@webiny/api-core 0.0.0-unstable.0d717d18dd

package/features/security/apiKeys/shared/ApiKeysRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/shared/ApiKeysRepository.js","sources":["../../../../../src/features/security/apiKeys/shared/ApiKeysRepository.ts"],"sourcesContent":["import { createImplementation } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport { ApiKeysRepository as RepositoryAbstraction } from \"./abstractions.js\";\nimport { ApiKeyProvider } from \"./abstractions.js\";\nimport type { ApiKey, ListApiKeysInput } from \"./types.js\";\nimport { SecurityStorageOperations } from \"~/features/security/shared/abstractions.js\";\nimport { TenantContext } from \"~/features/tenancy/TenantContext/index.js\";\nimport { ApiKeyNotFoundError, ApiKeyPersistenceError, ApiKeyValidationError } from \"./errors.js\";\n\n// TODO: create an ApiKeyMapper\n\nclass ApiKeysRepositoryImpl implements RepositoryAbstraction.Interface {\n    private resolving = false;\n\n    constructor(\n        private tenantContext: TenantContext.Interface,\n        private storageOperations: SecurityStorageOperations.Interface,\n        private apiKeyProvider: ApiKeyProvider.Interface\n    ) {}\n\n    async get(id: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKey({ id, tenant: tenant.id });\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(error);\n        }\n    }\n\n    async getByToken(token: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyByToken({\n                token,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            if (!this.resolving) {\n                this.resolving = true;\n                try {\n                    const factoryApiKey = await this.apiKeyProvider.getByToken(token);\n                    if (factoryApiKey) {\n                        return Result.ok(factoryApiKey);\n                    }\n                } finally {\n                    this.resolving = false;\n                }\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async getBySlug(slug: string): Promise<Result<ApiKey, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const apiKey = await this.storageOperations.getApiKeyBySlug({\n                slug,\n                tenant: tenant.id\n            });\n\n            if (apiKey) {\n                return Result.ok(apiKey);\n            }\n\n            if (!this.resolving) {\n                this.resolving = true;\n                try {\n                    const factoryApiKey = await this.apiKeyProvider.getBySlug(slug);\n                    if (factoryApiKey) {\n                        return Result.ok(factoryApiKey);\n                    }\n                } finally {\n                    this.resolving = false;\n                }\n            }\n\n            return Result.fail(new ApiKeyNotFoundError());\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async list(params: ListApiKeysInput): Promise<Result<ApiKey[], RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            const result = await this.storageOperations.listApiKeys({\n                where: { tenant: tenant.id },\n                ...params\n            });\n            return Result.ok(result);\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async create(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            // Check if an API key with the same slug already exists\n            const existingKeyResult = await this.getBySlug(apiKey.slug);\n\n            // If we found a key, it's a duplicate slug - return validation error\n            if (existingKeyResult.isOk()) {\n                return Result.fail(\n                    new ApiKeyValidationError(`API key with slug \"${apiKey.slug}\" already exists.`)\n                );\n            }\n\n            // \"NotFound\" error is ok. Everything else is not ok.\n            if (existingKeyResult.error.code !== \"ApiKey/NotFound\") {\n                return Result.fail(existingKeyResult.error);\n            }\n\n            // Slug is unique, proceed with creation\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.createApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async update(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.updateApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n\n    async delete(apiKey: ApiKey): Promise<Result<void, RepositoryAbstraction.Error>> {\n        try {\n            const tenant = this.tenantContext.getTenant();\n            await this.storageOperations.deleteApiKey({ apiKey: { ...apiKey, tenant: tenant.id } });\n\n            return Result.ok();\n        } catch (error) {\n            return Result.fail(new ApiKeyPersistenceError(error));\n        }\n    }\n}\n\nexport const ApiKeysRepository = createImplementation({\n    abstraction: RepositoryAbstraction,\n    implementation: ApiKeysRepositoryImpl,\n    dependencies: [TenantContext, SecurityStorageOperations, ApiKeyProvider]\n});\n"],"names":["ApiKeysRepositoryImpl","tenantContext","storageOperations","apiKeyProvider","id","tenant","apiKey","Result","ApiKeyNotFoundError","error","token","factoryApiKey","ApiKeyPersistenceError","slug","params","result","existingKeyResult","ApiKeyValidationError","ApiKeysRepository","createImplementation","RepositoryAbstraction","TenantContext","SecurityStorageOperations","ApiKeyProvider"],"mappings":";;;;;AAWA,MAAMA;IAGF,YACYC,aAAsC,EACtCC,iBAAsD,EACtDC,cAAwC,CAClD;aAHUF,aAAa,GAAbA;aACAC,iBAAiB,GAAjBA;aACAC,cAAc,GAAdA;aALJ,SAAS,GAAG;IAMjB;IAEH,MAAM,IAAIC,EAAU,EAAwD;QACxE,IAAI;YACA,MAAMC,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBAAEF;gBAAI,QAAQC,OAAO,EAAE;YAAC;YAC9E,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,OAAOC,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAACE;QACvB;IACJ;IAEA,MAAM,WAAWC,KAAa,EAAwD;QAClF,IAAI;YACA,MAAML,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;gBACzDI;gBACA,QAAQL,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjB,IAAI,CAAC,SAAS,GAAG;gBACjB,IAAI;oBACA,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAACD;oBAC3D,IAAIC,eACA,OAAOJ,OAAO,EAAE,CAACI;gBAEzB,SAAU;oBACN,IAAI,CAAC,SAAS,GAAG;gBACrB;YACJ;YAEA,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,UAAUI,IAAY,EAAwD;QAChF,IAAI;YACA,MAAMR,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMC,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;gBACxDO;gBACA,QAAQR,OAAO,EAAE;YACrB;YAEA,IAAIC,QACA,OAAOC,OAAO,EAAE,CAACD;YAGrB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACjB,IAAI,CAAC,SAAS,GAAG;gBACjB,IAAI;oBACA,MAAMK,gBAAgB,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAACE;oBAC1D,IAAIF,eACA,OAAOJ,OAAO,EAAE,CAACI;gBAEzB,SAAU;oBACN,IAAI,CAAC,SAAS,GAAG;gBACrB;YACJ;YAEA,OAAOJ,OAAO,IAAI,CAAC,IAAIC;QAC3B,EAAE,OAAOC,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,KAAKK,MAAwB,EAA0D;QACzF,IAAI;YACA,MAAMT,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAMU,SAAS,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC;gBACpD,OAAO;oBAAE,QAAQV,OAAO,EAAE;gBAAC;gBAC3B,GAAGS,MAAM;YACb;YACA,OAAOP,OAAO,EAAE,CAACQ;QACrB,EAAE,OAAON,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YAEA,MAAMU,oBAAoB,MAAM,IAAI,CAAC,SAAS,CAACV,OAAO,IAAI;YAG1D,IAAIU,kBAAkB,IAAI,IACtB,OAAOT,OAAO,IAAI,CACd,IAAIU,sBAAsB,CAAC,mBAAmB,EAAEX,OAAO,IAAI,CAAC,iBAAiB,CAAC;YAKtF,IAAIU,AAAiC,sBAAjCA,kBAAkB,KAAK,CAAC,IAAI,EAC5B,OAAOT,OAAO,IAAI,CAACS,kBAAkB,KAAK;YAI9C,MAAMX,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YACrF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;IAEA,MAAM,OAAOH,MAAc,EAAsD;QAC7E,IAAI;YACA,MAAMD,SAAS,IAAI,CAAC,aAAa,CAAC,SAAS;YAC3C,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;gBAAE,QAAQ;oBAAE,GAAGC,MAAM;oBAAE,QAAQD,OAAO,EAAE;gBAAC;YAAE;YAErF,OAAOE,OAAO,EAAE;QACpB,EAAE,OAAOE,OAAO;YACZ,OAAOF,OAAO,IAAI,CAAC,IAAIK,uBAAuBH;QAClD;IACJ;AACJ;AAEO,MAAMS,sCAAoBC,qBAAqB;IAClD,aAAaC;IACb,gBAAgBpB;IAChB,cAAc;QAACqB;QAAeC;QAA2BC;KAAe;AAC5E"}

package/features/security/apiKeys/shared/abstractions.d.ts

@@ -0,0 +1,45 @@
+import { Result } from "@webiny/feature/api";
+import type { ApiKey, ListApiKeysInput } from "./types.js";
+import { type ApiKeyNotFoundError, ApiKeyPersistenceError, ApiKeyValidationError } from "./errors.js";
+export interface IApiKeysRepositoryErrors {
+    base: ApiKeyNotFoundError | ApiKeyPersistenceError | ApiKeyValidationError;
+}
+type RepositoryError = IApiKeysRepositoryErrors[keyof IApiKeysRepositoryErrors];
+export interface IApiKeysRepository {
+    get(id: string): Promise<Result<ApiKey, RepositoryError>>;
+    getByToken(token: string): Promise<Result<ApiKey, RepositoryError>>;
+    getBySlug(token: string): Promise<Result<ApiKey, RepositoryError>>;
+    list(params: ListApiKeysInput): Promise<Result<ApiKey[], RepositoryError>>;
+    create(data: ApiKey): Promise<Result<void, RepositoryError>>;
+    update(data: ApiKey): Promise<Result<void, RepositoryError>>;
+    delete(apiKey: ApiKey): Promise<Result<void, RepositoryError>>;
+}
+/** Persist and retrieve API keys. */
+export declare const ApiKeysRepository: import("@webiny/di").Abstraction<IApiKeysRepository>;
+export declare namespace ApiKeysRepository {
+    type Interface = IApiKeysRepository;
+    type Error = RepositoryError;
+}
+export type CodeApiKey = Pick<ApiKey, "name" | "permissions" | "slug"> & {
+    token: `wat_${string}`;
+};
+export interface IApiKeyFactory {
+    execute(): Promise<CodeApiKey[]>;
+}
+/** Provide code-defined API keys. */
+export declare const ApiKeyFactory: import("@webiny/di").Abstraction<IApiKeyFactory>;
+export declare namespace ApiKeyFactory {
+    type Interface = IApiKeyFactory;
+    type Return = Promise<CodeApiKey[]>;
+    type ApiKey = CodeApiKey;
+}
+export interface IApiKeyProvider {
+    getByToken(token: string): Promise<ApiKey | null>;
+    getBySlug(slug: string): Promise<ApiKey | null>;
+}
+/** Retrieve API keys by token or slug. */
+export declare const ApiKeyProvider: import("@webiny/di").Abstraction<IApiKeyProvider>;
+export declare namespace ApiKeyProvider {
+    type Interface = IApiKeyProvider;
+}
+export {};

package/features/security/apiKeys/shared/abstractions.js

@@ -0,0 +1,7 @@
+import { createAbstraction } from "@webiny/feature/api";
+const ApiKeysRepository = createAbstraction("ApiKeysRepository");
+const ApiKeyFactory = createAbstraction("ApiKeyFactory");
+const ApiKeyProvider = createAbstraction("ApiKeyProvider");
+export { ApiKeyFactory, ApiKeyProvider, ApiKeysRepository };
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/apiKeys/shared/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/shared/abstractions.js","sources":["../../../../../src/features/security/apiKeys/shared/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport { Result } from \"@webiny/feature/api\";\nimport type { ApiKey, ListApiKeysInput } from \"./types.js\";\nimport {\n    type ApiKeyNotFoundError,\n    ApiKeyPersistenceError,\n    ApiKeyValidationError\n} from \"./errors.js\";\n\nexport interface IApiKeysRepositoryErrors {\n    base: ApiKeyNotFoundError | ApiKeyPersistenceError | ApiKeyValidationError;\n}\n\ntype RepositoryError = IApiKeysRepositoryErrors[keyof IApiKeysRepositoryErrors];\n\nexport interface IApiKeysRepository {\n    get(id: string): Promise<Result<ApiKey, RepositoryError>>;\n    getByToken(token: string): Promise<Result<ApiKey, RepositoryError>>;\n    getBySlug(token: string): Promise<Result<ApiKey, RepositoryError>>;\n    list(params: ListApiKeysInput): Promise<Result<ApiKey[], RepositoryError>>;\n    create(data: ApiKey): Promise<Result<void, RepositoryError>>;\n    update(data: ApiKey): Promise<Result<void, RepositoryError>>;\n    delete(apiKey: ApiKey): Promise<Result<void, RepositoryError>>;\n}\n\n/** Persist and retrieve API keys. */\nexport const ApiKeysRepository = createAbstraction<IApiKeysRepository>(\"ApiKeysRepository\");\n\nexport namespace ApiKeysRepository {\n    export type Interface = IApiKeysRepository;\n    export type Error = RepositoryError;\n}\n\nexport type CodeApiKey = Pick<ApiKey, \"name\" | \"permissions\" | \"slug\"> & {\n    token: `wat_${string}`;\n};\n\nexport interface IApiKeyFactory {\n    execute(): Promise<CodeApiKey[]>;\n}\n\n/** Provide code-defined API keys. */\nexport const ApiKeyFactory = createAbstraction<IApiKeyFactory>(\"ApiKeyFactory\");\n\nexport namespace ApiKeyFactory {\n    export type Interface = IApiKeyFactory;\n    export type Return = Promise<CodeApiKey[]>;\n    export type ApiKey = CodeApiKey;\n}\n\nexport interface IApiKeyProvider {\n    getByToken(token: string): Promise<ApiKey | null>;\n    getBySlug(slug: string): Promise<ApiKey | null>;\n}\n\n/** Retrieve API keys by token or slug. */\nexport const ApiKeyProvider = createAbstraction<IApiKeyProvider>(\"ApiKeyProvider\");\n\nexport namespace ApiKeyProvider {\n    export type Interface = IApiKeyProvider;\n}\n"],"names":["ApiKeysRepository","createAbstraction","ApiKeyFactory","ApiKeyProvider"],"mappings":";AA0BO,MAAMA,oBAAoBC,kBAAsC;AAgBhE,MAAMC,gBAAgBD,kBAAkC;AAcxD,MAAME,iBAAiBF,kBAAmC"}

package/features/security/apiKeys/shared/errors.d.ts

@@ -0,0 +1,24 @@
+import { BaseError } from "@webiny/feature/api";
+export declare class ApiKeyPersistenceError extends BaseError {
+    readonly code: "ApiKey/Persistence";
+    constructor(error: Error);
+}
+export declare class ApiKeyNotFoundError extends BaseError {
+    readonly code: "ApiKey/NotFound";
+    constructor();
+}
+type NotAuthorizedErrorData = {
+    message?: string;
+};
+export declare class ApiKeyNotAuthorizedError extends BaseError<NotAuthorizedErrorData> {
+    readonly code: "ApiKey/NotAuthorized";
+    constructor(data?: NotAuthorizedErrorData);
+}
+type ApiKeyValidationErrorData = {
+    message: string;
+};
+export declare class ApiKeyValidationError extends BaseError<ApiKeyValidationErrorData> {
+    readonly code: "ApiKey/Validation";
+    constructor(message: string);
+}
+export {};

package/features/security/apiKeys/shared/errors.js

@@ -0,0 +1,36 @@
+import { BaseError } from "@webiny/feature/api";
+class ApiKeyPersistenceError extends BaseError {
+    constructor(error){
+        super({
+            message: error.message
+        }), this.code = "ApiKey/Persistence";
+    }
+}
+class ApiKeyNotFoundError extends BaseError {
+    constructor(){
+        super({
+            message: "API key was not found!"
+        }), this.code = "ApiKey/NotFound";
+    }
+}
+class ApiKeyNotAuthorizedError extends BaseError {
+    constructor(data = {}){
+        super({
+            message: data.message || "Not authorized!",
+            data
+        }), this.code = "ApiKey/NotAuthorized";
+    }
+}
+class ApiKeyValidationError extends BaseError {
+    constructor(message){
+        super({
+            message,
+            data: {
+                message
+            }
+        }), this.code = "ApiKey/Validation";
+    }
+}
+export { ApiKeyNotAuthorizedError, ApiKeyNotFoundError, ApiKeyPersistenceError, ApiKeyValidationError };
+
+//# sourceMappingURL=errors.js.map

package/features/security/apiKeys/shared/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/shared/errors.js","sources":["../../../../../src/features/security/apiKeys/shared/errors.ts"],"sourcesContent":["import { BaseError } from \"@webiny/feature/api\";\n\nexport class ApiKeyPersistenceError extends BaseError {\n    override readonly code = \"ApiKey/Persistence\" as const;\n\n    constructor(error: Error) {\n        super({\n            message: error.message\n        });\n    }\n}\n\nexport class ApiKeyNotFoundError extends BaseError {\n    override readonly code = \"ApiKey/NotFound\" as const;\n\n    constructor() {\n        super({\n            message: `API key was not found!`\n        });\n    }\n}\n\ntype NotAuthorizedErrorData = {\n    message?: string;\n};\n\nexport class ApiKeyNotAuthorizedError extends BaseError<NotAuthorizedErrorData> {\n    override readonly code = \"ApiKey/NotAuthorized\" as const;\n\n    constructor(data: NotAuthorizedErrorData = {}) {\n        super({\n            message: data.message || \"Not authorized!\",\n            data\n        });\n    }\n}\n\ntype ApiKeyValidationErrorData = {\n    message: string;\n};\n\nexport class ApiKeyValidationError extends BaseError<ApiKeyValidationErrorData> {\n    override readonly code = \"ApiKey/Validation\" as const;\n\n    constructor(message: string) {\n        super({\n            message,\n            data: { message }\n        });\n    }\n}\n"],"names":["ApiKeyPersistenceError","BaseError","error","ApiKeyNotFoundError","ApiKeyNotAuthorizedError","data","ApiKeyValidationError","message"],"mappings":";AAEO,MAAMA,+BAA+BC;IAGxC,YAAYC,KAAY,CAAE;QACtB,KAAK,CAAC;YACF,SAASA,MAAM,OAAO;QAC1B,SALc,IAAI,GAAG;IAMzB;AACJ;AAEO,MAAMC,4BAA4BF;IAGrC,aAAc;QACV,KAAK,CAAC;YACF,SAAS;QACb,SALc,IAAI,GAAG;IAMzB;AACJ;AAMO,MAAMG,iCAAiCH;IAG1C,YAAYI,OAA+B,CAAC,CAAC,CAAE;QAC3C,KAAK,CAAC;YACF,SAASA,KAAK,OAAO,IAAI;YACzBA;QACJ,SANc,IAAI,GAAG;IAOzB;AACJ;AAMO,MAAMC,8BAA8BL;IAGvC,YAAYM,OAAe,CAAE;QACzB,KAAK,CAAC;YACFA;YACA,MAAM;gBAAEA;YAAQ;QACpB,SANc,IAAI,GAAG;IAOzB;AACJ"}

package/features/security/apiKeys/shared/generateToken.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Generates a random token for API keys.
+ * API Keys are prefixed with letter "wat_" to make token verification easier.
+ * When authentication plugins kick in, they will be able to tell if they should handle
+ * the token by checking the first letter.
+ */
+export declare const generateToken: (tokenLength?: number) => `wat_${string}`;

package/features/security/apiKeys/shared/generateToken.js

@@ -0,0 +1,9 @@
+import crypto_0 from "crypto";
+const generateToken = (tokenLength = 40)=>{
+    const token = crypto_0.randomBytes(Math.ceil(tokenLength / 2)).toString("hex");
+    if (token.startsWith("wat_")) return token;
+    return `wat_${token.slice(0, tokenLength - 4)}`;
+};
+export { generateToken };
+
+//# sourceMappingURL=generateToken.js.map

package/features/security/apiKeys/shared/generateToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/shared/generateToken.js","sources":["../../../../../src/features/security/apiKeys/shared/generateToken.ts"],"sourcesContent":["import crypto from \"crypto\";\n\n/**\n * Generates a random token for API keys.\n * API Keys are prefixed with letter \"wat_\" to make token verification easier.\n * When authentication plugins kick in, they will be able to tell if they should handle\n * the token by checking the first letter.\n */\nexport const generateToken = (tokenLength = 40): `wat_${string}` => {\n    const token = crypto.randomBytes(Math.ceil(tokenLength / 2)).toString(\"hex\");\n\n    // API Keys are prefixed with letters \"wat_\" to make token verification easier\n    if (token.startsWith(\"wat_\")) {\n        return token as `wat_${string}`;\n    }\n\n    return `wat_${token.slice(0, tokenLength - 4)}`;\n};\n"],"names":["generateToken","tokenLength","token","crypto","Math"],"mappings":";AAQO,MAAMA,gBAAgB,CAACC,cAAc,EAAE;IAC1C,MAAMC,QAAQC,SAAAA,WAAkB,CAACC,KAAK,IAAI,CAACH,cAAc,IAAI,QAAQ,CAAC;IAGtE,IAAIC,MAAM,UAAU,CAAC,SACjB,OAAOA;IAGX,OAAO,CAAC,IAAI,EAAEA,MAAM,KAAK,CAAC,GAAGD,cAAc,IAAI;AACnD"}

package/features/security/apiKeys/shared/schemas.d.ts

@@ -0,0 +1,30 @@
+import { z } from "zod";
+export declare const createApiKeyInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+    description: z.ZodString;
+    permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$loose>>>>;
+}, z.core.$strip>;
+export declare const updateApiKeyInputSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$loose>>>>;
+}, z.core.$strip>;
+export declare const listApiKeysInputSchema: z.ZodObject<{
+    where: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        name_contains: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        description_contains: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    after: z.ZodOptional<z.ZodString>;
+    sort: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        createdOn_ASC: "createdOn_ASC";
+        createdOn_DESC: "createdOn_DESC";
+    }>>>;
+}, z.core.$strip>;

package/features/security/apiKeys/shared/schemas.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+const createApiKeyInputSchema = z.object({
+    name: z.string().min(1),
+    slug: z.string().min(1),
+    description: z.string(),
+    permissions: z.array(z.looseObject({
+        name: z.string()
+    })).optional().default([])
+});
+const updateApiKeyInputSchema = z.object({
+    name: z.string().min(1).optional(),
+    description: z.string().optional(),
+    permissions: z.array(z.looseObject({
+        name: z.string()
+    })).optional().default([])
+});
+const listApiKeysInputSchema = z.object({
+    where: z.object({
+        name: z.string().optional(),
+        name_contains: z.string().optional(),
+        description: z.string().optional(),
+        description_contains: z.string().optional()
+    }).optional(),
+    limit: z.number().int().positive().max(100).optional(),
+    after: z.string().optional(),
+    sort: z.array(z["enum"]([
+        "createdOn_ASC",
+        "createdOn_DESC"
+    ])).optional()
+});
+export { createApiKeyInputSchema, listApiKeysInputSchema, updateApiKeyInputSchema };
+
+//# sourceMappingURL=schemas.js.map

package/features/security/apiKeys/shared/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/apiKeys/shared/schemas.js","sources":["../../../../../src/features/security/apiKeys/shared/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const createApiKeyInputSchema = z.object({\n    name: z.string().min(1),\n    slug: z.string().min(1),\n    description: z.string(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const updateApiKeyInputSchema = z.object({\n    name: z.string().min(1).optional(),\n    description: z.string().optional(),\n    permissions: z\n        .array(z.looseObject({ name: z.string() }))\n        .optional()\n        .default([])\n});\n\nexport const listApiKeysInputSchema = z.object({\n    where: z\n        .object({\n            name: z.string().optional(),\n            name_contains: z.string().optional(),\n            description: z.string().optional(),\n            description_contains: z.string().optional()\n        })\n        .optional(),\n    limit: z.number().int().positive().max(100).optional(),\n    after: z.string().optional(),\n    sort: z.array(z.enum([\"createdOn_ASC\", \"createdOn_DESC\"])).optional()\n});\n"],"names":["createApiKeyInputSchema","z","updateApiKeyInputSchema","listApiKeysInputSchema"],"mappings":";AAEO,MAAMA,0BAA0BC,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC;IACrB,aAAaA,EAAE,MAAM;IACrB,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAMC,0BAA0BD,EAAE,MAAM,CAAC;IAC5C,MAAMA,EAAE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ;IAChC,aAAaA,EAAE,MAAM,GAAG,QAAQ;IAChC,aAAaA,EAAAA,KACH,CAACA,EAAE,WAAW,CAAC;QAAE,MAAMA,EAAE,MAAM;IAAG,IACvC,QAAQ,GACR,OAAO,CAAC,EAAE;AACnB;AAEO,MAAME,yBAAyBF,EAAE,MAAM,CAAC;IAC3C,OAAOA,EAAAA,MACI,CAAC;QACJ,MAAMA,EAAE,MAAM,GAAG,QAAQ;QACzB,eAAeA,EAAE,MAAM,GAAG,QAAQ;QAClC,aAAaA,EAAE,MAAM,GAAG,QAAQ;QAChC,sBAAsBA,EAAE,MAAM,GAAG,QAAQ;IAC7C,GACC,QAAQ;IACb,OAAOA,EAAE,MAAM,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,KAAK,QAAQ;IACpD,OAAOA,EAAE,MAAM,GAAG,QAAQ;IAC1B,MAAMA,EAAE,KAAK,CAACA,CAAC,CAADA,OAAM,CAAC;QAAC;QAAiB;KAAiB,GAAG,QAAQ;AACvE"}

package/features/security/apiKeys/shared/types.d.ts

@@ -0,0 +1,25 @@
+import type { CreatedBy, SecurityPermission } from "../../../../types/security.js";
+export interface ApiKey {
+    id: string;
+    name: string;
+    slug: string;
+    description: string;
+    token: `wat_${string}`;
+    permissions: SecurityPermission[];
+    createdBy: CreatedBy;
+    createdOn: string;
+}
+export interface CreateApiKeyInput {
+    name: string;
+    slug: string;
+    description: string;
+    permissions: SecurityPermission[];
+}
+export interface UpdateApiKeyInput {
+    name?: string;
+    description?: string;
+    permissions?: SecurityPermission[];
+}
+export interface ListApiKeysInput {
+    sort?: string[];
+}

package/features/security/authentication/AuthenticationContext/AuthenticationContext.d.ts

@@ -0,0 +1,15 @@
+import { EventPublisher } from "../../../../features/eventPublisher/index.js";
+import { AuthenticationContext as Abstraction } from "./abstractions.js";
+import { Authenticator } from "../Authenticator/index.js";
+import type { Identity } from "../../../../features/security/IdentityContext/Identity.js";
+declare class AuthenticationContextImpl implements Abstraction.Interface {
+    private authenticators;
+    private eventPublisher;
+    private authToken?;
+    constructor(authenticators: Authenticator.Interface[], eventPublisher: EventPublisher.Interface);
+    authenticate(token: string): Promise<Identity>;
+    getAuthToken(): string | undefined;
+    private processAuthenticators;
+}
+export declare const AuthenticationContext: import("@webiny/di").Implementation<typeof AuthenticationContextImpl>;
+export {};

package/features/security/authentication/AuthenticationContext/AuthenticationContext.js

@@ -0,0 +1,57 @@
+import { createImplementation } from "@webiny/di";
+import { EventPublisher } from "../../../eventPublisher/index.js";
+import { AuthenticationContext } from "./abstractions.js";
+import { Authenticator } from "../Authenticator/index.js";
+import { AfterAuthenticationEvent, BeforeAuthenticationEvent } from "./events.js";
+import { AnonymousIdentity, AuthenticatedIdentity } from "../../IdentityContext/index.js";
+import { AuthenticationError } from "./errors.js";
+class AuthenticationContextImpl {
+    constructor(authenticators, eventPublisher){
+        this.authenticators = authenticators;
+        this.eventPublisher = eventPublisher;
+    }
+    async authenticate(token) {
+        await this.eventPublisher.publish(new BeforeAuthenticationEvent({
+            token
+        }));
+        try {
+            return await this.processAuthenticators(token);
+        } catch (error) {
+            throw AuthenticationError.from(error);
+        }
+    }
+    getAuthToken() {
+        return this.authToken;
+    }
+    async processAuthenticators(token) {
+        for (const authenticator of this.authenticators){
+            const identityData = await authenticator.authenticate(token);
+            if (identityData) {
+                this.authToken = token;
+                const identity = new AuthenticatedIdentity(identityData);
+                await this.eventPublisher.publish(new AfterAuthenticationEvent({
+                    identity,
+                    token
+                }));
+                return identity;
+            }
+        }
+        return new AnonymousIdentity();
+    }
+}
+const AuthenticationContext_AuthenticationContext = createImplementation({
+    abstraction: AuthenticationContext,
+    implementation: AuthenticationContextImpl,
+    dependencies: [
+        [
+            Authenticator,
+            {
+                multiple: true
+            }
+        ],
+        EventPublisher
+    ]
+});
+export { AuthenticationContext_AuthenticationContext as AuthenticationContext };
+
+//# sourceMappingURL=AuthenticationContext.js.map

package/features/security/authentication/AuthenticationContext/AuthenticationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/authentication/AuthenticationContext/AuthenticationContext.js","sources":["../../../../../src/features/security/authentication/AuthenticationContext/AuthenticationContext.ts"],"sourcesContent":["import { createImplementation } from \"@webiny/di\";\nimport { EventPublisher } from \"~/features/eventPublisher/index.js\";\nimport { AuthenticationContext as Abstraction } from \"./abstractions.js\";\nimport { Authenticator } from \"../Authenticator/index.js\";\nimport { BeforeAuthenticationEvent, AfterAuthenticationEvent } from \"./events.js\";\nimport type { Identity } from \"~/features/security/IdentityContext/Identity.js\";\nimport {\n    AnonymousIdentity,\n    AuthenticatedIdentity\n} from \"~/features/security/IdentityContext/index.js\";\nimport { AuthenticationError } from \"./errors.js\";\n\nclass AuthenticationContextImpl implements Abstraction.Interface {\n    private authToken?: string;\n\n    constructor(\n        private authenticators: Authenticator.Interface[],\n        private eventPublisher: EventPublisher.Interface\n    ) {}\n\n    async authenticate(token: string): Promise<Identity> {\n        await this.eventPublisher.publish(new BeforeAuthenticationEvent({ token }));\n\n        try {\n            return await this.processAuthenticators(token);\n        } catch (error) {\n            throw AuthenticationError.from(error);\n        }\n    }\n\n    getAuthToken(): string | undefined {\n        return this.authToken;\n    }\n\n    private async processAuthenticators(token: string): Promise<Identity> {\n        // Try each authenticator until one succeeds\n        for (const authenticator of this.authenticators) {\n            const identityData = await authenticator.authenticate(token);\n            if (identityData) {\n                this.authToken = token;\n\n                const identity = new AuthenticatedIdentity(identityData);\n\n                await this.eventPublisher.publish(\n                    new AfterAuthenticationEvent({ identity, token })\n                );\n\n                return identity;\n            }\n        }\n\n        return new AnonymousIdentity();\n    }\n}\n\nexport const AuthenticationContext = createImplementation({\n    abstraction: Abstraction,\n    implementation: AuthenticationContextImpl,\n    dependencies: [[Authenticator, { multiple: true }], EventPublisher]\n});\n"],"names":["AuthenticationContextImpl","authenticators","eventPublisher","token","BeforeAuthenticationEvent","error","AuthenticationError","authenticator","identityData","identity","AuthenticatedIdentity","AfterAuthenticationEvent","AnonymousIdentity","AuthenticationContext","createImplementation","Abstraction","Authenticator","EventPublisher"],"mappings":";;;;;;;AAYA,MAAMA;IAGF,YACYC,cAAyC,EACzCC,cAAwC,CAClD;aAFUD,cAAc,GAAdA;aACAC,cAAc,GAAdA;IACT;IAEH,MAAM,aAAaC,KAAa,EAAqB;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAIC,0BAA0B;YAAED;QAAM;QAExE,IAAI;YACA,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAACA;QAC5C,EAAE,OAAOE,OAAO;YACZ,MAAMC,oBAAoB,IAAI,CAACD;QACnC;IACJ;IAEA,eAAmC;QAC/B,OAAO,IAAI,CAAC,SAAS;IACzB;IAEA,MAAc,sBAAsBF,KAAa,EAAqB;QAElE,KAAK,MAAMI,iBAAiB,IAAI,CAAC,cAAc,CAAE;YAC7C,MAAMC,eAAe,MAAMD,cAAc,YAAY,CAACJ;YACtD,IAAIK,cAAc;gBACd,IAAI,CAAC,SAAS,GAAGL;gBAEjB,MAAMM,WAAW,IAAIC,sBAAsBF;gBAE3C,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7B,IAAIG,yBAAyB;oBAAEF;oBAAUN;gBAAM;gBAGnD,OAAOM;YACX;QACJ;QAEA,OAAO,IAAIG;IACf;AACJ;AAEO,MAAMC,8CAAwBC,qBAAqB;IACtD,aAAaC;IACb,gBAAgBf;IAChB,cAAc;QAAC;YAACgB;YAAe;gBAAE,UAAU;YAAK;SAAE;QAAEC;KAAe;AACvE"}

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.d.ts

@@ -0,0 +1,11 @@
+import { Reply } from "@webiny/handler";
+import { AfterAuthenticationEventHandler } from "../../../../features/security/authentication/AuthenticationContext/index.js";
+import { AuthenticationContext } from "../../../../features/security/authentication/AuthenticationContext/index.js";
+declare class SetIdTokenCookieImpl implements AfterAuthenticationEventHandler.Interface {
+    private authenticationContext;
+    private reply;
+    constructor(authenticationContext: AuthenticationContext.Interface, reply: Reply.Interface);
+    handle(): Promise<void>;
+}
+export declare const SetIdTokenCookie: import("@webiny/di").Implementation<typeof SetIdTokenCookieImpl>;
+export {};

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.js

@@ -0,0 +1,42 @@
+import jsonwebtoken from "jsonwebtoken";
+import { createImplementation } from "@webiny/feature/api";
+import { Reply } from "@webiny/handler";
+import { AfterAuthenticationEventHandler, AuthenticationContext } from "./index.js";
+const get24HoursFromNow = ()=>{
+    const oneHour = 3600000;
+    return new Date(new Date().getTime() + 24 * oneHour);
+};
+const toDate = (timestamp)=>timestamp ? new Date(1000 * timestamp) : get24HoursFromNow();
+class SetIdTokenCookieImpl {
+    constructor(authenticationContext, reply){
+        this.authenticationContext = authenticationContext;
+        this.reply = reply;
+    }
+    async handle() {
+        const token = this.authenticationContext.getAuthToken();
+        if (!token) return;
+        const tokenData = jsonwebtoken.decode(token, {
+            json: true
+        });
+        const expiresOn = tokenData ? toDate(tokenData.exp) : get24HoursFromNow();
+        this.reply.setCookie("wby-id-token", token, {
+            path: "/",
+            expires: expiresOn,
+            sameSite: "none",
+            secure: true,
+            httpOnly: true
+        });
+        this.reply.header("cache-control", 'no-cache="Set-Cookie"');
+    }
+}
+const SetIdTokenCookie = createImplementation({
+    abstraction: AfterAuthenticationEventHandler,
+    implementation: SetIdTokenCookieImpl,
+    dependencies: [
+        AuthenticationContext,
+        Reply
+    ]
+});
+export { SetIdTokenCookie };
+
+//# sourceMappingURL=SetIdTokenCookie.js.map

package/features/security/authentication/AuthenticationContext/SetIdTokenCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/authentication/AuthenticationContext/SetIdTokenCookie.js","sources":["../../../../../src/features/security/authentication/AuthenticationContext/SetIdTokenCookie.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { createImplementation } from \"@webiny/feature/api\";\nimport { Reply } from \"@webiny/handler\";\nimport { AfterAuthenticationEventHandler } from \"~/features/security/authentication/AuthenticationContext/index.js\";\nimport { AuthenticationContext } from \"~/features/security/authentication/AuthenticationContext/index.js\";\n\nconst get24HoursFromNow = () => {\n    const oneHour = 1000 * 60 * 60;\n    return new Date(new Date().getTime() + oneHour * 24);\n};\n\nconst toDate = (timestamp: number | undefined) => {\n    return timestamp ? new Date(timestamp * 1000) : get24HoursFromNow();\n};\n\nclass SetIdTokenCookieImpl implements AfterAuthenticationEventHandler.Interface {\n    constructor(\n        private authenticationContext: AuthenticationContext.Interface,\n        private reply: Reply.Interface\n    ) {}\n\n    async handle(): Promise<void> {\n        const token = this.authenticationContext.getAuthToken();\n\n        if (!token) {\n            return;\n        }\n\n        // Attempt to acquire expiration from the token; fall back to \"expire in 24 hours\".\n        // In most cases the token will be a JWT token, but it can also be a custom token, or an API key.\n        const tokenData = jwt.decode(token, { json: true });\n        const expiresOn = tokenData ? toDate(tokenData.exp) : get24HoursFromNow();\n\n        // @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n        this.reply.setCookie(\"wby-id-token\", token, {\n            path: \"/\",\n            expires: expiresOn,\n            // Allow this cookie to be sent with cross-origin requests.\n            sameSite: \"none\",\n            // Only send this cookie to the server when HTTPS is used.\n            // NOTE: `https` requirement is ignored for `localhost.\n            secure: true,\n            // Forbids JavaScript from accessing the cookie.\n            httpOnly: true\n        });\n\n        this.reply.header(\"cache-control\", `no-cache=\"Set-Cookie\"`);\n    }\n}\n\nexport const SetIdTokenCookie = createImplementation({\n    abstraction: AfterAuthenticationEventHandler,\n    implementation: SetIdTokenCookieImpl,\n    dependencies: [AuthenticationContext, Reply]\n});\n"],"names":["get24HoursFromNow","oneHour","Date","toDate","timestamp","SetIdTokenCookieImpl","authenticationContext","reply","token","tokenData","jwt","expiresOn","SetIdTokenCookie","createImplementation","AfterAuthenticationEventHandler","AuthenticationContext","Reply"],"mappings":";;;;AAMA,MAAMA,oBAAoB;IACtB,MAAMC,UAAU;IAChB,OAAO,IAAIC,KAAK,IAAIA,OAAO,OAAO,KAAKD,AAAU,KAAVA;AAC3C;AAEA,MAAME,SAAS,CAACC,YACLA,YAAY,IAAIF,KAAKE,AAAY,OAAZA,aAAoBJ;AAGpD,MAAMK;IACF,YACYC,qBAAsD,EACtDC,KAAsB,CAChC;aAFUD,qBAAqB,GAArBA;aACAC,KAAK,GAALA;IACT;IAEH,MAAM,SAAwB;QAC1B,MAAMC,QAAQ,IAAI,CAAC,qBAAqB,CAAC,YAAY;QAErD,IAAI,CAACA,OACD;QAKJ,MAAMC,YAAYC,aAAAA,MAAU,CAACF,OAAO;YAAE,MAAM;QAAK;QACjD,MAAMG,YAAYF,YAAYN,OAAOM,UAAU,GAAG,IAAIT;QAGtD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,gBAAgBQ,OAAO;YACxC,MAAM;YACN,SAASG;YAET,UAAU;YAGV,QAAQ;YAER,UAAU;QACd;QAEA,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB;IACvC;AACJ;AAEO,MAAMC,mBAAmBC,qBAAqB;IACjD,aAAaC;IACb,gBAAgBT;IAChB,cAAc;QAACU;QAAuBC;KAAM;AAChD"}

package/features/security/authentication/AuthenticationContext/abstractions.d.ts

@@ -0,0 +1,10 @@
+import type { Identity } from "../../../../features/security/IdentityContext/Identity.js";
+export interface IAuthenticationContext {
+    authenticate(token: string): Promise<Identity>;
+    getAuthToken(): string | undefined;
+}
+/** Authenticate incoming requests and resolve the current identity. */
+export declare const AuthenticationContext: import("@webiny/di").Abstraction<IAuthenticationContext>;
+export declare namespace AuthenticationContext {
+    type Interface = IAuthenticationContext;
+}

package/features/security/authentication/AuthenticationContext/abstractions.js

@@ -0,0 +1,5 @@
+import { createAbstraction } from "@webiny/feature/api";
+const AuthenticationContext = createAbstraction("AuthenticationContext");
+export { AuthenticationContext };
+
+//# sourceMappingURL=abstractions.js.map

package/features/security/authentication/AuthenticationContext/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/authentication/AuthenticationContext/abstractions.js","sources":["../../../../../src/features/security/authentication/AuthenticationContext/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/api\";\nimport type { Identity } from \"~/features/security/IdentityContext/Identity.js\";\n\nexport interface IAuthenticationContext {\n    authenticate(token: string): Promise<Identity>;\n    getAuthToken(): string | undefined;\n}\n\n/** Authenticate incoming requests and resolve the current identity. */\nexport const AuthenticationContext =\n    createAbstraction<IAuthenticationContext>(\"AuthenticationContext\");\n\nexport namespace AuthenticationContext {\n    export type Interface = IAuthenticationContext;\n}\n"],"names":["AuthenticationContext","createAbstraction"],"mappings":";AASO,MAAMA,wBACTC,kBAA0C"}

package/features/security/authentication/AuthenticationContext/errors.d.ts

@@ -0,0 +1,64 @@
+import { BaseError } from "@webiny/feature/api";
+/**
+ * Base class for all authentication-related errors
+ */
+export declare abstract class AuthenticationError extends BaseError {
+    protected constructor(message: string);
+    static from(error: any): AuthenticationError;
+}
+/**
+ * Thrown when a JWT token has expired
+ */
+export declare class TokenExpiredError extends AuthenticationError {
+    readonly code: "Authentication/TokenExpired";
+    constructor(message?: string);
+}
+/**
+ * Thrown when a JWT token is not yet valid (nbf claim)
+ */
+export declare class TokenNotYetValidError extends AuthenticationError {
+    readonly code: "Authentication/TokenNotYetValid";
+    constructor(message?: string);
+}
+/**
+ * Thrown when a JWT token has an invalid signature
+ */
+export declare class InvalidTokenSignatureError extends AuthenticationError {
+    readonly code: "Authentication/InvalidSignature";
+    constructor(message?: string);
+}
+/**
+ * Thrown when a JWT token is malformed or invalid
+ */
+export declare class InvalidTokenError extends AuthenticationError {
+    readonly code: "Authentication/InvalidToken";
+    constructor(message?: string);
+}
+/**
+ * Thrown when the JWT audience claim doesn't match expected value
+ */
+export declare class InvalidAudienceError extends AuthenticationError {
+    readonly code: "Authentication/InvalidAudience";
+    constructor(message?: string);
+}
+/**
+ * Thrown when the JWT issuer claim doesn't match expected value
+ */
+export declare class InvalidIssuerError extends AuthenticationError {
+    readonly code: "Authentication/InvalidIssuer";
+    constructor(message?: string);
+}
+/**
+ * Thrown when a required JWT claim is missing
+ */
+export declare class MissingClaimError extends AuthenticationError {
+    readonly code: "Authentication/MissingClaim";
+    constructor(claim: string);
+}
+/**
+ * Generic authentication failure error
+ */
+export declare class AuthenticationFailedError extends AuthenticationError {
+    readonly code: "Authentication/Failed";
+    constructor(message?: string);
+}

package/features/security/authentication/AuthenticationContext/errors.js

@@ -0,0 +1,65 @@
+import { BaseError } from "@webiny/feature/api";
+class AuthenticationError extends BaseError {
+    constructor(message){
+        super({
+            message
+        });
+    }
+    static from(error) {
+        if ("TokenExpiredError" === error.name) return new TokenExpiredError(error.message);
+        if ("NotBeforeError" === error.name) return new TokenNotYetValidError(error.message);
+        if ("JsonWebTokenError" === error.name) {
+            const message = error.message.toLowerCase();
+            if (message.includes("invalid signature")) return new InvalidTokenSignatureError(error.message);
+            if (message.includes("invalid audience") || message.includes("jwt audience")) return new InvalidAudienceError(error.message);
+            if (message.includes("invalid issuer") || message.includes("jwt issuer")) return new InvalidIssuerError(error.message);
+            message.includes("jwt malformed") || message.includes("invalid token");
+            return new InvalidTokenError(error.message);
+        }
+        if (error instanceof AuthenticationError) return error;
+        return new InvalidTokenError(error.message || "Authentication failed");
+    }
+}
+class TokenExpiredError extends AuthenticationError {
+    constructor(message = "Token has expired"){
+        super(message), this.code = "Authentication/TokenExpired";
+    }
+}
+class TokenNotYetValidError extends AuthenticationError {
+    constructor(message = "Token is not yet valid"){
+        super(message), this.code = "Authentication/TokenNotYetValid";
+    }
+}
+class InvalidTokenSignatureError extends AuthenticationError {
+    constructor(message = "Invalid token signature"){
+        super(message), this.code = "Authentication/InvalidSignature";
+    }
+}
+class InvalidTokenError extends AuthenticationError {
+    constructor(message = "Invalid token"){
+        super(message), this.code = "Authentication/InvalidToken";
+    }
+}
+class InvalidAudienceError extends AuthenticationError {
+    constructor(message = "Invalid audience"){
+        super(message), this.code = "Authentication/InvalidAudience";
+    }
+}
+class InvalidIssuerError extends AuthenticationError {
+    constructor(message = "Invalid issuer"){
+        super(message), this.code = "Authentication/InvalidIssuer";
+    }
+}
+class MissingClaimError extends AuthenticationError {
+    constructor(claim){
+        super(`Missing required claim: ${claim}`), this.code = "Authentication/MissingClaim";
+    }
+}
+class AuthenticationFailedError extends AuthenticationError {
+    constructor(message = "Authentication failed"){
+        super(message), this.code = "Authentication/Failed";
+    }
+}
+export { AuthenticationError, AuthenticationFailedError, InvalidAudienceError, InvalidIssuerError, InvalidTokenError, InvalidTokenSignatureError, MissingClaimError, TokenExpiredError, TokenNotYetValidError };
+
+//# sourceMappingURL=errors.js.map

package/features/security/authentication/AuthenticationContext/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/authentication/AuthenticationContext/errors.js","sources":["../../../../../src/features/security/authentication/AuthenticationContext/errors.ts"],"sourcesContent":["import { BaseError } from \"@webiny/feature/api\";\n\n/**\n * Base class for all authentication-related errors\n */\nexport abstract class AuthenticationError extends BaseError {\n    protected constructor(message: string) {\n        super({ message });\n    }\n\n    static from(error: any): AuthenticationError {\n        // Check for specific jsonwebtoken error names\n        if (error.name === \"TokenExpiredError\") {\n            return new TokenExpiredError(error.message);\n        }\n\n        if (error.name === \"NotBeforeError\") {\n            return new TokenNotYetValidError(error.message);\n        }\n\n        if (error.name === \"JsonWebTokenError\") {\n            // Check message for specific error types\n            const message = error.message.toLowerCase();\n\n            if (message.includes(\"invalid signature\")) {\n                return new InvalidTokenSignatureError(error.message);\n            }\n\n            if (message.includes(\"invalid audience\") || message.includes(\"jwt audience\")) {\n                return new InvalidAudienceError(error.message);\n            }\n\n            if (message.includes(\"invalid issuer\") || message.includes(\"jwt issuer\")) {\n                return new InvalidIssuerError(error.message);\n            }\n\n            if (message.includes(\"jwt malformed\") || message.includes(\"invalid token\")) {\n                return new InvalidTokenError(error.message);\n            }\n\n            // Generic JsonWebTokenError\n            return new InvalidTokenError(error.message);\n        }\n\n        // If it's already one of our errors, return as-is\n        if (error instanceof AuthenticationError) {\n            return error;\n        }\n\n        // For any other error, wrap in InvalidTokenError\n        return new InvalidTokenError(error.message || \"Authentication failed\");\n    }\n}\n\n/**\n * Thrown when a JWT token has expired\n */\nexport class TokenExpiredError extends AuthenticationError {\n    override readonly code = \"Authentication/TokenExpired\" as const;\n\n    constructor(message: string = \"Token has expired\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when a JWT token is not yet valid (nbf claim)\n */\nexport class TokenNotYetValidError extends AuthenticationError {\n    override readonly code = \"Authentication/TokenNotYetValid\" as const;\n\n    constructor(message: string = \"Token is not yet valid\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when a JWT token has an invalid signature\n */\nexport class InvalidTokenSignatureError extends AuthenticationError {\n    override readonly code = \"Authentication/InvalidSignature\" as const;\n\n    constructor(message: string = \"Invalid token signature\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when a JWT token is malformed or invalid\n */\nexport class InvalidTokenError extends AuthenticationError {\n    override readonly code = \"Authentication/InvalidToken\" as const;\n\n    constructor(message: string = \"Invalid token\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when the JWT audience claim doesn't match expected value\n */\nexport class InvalidAudienceError extends AuthenticationError {\n    override readonly code = \"Authentication/InvalidAudience\" as const;\n\n    constructor(message: string = \"Invalid audience\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when the JWT issuer claim doesn't match expected value\n */\nexport class InvalidIssuerError extends AuthenticationError {\n    override readonly code = \"Authentication/InvalidIssuer\" as const;\n\n    constructor(message: string = \"Invalid issuer\") {\n        super(message);\n    }\n}\n\n/**\n * Thrown when a required JWT claim is missing\n */\nexport class MissingClaimError extends AuthenticationError {\n    override readonly code = \"Authentication/MissingClaim\" as const;\n\n    constructor(claim: string) {\n        super(`Missing required claim: ${claim}`);\n    }\n}\n\n/**\n * Generic authentication failure error\n */\nexport class AuthenticationFailedError extends AuthenticationError {\n    override readonly code = \"Authentication/Failed\" as const;\n\n    constructor(message: string = \"Authentication failed\") {\n        super(message);\n    }\n}\n"],"names":["AuthenticationError","BaseError","message","error","TokenExpiredError","TokenNotYetValidError","InvalidTokenSignatureError","InvalidAudienceError","InvalidIssuerError","InvalidTokenError","MissingClaimError","claim","AuthenticationFailedError"],"mappings":";AAKO,MAAeA,4BAA4BC;IAC9C,YAAsBC,OAAe,CAAE;QACnC,KAAK,CAAC;YAAEA;QAAQ;IACpB;IAEA,OAAO,KAAKC,KAAU,EAAuB;QAEzC,IAAIA,AAAe,wBAAfA,MAAM,IAAI,EACV,OAAO,IAAIC,kBAAkBD,MAAM,OAAO;QAG9C,IAAIA,AAAe,qBAAfA,MAAM,IAAI,EACV,OAAO,IAAIE,sBAAsBF,MAAM,OAAO;QAGlD,IAAIA,AAAe,wBAAfA,MAAM,IAAI,EAA0B;YAEpC,MAAMD,UAAUC,MAAM,OAAO,CAAC,WAAW;YAEzC,IAAID,QAAQ,QAAQ,CAAC,sBACjB,OAAO,IAAII,2BAA2BH,MAAM,OAAO;YAGvD,IAAID,QAAQ,QAAQ,CAAC,uBAAuBA,QAAQ,QAAQ,CAAC,iBACzD,OAAO,IAAIK,qBAAqBJ,MAAM,OAAO;YAGjD,IAAID,QAAQ,QAAQ,CAAC,qBAAqBA,QAAQ,QAAQ,CAAC,eACvD,OAAO,IAAIM,mBAAmBL,MAAM,OAAO;YAG3CD,QAAQ,QAAQ,CAAC,oBAAoBA,QAAQ,QAAQ,CAAC;YAK1D,OAAO,IAAIO,kBAAkBN,MAAM,OAAO;QAC9C;QAGA,IAAIA,iBAAiBH,qBACjB,OAAOG;QAIX,OAAO,IAAIM,kBAAkBN,MAAM,OAAO,IAAI;IAClD;AACJ;AAKO,MAAMC,0BAA0BJ;IAGnC,YAAYE,UAAkB,mBAAmB,CAAE;QAC/C,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMG,8BAA8BL;IAGvC,YAAYE,UAAkB,wBAAwB,CAAE;QACpD,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMI,mCAAmCN;IAG5C,YAAYE,UAAkB,yBAAyB,CAAE;QACrD,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMO,0BAA0BT;IAGnC,YAAYE,UAAkB,eAAe,CAAE;QAC3C,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMK,6BAA6BP;IAGtC,YAAYE,UAAkB,kBAAkB,CAAE;QAC9C,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMM,2BAA2BR;IAGpC,YAAYE,UAAkB,gBAAgB,CAAE;QAC5C,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMQ,0BAA0BV;IAGnC,YAAYW,KAAa,CAAE;QACvB,KAAK,CAAC,CAAC,wBAAwB,EAAEA,OAAO,QAH1B,IAAI,GAAG;IAIzB;AACJ;AAKO,MAAMC,kCAAkCZ;IAG3C,YAAYE,UAAkB,uBAAuB,CAAE;QACnD,KAAK,CAACA,UAAAA,IAAAA,CAHQ,IAAI,GAAG;IAIzB;AACJ"}