -41,7 +41,7 @@ declare namespace AuthTypes {
  * @param options Optional options for the authentication middleware
  * @returns A decorator function that adds authentication middleware to the target
  */
-declare function Auth(options?: AuthTypes.MiddlewareOptions): Function;
+export declare function Auth(options?: AuthTypes.MiddlewareOptions): Function;
 //#endregion
 //#region src/Decorators/User.d.ts
 /**
@@ -73,7 +73,7 @@ interface UserDecoratorOptions {
  *   // user is retrieved using CustomAuthProvider
  * }
  */
-declare function User(params?: UserDecoratorOptions): Function;
+export declare function User(params?: UserDecoratorOptions): Function;
 //#endregion
 //#region src/Middleware/AuthMiddleware.d.ts
 /**
@@ -84,7 +84,7 @@ declare function User(params?: UserDecoratorOptions): Function;
  * const middleware = new AuthMiddleware();
  * await middleware.use(event);
  */
-declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptions> {
+export declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptions> {
   private gContainer;
   private gLogger;
   private gAuthProvider;
@@ -98,5 +98,4 @@ declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptio
    */
   onRequest(request: Request, response: Response, args: MiddlewareOptions<AuthTypes.MiddlewareOptions>): Promise<void>;
 }
-//#endregion
-export { Auth, AuthMiddleware, AuthProvider, AuthTypes, User };
+//#endregion

package/dist/index.mjs

@@ -1,10 +1,11 @@
 import { UnauthorizedError, addMetadataMiddleware, initializeMetadata, initializeMetadataMethod, setMetadataArg } from "@vercube/core";
 import { BaseDecorator, Container, Inject, InjectOptional, createDecorator } from "@vercube/di";
 import { Logger } from "@vercube/logger";
+import { ValueType, createInstrument } from "@vercube/telemetry/instrument";
 //#region src/Services/AuthProvider.ts
 var AuthProvider = class {};
 //#endregion
-//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -14,6 +15,34 @@ function __decorate(decorators, target, key, desc) {
 //#endregion
 //#region src/Middleware/AuthMiddleware.ts
 /**
+* Records auth signals.
+*
+* The toolkit comes from `@vercube/telemetry/instrument`, which is the only
+* place in the framework that speaks to OpenTelemetry directly.
+*/
+const instrument = createInstrument("@vercube/auth");
+/** Attribute carrying how an authentication attempt ended. */
+const AUTH_OUTCOME = "vercube.auth.outcome";
+/**
+* Records the outcome of one authentication attempt.
+*
+* Recorded on the request span rather than as a span of its own: the check is
+* part of serving the request, not a separate operation, and an extra span per
+* request for something that usually takes microseconds buys nothing. No
+* principal, token or header ever leaves this function.
+*
+* @param {string} outcome - `allowed`, `denied` or `unconfigured`
+* @returns {void}
+*/
+function recordOutcome(outcome) {
+	instrument.activeSpan()?.addEvent("auth.decision", { [AUTH_OUTCOME]: outcome });
+	instrument.counter("vercube.auth.decisions", {
+		description: "Authentication decisions by outcome.",
+		unit: "{decision}",
+		valueType: ValueType.INT
+	}).add(1, { [AUTH_OUTCOME]: outcome });
+}
+/**
 * Middleware for auth
 * @implements {BaseMiddleware}
 * @description authorizes incoming request
@@ -38,10 +67,15 @@ var AuthMiddleware = class {
 		if (args?.middlewareArgs?.provider) provider = this.gContainer.getOptional(args.middlewareArgs.provider);
 		if (!provider) {
 			this.gLogger?.warn("AuthMiddleware::AuthProvider is not registered");
+			recordOutcome("unconfigured");
 			return;
 		}
 		const authenticationError = await provider.validate(request, args.middlewareArgs);
-		if (authenticationError) throw new UnauthorizedError(authenticationError);
+		if (authenticationError) {
+			recordOutcome("denied");
+			throw new UnauthorizedError(authenticationError);
+		}
+		recordOutcome("allowed");
 	}
 };
 __decorate([Inject(Container)], AuthMiddleware.prototype, "gContainer", void 0);
@@ -84,7 +118,8 @@ var UserDecorator = class extends BaseDecorator {
 	*/
 	created() {
 		initializeMetadata(this.prototype);
-		setMetadataArg(initializeMetadataMethod(this.prototype, this.propertyName), {
+		const method = initializeMetadataMethod(this.prototype, this.propertyName);
+		setMetadataArg(method, {
 			idx: this.propertyIndex,
 			type: "custom",
 			resolver: async (event) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercube/auth",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Auth module for Vercube framework",
   "repository": {
     "type": "git",
@@ -22,9 +22,10 @@
     "README.md"
   ],
   "dependencies": {
-    "@vercube/core": "1.2.0",
-    "@vercube/di": "1.2.0",
-    "@vercube/logger": "1.2.0"
+    "@vercube/core": "1.3.0",
+    "@vercube/di": "1.3.0",
+    "@vercube/logger": "1.3.0",
+    "@vercube/telemetry": "1.3.0"
   },
   "publishConfig": {
     "access": "public"