@vercube/auth 1.2.1 → 1.3.1

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { BaseMiddleware, MiddlewareOptions } from "@vercube/core";
 //#region src/Services/AuthProvider.d.ts
-declare abstract class AuthProvider<U = unknown> {
+export declare abstract class AuthProvider<U = unknown> {
   /**
    * Validate authentication
    * @param {Request} request - The request object
@@ -17,7 +17,7 @@ declare abstract class AuthProvider<U = unknown> {
 }
 //#endregion
 //#region src/Types/AuthTypes.d.ts
-declare namespace AuthTypes {
+export declare namespace AuthTypes {
   /**
    * Middleware options for auth
    */
@@ -41,7 +41,7 @@ declare namespace AuthTypes {
  * @param options Optional options for the authentication middleware
  * @returns A decorator function that adds authentication middleware to the target
  */
-declare function Auth(options?: AuthTypes.MiddlewareOptions): Function;
+export declare function Auth(options?: AuthTypes.MiddlewareOptions): Function;
 //#endregion
 //#region src/Decorators/User.d.ts
 /**
@@ -73,7 +73,7 @@ interface UserDecoratorOptions {
  *   // user is retrieved using CustomAuthProvider
  * }
  */
-declare function User(params?: UserDecoratorOptions): Function;
+export declare function User(params?: UserDecoratorOptions): Function;
 //#endregion
 //#region src/Middleware/AuthMiddleware.d.ts
 /**
@@ -84,10 +84,8 @@ declare function User(params?: UserDecoratorOptions): Function;
  * const middleware = new AuthMiddleware();
  * await middleware.use(event);
  */
-declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptions> {
+export declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptions> {
   private gContainer;
-  private gLogger;
-  private gAuthProvider;
   /**
    * Middleware function that processes the HTTP event.
    *
@@ -95,8 +93,9 @@ declare class AuthMiddleware implements BaseMiddleware<AuthTypes.MiddlewareOptio
    * @param {Response} response - The HTTP response to be processed
    * @param {MiddlewareOptions} args - Additional arguments for the middleware
    * @returns {Promise<void>} - A promise that resolves when the processing is complete.
+   * @throws {InternalServerError} - If the auth provider is not registered in the container
+   * @throws {UnauthorizedError} - If authentication fails
    */
   onRequest(request: Request, response: Response, args: MiddlewareOptions<AuthTypes.MiddlewareOptions>): Promise<void>;
 }
-//#endregion
-export { Auth, AuthMiddleware, AuthProvider, AuthTypes, User };
+//#endregion

package/dist/index.mjs

@@ -1,10 +1,10 @@
-import { UnauthorizedError, addMetadataMiddleware, initializeMetadata, initializeMetadataMethod, setMetadataArg } from "@vercube/core";
-import { BaseDecorator, Container, Inject, InjectOptional, createDecorator } from "@vercube/di";
-import { Logger } from "@vercube/logger";
+import { InternalServerError, UnauthorizedError, addMetadataMiddleware, initializeMetadata, initializeMetadataMethod, setMetadataArg } from "@vercube/core";
+import { BaseDecorator, Container, Inject, createDecorator } from "@vercube/di";
+import { ValueType, createInstrument } from "@vercube/telemetry/instrument";
 //#region src/Services/AuthProvider.ts
 var AuthProvider = class {};
 //#endregion
-//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.150.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -14,6 +14,34 @@ function __decorate(decorators, target, key, desc) {
 //#endregion
 //#region src/Middleware/AuthMiddleware.ts
 /**
+* Records auth signals.
+*
+* The toolkit comes from `@vercube/telemetry/instrument`, which is the only
+* place in the framework that speaks to OpenTelemetry directly.
+*/
+const instrument = createInstrument("@vercube/auth");
+/** Attribute carrying how an authentication attempt ended. */
+const AUTH_OUTCOME = "vercube.auth.outcome";
+/**
+* Records the outcome of one authentication attempt.
+*
+* Recorded on the request span rather than as a span of its own: the check is
+* part of serving the request, not a separate operation, and an extra span per
+* request for something that usually takes microseconds buys nothing. No
+* principal, token or header ever leaves this function.
+*
+* @param {string} outcome - `allowed`, `denied` or `unconfigured`
+* @returns {void}
+*/
+function recordOutcome(outcome) {
+	instrument.activeSpan()?.addEvent("auth.decision", { [AUTH_OUTCOME]: outcome });
+	instrument.counter("vercube.auth.decisions", {
+		description: "Authentication decisions by outcome.",
+		unit: "{decision}",
+		valueType: ValueType.INT
+	}).add(1, { [AUTH_OUTCOME]: outcome });
+}
+/**
 * Middleware for auth
 * @implements {BaseMiddleware}
 * @description authorizes incoming request
@@ -23,8 +51,6 @@ function __decorate(decorators, target, key, desc) {
 */
 var AuthMiddleware = class {
 	gContainer;
-	gLogger;
-	gAuthProvider;
 	/**
 	* Middleware function that processes the HTTP event.
 	*
@@ -32,21 +58,25 @@ var AuthMiddleware = class {
 	* @param {Response} response - The HTTP response to be processed
 	* @param {MiddlewareOptions} args - Additional arguments for the middleware
 	* @returns {Promise<void>} - A promise that resolves when the processing is complete.
+	* @throws {InternalServerError} - If the auth provider is not registered in the container
+	* @throws {UnauthorizedError} - If authentication fails
 	*/
 	async onRequest(request, response, args) {
-		let provider = this.gAuthProvider;
-		if (args?.middlewareArgs?.provider) provider = this.gContainer.getOptional(args.middlewareArgs.provider);
+		const providerKey = args?.middlewareArgs?.provider ?? AuthProvider;
+		const provider = this.gContainer.getOptional(providerKey);
 		if (!provider) {
-			this.gLogger?.warn("AuthMiddleware::AuthProvider is not registered");
-			return;
+			recordOutcome("unconfigured");
+			throw new InternalServerError(`AuthMiddleware: auth provider "${providerKey.name}" is not registered in the container`);
 		}
 		const authenticationError = await provider.validate(request, args.middlewareArgs);
-		if (authenticationError) throw new UnauthorizedError(authenticationError);
+		if (authenticationError) {
+			recordOutcome("denied");
+			throw new UnauthorizedError(authenticationError);
+		}
+		recordOutcome("allowed");
 	}
 };
 __decorate([Inject(Container)], AuthMiddleware.prototype, "gContainer", void 0);
-__decorate([InjectOptional(Logger)], AuthMiddleware.prototype, "gLogger", void 0);
-__decorate([InjectOptional(AuthProvider)], AuthMiddleware.prototype, "gAuthProvider", void 0);
 //#endregion
 //#region src/Decorators/Auth.ts
 /**
@@ -84,7 +114,8 @@ var UserDecorator = class extends BaseDecorator {
 	*/
 	created() {
 		initializeMetadata(this.prototype);
-		setMetadataArg(initializeMetadataMethod(this.prototype, this.propertyName), {
+		const method = initializeMetadataMethod(this.prototype, this.propertyName);
+		setMetadataArg(method, {
 			idx: this.propertyIndex,
 			type: "custom",
 			resolver: async (event) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercube/auth",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "Auth module for Vercube framework",
   "repository": {
     "type": "git",
@@ -22,9 +22,10 @@
     "README.md"
   ],
   "dependencies": {
-    "@vercube/core": "1.2.1",
-    "@vercube/logger": "1.2.1",
-    "@vercube/di": "1.2.1"
+    "@vercube/core": "1.3.1",
+    "@vercube/di": "1.3.1",
+    "@vercube/logger": "1.3.1",
+    "@vercube/telemetry": "1.3.1"
   },
   "publishConfig": {
     "access": "public"