@xbg.solutions/utils-token-handler 1.0.0

package/lib/firebase-adapter.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Firebase Auth Adapter
+ * Implements ITokenAdapter for Firebase Authentication
+ */
+import * as admin from 'firebase-admin';
+import { Logger } from '@xbg/utils-logger';
+import { ITokenAdapter, NormalizedToken, CustomClaimsConfig, TokenVerificationError } from './token-types';
+export declare class FirebaseAuthAdapter<TCustomClaims = Record<string, any>> implements ITokenAdapter<TCustomClaims> {
+    /**
+     * Verify token with Firebase Auth
+     */
+    verifyToken(rawToken: string, logger: Logger): Promise<admin.auth.DecodedIdToken>;
+    /**
+     * Generate token identifier for blacklist
+     * Firebase doesn't provide jti claim, so we hash the token
+     */
+    getTokenIdentifier(rawToken: string): Promise<string>;
+    /**
+     * Normalize Firebase token to platform-agnostic structure
+     */
+    normalizeToken(providerToken: admin.auth.DecodedIdToken, customClaimsConfig: CustomClaimsConfig<TCustomClaims>): NormalizedToken<TCustomClaims>;
+    /**
+     * Sync custom claims to Firebase Auth
+     */
+    syncCustomClaims(authUID: string, claims: TCustomClaims, logger: Logger): Promise<void>;
+    /**
+     * Revoke user tokens at Firebase level
+     * Firebase supports this via revokeRefreshTokens
+     */
+    revokeUserTokens(authUID: string, logger: Logger): Promise<boolean>;
+    /**
+     * Map Firebase errors to standard error types
+     */
+    mapProviderError(error: any): TokenVerificationError;
+    /**
+     * Extract userUID from token, with fallback logic
+     * This method can be customized based on how different projects
+     * structure their custom claims
+     */
+    private extractUserUID;
+}
+/**
+ * Factory function to create Firebase adapter with type safety
+ */
+export declare function createFirebaseAuthAdapter<TCustomClaims = Record<string, any>>(): FirebaseAuthAdapter<TCustomClaims>;
+//# sourceMappingURL=firebase-adapter.d.ts.map

package/lib/firebase-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-adapter.d.ts","sourceRoot":"","sources":["../src/firebase-adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,eAAe,CAAC;AAEvB,qBAAa,mBAAmB,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAClE,YAAW,aAAa,CAAC,aAAa,CAAC;IAEvC;;OAEG;IACG,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;IAmBvF;;;OAGG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAO3D;;OAEG;IACH,cAAc,CACZ,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EACxC,kBAAkB,EAAE,kBAAkB,CAAC,aAAa,CAAC,GACpD,eAAe,CAAC,aAAa,CAAC;IAiCjC;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBzE;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,GAAG,GAAG,sBAAsB;IAqCpD;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAkBvB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAC3E,mBAAmB,CAAC,aAAa,CAAC,CAEnC"}

package/lib/firebase-adapter.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * Firebase Auth Adapter
+ * Implements ITokenAdapter for Firebase Authentication
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirebaseAuthAdapter = void 0;
+exports.createFirebaseAuthAdapter = createFirebaseAuthAdapter;
+const admin = __importStar(require("firebase-admin"));
+const crypto = __importStar(require("crypto"));
+const token_types_1 = require("./token-types");
+class FirebaseAuthAdapter {
+    /**
+     * Verify token with Firebase Auth
+     */
+    async verifyToken(rawToken, logger) {
+        logger.debug('FirebaseAuthAdapter: Verifying token with Firebase');
+        try {
+            const decodedToken = await admin.auth().verifyIdToken(rawToken, true);
+            logger.debug('FirebaseAuthAdapter: Token verified successfully', {
+                authUID: decodedToken.uid
+            });
+            return decodedToken;
+        }
+        catch (error) {
+            logger.warn('FirebaseAuthAdapter: Token verification failed', {
+                error: error.message
+            });
+            throw error;
+        }
+    }
+    /**
+     * Generate token identifier for blacklist
+     * Firebase doesn't provide jti claim, so we hash the token
+     */
+    async getTokenIdentifier(rawToken) {
+        return crypto
+            .createHash('sha256')
+            .update(rawToken)
+            .digest('hex');
+    }
+    /**
+     * Normalize Firebase token to platform-agnostic structure
+     */
+    normalizeToken(providerToken, customClaimsConfig) {
+        // Extract custom claims using provided configuration
+        let customClaims;
+        try {
+            customClaims = customClaimsConfig.extract(providerToken);
+            // Validate if validator is provided
+            if (customClaimsConfig.validate && !customClaimsConfig.validate(customClaims)) {
+                // If validation fails, use defaults
+                customClaims = customClaimsConfig.defaults;
+            }
+        }
+        catch (error) {
+            // If extraction fails, use defaults
+            customClaims = customClaimsConfig.defaults;
+        }
+        return {
+            authUID: providerToken.uid,
+            userUID: this.extractUserUID(providerToken, customClaims),
+            email: providerToken.email || null,
+            emailVerified: providerToken.email_verified || false,
+            phoneNumber: providerToken.phone_number || null,
+            issuedAt: providerToken.iat,
+            expiresAt: providerToken.exp,
+            issuer: 'firebase',
+            customClaims,
+            rawClaims: providerToken
+        };
+    }
+    /**
+     * Sync custom claims to Firebase Auth
+     */
+    async syncCustomClaims(authUID, claims, logger) {
+        logger.debug('FirebaseAuthAdapter: Syncing custom claims', {
+            authUID,
+            claimKeys: Object.keys(claims)
+        });
+        try {
+            await admin.auth().setCustomUserClaims(authUID, claims);
+            logger.info('FirebaseAuthAdapter: Custom claims synced successfully', {
+                authUID
+            });
+        }
+        catch (error) {
+            logger.error('FirebaseAuthAdapter: Failed to sync custom claims', error, {
+                authUID
+            });
+            throw error;
+        }
+    }
+    /**
+     * Revoke user tokens at Firebase level
+     * Firebase supports this via revokeRefreshTokens
+     */
+    async revokeUserTokens(authUID, logger) {
+        logger.info('FirebaseAuthAdapter: Revoking user tokens at Firebase', {
+            authUID
+        });
+        try {
+            await admin.auth().revokeRefreshTokens(authUID);
+            logger.info('FirebaseAuthAdapter: User tokens revoked successfully', {
+                authUID
+            });
+            return true;
+        }
+        catch (error) {
+            logger.error('FirebaseAuthAdapter: Failed to revoke tokens', error, {
+                authUID
+            });
+            return false;
+        }
+    }
+    /**
+     * Map Firebase errors to standard error types
+     */
+    mapProviderError(error) {
+        const errorCode = error.code || '';
+        const errorMessage = error.message || '';
+        // Firebase ID token verification errors
+        if (errorCode.includes('expired') || errorCode.includes('exp-') ||
+            errorMessage.includes('expired')) {
+            return token_types_1.TokenVerificationError.EXPIRED;
+        }
+        if (errorCode.includes('invalid') || errorCode.includes('signature') ||
+            errorMessage.includes('signature') || errorMessage.includes('invalid')) {
+            return token_types_1.TokenVerificationError.INVALID_SIGNATURE;
+        }
+        if (errorCode.includes('malformed') || errorMessage.includes('malformed') ||
+            errorMessage.includes('decode')) {
+            return token_types_1.TokenVerificationError.MALFORMED;
+        }
+        // Firebase-specific error codes
+        switch (errorCode) {
+            case 'auth/argument-error':
+            case 'auth/invalid-id-token':
+                return token_types_1.TokenVerificationError.MALFORMED;
+            case 'auth/id-token-expired':
+                return token_types_1.TokenVerificationError.EXPIRED;
+            case 'auth/id-token-revoked':
+                return token_types_1.TokenVerificationError.BLACKLISTED;
+            default:
+                return token_types_1.TokenVerificationError.UNKNOWN;
+        }
+    }
+    /**
+     * Extract userUID from token, with fallback logic
+     * This method can be customized based on how different projects
+     * structure their custom claims
+     */
+    extractUserUID(providerToken, customClaims) {
+        // Try to extract from custom claims first
+        if (customClaims && typeof customClaims === 'object' && 'userUID' in customClaims) {
+            return customClaims.userUID || null;
+        }
+        // Fallback: check if it's directly in the provider token
+        const anyToken = providerToken;
+        if (anyToken.userUID) {
+            return anyToken.userUID;
+        }
+        // No userUID found - this might be a first-time user
+        return null;
+    }
+}
+exports.FirebaseAuthAdapter = FirebaseAuthAdapter;
+/**
+ * Factory function to create Firebase adapter with type safety
+ */
+function createFirebaseAuthAdapter() {
+    return new FirebaseAuthAdapter();
+}
+//# sourceMappingURL=firebase-adapter.js.map

package/lib/firebase-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase-adapter.js","sourceRoot":"","sources":["../src/firebase-adapter.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+MH,8DAGC;AAhND,sDAAwC;AACxC,+CAAiC;AAEjC,+CAKuB;AAEvB,MAAa,mBAAmB;IAG9B;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,MAAc;QAChD,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEtE,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;gBAC/D,OAAO,EAAE,YAAY,CAAC,GAAG;aAC1B,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE;gBAC5D,KAAK,EAAE,KAAK,CAAC,OAAO;aACrB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,cAAc,CACZ,aAAwC,EACxC,kBAAqD;QAErD,qDAAqD;QACrD,IAAI,YAA2B,CAAC;QAChC,IAAI,CAAC;YACH,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAEzD,oCAAoC;YACpC,IAAI,kBAAkB,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9E,oCAAoC;gBACpC,YAAY,GAAG,kBAAkB,CAAC,QAAyB,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oCAAoC;YACpC,YAAY,GAAG,kBAAkB,CAAC,QAAyB,CAAC;QAC9D,CAAC;QAED,OAAO;YACL,OAAO,EAAE,aAAa,CAAC,GAAG;YAC1B,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC;YAEzD,KAAK,EAAE,aAAa,CAAC,KAAK,IAAI,IAAI;YAClC,aAAa,EAAE,aAAa,CAAC,cAAc,IAAI,KAAK;YACpD,WAAW,EAAE,aAAa,CAAC,YAAY,IAAI,IAAI;YAE/C,QAAQ,EAAE,aAAa,CAAC,GAAG;YAC3B,SAAS,EAAE,aAAa,CAAC,GAAG;YAC5B,MAAM,EAAE,UAAU;YAElB,YAAY;YACZ,SAAS,EAAE,aAAa;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,MAAqB,EACrB,MAAc;QAEd,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;YACzD,OAAO;YACP,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAA6B,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAA6B,CAAC,CAAC;YAE/E,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE;gBACpE,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,mDAAmD,EAAE,KAAK,EAAE;gBACvE,OAAO;aACR,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,MAAc;QACpD,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACnE,OAAO;SACR,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAEhD,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACnE,OAAO;aACR,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,EAAE;gBAClE,OAAO;aACR,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAU;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QAEzC,wCAAwC;QACxC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3D,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,oCAAsB,CAAC,OAAO,CAAC;QACxC,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChE,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,OAAO,oCAAsB,CAAC,iBAAiB,CAAC;QAClD,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YACrE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,oCAAsB,CAAC,SAAS,CAAC;QAC1C,CAAC;QAED,gCAAgC;QAChC,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,qBAAqB,CAAC;YAC3B,KAAK,uBAAuB;gBAC1B,OAAO,oCAAsB,CAAC,SAAS,CAAC;YAE1C,KAAK,uBAAuB;gBAC1B,OAAO,oCAAsB,CAAC,OAAO,CAAC;YAExC,KAAK,uBAAuB;gBAC1B,OAAO,oCAAsB,CAAC,WAAW,CAAC;YAE5C;gBACE,OAAO,oCAAsB,CAAC,OAAO,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,cAAc,CACpB,aAAwC,EACxC,YAA2B;QAE3B,0CAA0C;QAC1C,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAClF,OAAQ,YAAoB,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,aAAoB,CAAC;QACtC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC,OAAO,CAAC;QAC1B,CAAC;QAED,qDAAqD;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA9LD,kDA8LC;AAED;;GAEG;AACH,SAAgB,yBAAyB;IAEvC,OAAO,IAAI,mBAAmB,EAAiB,CAAC;AAClD,CAAC"}

package/lib/firestore-database-adapter.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Firestore Database Adapter
+ * Implements ITokenDatabase for Firestore operations
+ */
+import * as admin from 'firebase-admin';
+import { Firestore } from 'firebase-admin/firestore';
+import { ITokenDatabase, TokenBlacklistEntry } from './token-types';
+export declare class FirestoreTokenDatabase implements ITokenDatabase {
+    private db;
+    private collectionName;
+    private collection;
+    constructor(db: Firestore, collectionName: string);
+    /**
+     * Add entry to blacklist
+     */
+    addBlacklistEntry(entry: TokenBlacklistEntry): Promise<void>;
+    /**
+     * Check if token identifier is blacklisted
+     */
+    isTokenBlacklisted(tokenIdentifier: string): Promise<boolean>;
+    /**
+     * Get user's global token revocation timestamp
+     */
+    getUserRevocationTime(authUID: string): Promise<Date | null>;
+    /**
+     * Add global revocation entry for user
+     */
+    addUserRevocation(authUID: string, reason: string, blacklistedBy: string | null, expiresAt: Date): Promise<void>;
+    /**
+     * Remove expired blacklist entries
+     */
+    cleanupExpiredEntries(): Promise<number>;
+    /**
+     * Get collection reference for advanced operations
+     */
+    getCollection(): admin.firestore.CollectionReference;
+    /**
+     * Health check - verify database connectivity
+     */
+    healthCheck(): Promise<boolean>;
+}
+/**
+ * Factory function to create Firestore database adapter
+ */
+export declare function createFirestoreTokenDatabase(db: Firestore, collectionName: string): FirestoreTokenDatabase;
+//# sourceMappingURL=firestore-database-adapter.d.ts.map

package/lib/firestore-database-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-database-adapter.d.ts","sourceRoot":"","sources":["../src/firestore-database-adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EACL,cAAc,EACd,mBAAmB,EACpB,MAAM,eAAe,CAAC;AAEvB,qBAAa,sBAAuB,YAAW,cAAc;IAIzD,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,cAAc;IAJxB,OAAO,CAAC,UAAU,CAAsC;gBAG9C,EAAE,EAAE,SAAS,EACb,cAAc,EAAE,MAAM;IAKhC;;OAEG;IACG,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IASlE;;OAEG;IACG,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASnE;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAyBlE;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,IAAI,CAAC;IAchB;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAoB9C;;OAEG;IACH,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC,mBAAmB;IAIpD;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;CAStC;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,SAAS,EACb,cAAc,EAAE,MAAM,GACrB,sBAAsB,CAExB"}

package/lib/firestore-database-adapter.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Firestore Database Adapter
+ * Implements ITokenDatabase for Firestore operations
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FirestoreTokenDatabase = void 0;
+exports.createFirestoreTokenDatabase = createFirestoreTokenDatabase;
+class FirestoreTokenDatabase {
+    constructor(db, collectionName) {
+        this.db = db;
+        this.collectionName = collectionName;
+        this.collection = this.db.collection(this.collectionName);
+    }
+    /**
+     * Add entry to blacklist
+     */
+    async addBlacklistEntry(entry) {
+        await this.collection.doc(entry.blacklistEntryUID).set(Object.assign(Object.assign({}, entry), { 
+            // Ensure dates are Firestore timestamps
+            blacklistedAt: entry.blacklistedAt, expiresAt: entry.expiresAt }));
+    }
+    /**
+     * Check if token identifier is blacklisted
+     */
+    async isTokenBlacklisted(tokenIdentifier) {
+        const snapshot = await this.collection
+            .where('tokenJTI', '==', tokenIdentifier)
+            .limit(1)
+            .get();
+        return !snapshot.empty;
+    }
+    /**
+     * Get user's global token revocation timestamp
+     */
+    async getUserRevocationTime(authUID) {
+        const snapshot = await this.collection
+            .where('tokenJTI', '==', `ALL_TOKENS_${authUID}`)
+            .orderBy('blacklistedAt', 'desc')
+            .limit(1)
+            .get();
+        if (snapshot.empty) {
+            return null;
+        }
+        const entry = snapshot.docs[0].data();
+        // Handle both Firestore Timestamp and Date objects
+        const blacklistedAt = entry.blacklistedAt;
+        if (blacklistedAt instanceof Date) {
+            return blacklistedAt;
+        }
+        else if (blacklistedAt && typeof blacklistedAt === 'object' && 'toDate' in blacklistedAt) {
+            // Firestore Timestamp
+            return blacklistedAt.toDate();
+        }
+        return null;
+    }
+    /**
+     * Add global revocation entry for user
+     */
+    async addUserRevocation(authUID, reason, blacklistedBy, expiresAt) {
+        const entry = {
+            blacklistEntryUID: `revocation_${authUID}_${Date.now()}`,
+            tokenJTI: `ALL_TOKENS_${authUID}`,
+            authUID,
+            blacklistedAt: new Date(),
+            blacklistedBy,
+            reason,
+            expiresAt
+        };
+        await this.addBlacklistEntry(entry);
+    }
+    /**
+     * Remove expired blacklist entries
+     */
+    async cleanupExpiredEntries() {
+        const now = new Date();
+        const snapshot = await this.collection
+            .where('expiresAt', '<=', now)
+            .get();
+        if (snapshot.empty) {
+            return 0;
+        }
+        // Batch delete for efficiency
+        const batch = this.db.batch();
+        snapshot.docs.forEach((doc) => {
+            batch.delete(doc.ref);
+        });
+        await batch.commit();
+        return snapshot.size;
+    }
+    /**
+     * Get collection reference for advanced operations
+     */
+    getCollection() {
+        return this.collection;
+    }
+    /**
+     * Health check - verify database connectivity
+     */
+    async healthCheck() {
+        try {
+            // Simple read operation to test connectivity
+            await this.collection.limit(1).get();
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+}
+exports.FirestoreTokenDatabase = FirestoreTokenDatabase;
+/**
+ * Factory function to create Firestore database adapter
+ */
+function createFirestoreTokenDatabase(db, collectionName) {
+    return new FirestoreTokenDatabase(db, collectionName);
+}
+//# sourceMappingURL=firestore-database-adapter.js.map

package/lib/firestore-database-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firestore-database-adapter.js","sourceRoot":"","sources":["../src/firestore-database-adapter.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AA4IH,oEAKC;AAxID,MAAa,sBAAsB;IAGjC,YACU,EAAa,EACb,cAAsB;QADtB,OAAE,GAAF,EAAE,CAAW;QACb,mBAAc,GAAd,cAAc,CAAQ;QAE9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAA0B;QAChD,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,iCACjD,KAAK;YACR,wCAAwC;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa,EAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAC1B,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,eAAuB;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU;aACnC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,EAAE,CAAC;QAET,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,OAAe;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU;aACnC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,OAAO,EAAE,CAAC;aAChD,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;aAChC,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,EAAE,CAAC;QAET,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAyB,CAAC;QAE7D,mDAAmD;QACnD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QAC1C,IAAI,aAAa,YAAY,IAAI,EAAE,CAAC;YAClC,OAAO,aAAa,CAAC;QACvB,CAAC;aAAM,IAAI,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC3F,sBAAsB;YACtB,OAAQ,aAAqB,CAAC,MAAM,EAAE,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,MAAc,EACd,aAA4B,EAC5B,SAAe;QAEf,MAAM,KAAK,GAAwB;YACjC,iBAAiB,EAAE,cAAc,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YACxD,QAAQ,EAAE,cAAc,OAAO,EAAE;YACjC,OAAO;YACP,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,aAAa;YACb,MAAM;YACN,SAAS;SACV,CAAC;QAEF,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU;aACnC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC;aAC7B,GAAG,EAAE,CAAC;QAET,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,8BAA8B;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,EAAE;YACjC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,6CAA6C;YAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AA9HD,wDA8HC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAC1C,EAAa,EACb,cAAsB;IAEtB,OAAO,IAAI,sBAAsB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AACxD,CAAC"}

package/lib/generic-token-handler.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Generic Token Handler
+ * Platform-agnostic token handling with configurable auth providers
+ */
+import { Logger } from '@xbg/utils-logger';
+import { ITokenHandler, ITokenAdapter, TokenVerificationResult, TokenBlacklistEntry, TokenHandlerConfig } from './token-types';
+export declare class TokenHandler<TCustomClaims = Record<string, any>> implements ITokenHandler<TCustomClaims> {
+    private config;
+    private adapter;
+    private blacklistManager;
+    constructor(config: TokenHandlerConfig<TCustomClaims>, adapter: ITokenAdapter<TCustomClaims>);
+    /**
+     * Verify and unpack raw token string
+     * Returns normalized token if valid, or error details if invalid
+     */
+    verifyAndUnpack(rawToken: string, logger: Logger): Promise<TokenVerificationResult<TCustomClaims>>;
+    /**
+     * Generate token identifier for blacklist lookup
+     */
+    getTokenIdentifier(rawToken: string): Promise<string>;
+    /**
+     * Sync custom claims to auth provider
+     */
+    syncCustomClaims(authUID: string, claims: TCustomClaims, logger: Logger): Promise<void>;
+    /**
+     * Revoke all tokens for a user at provider level
+     */
+    revokeUserTokens(authUID: string, logger: Logger): Promise<boolean>;
+    /**
+     * Blacklist individual token
+     */
+    blacklistToken(tokenIdentifier: string, authUID: string, reason: string, tokenExpiresAt: Date, blacklistedBy: string | null, logger: Logger): Promise<TokenBlacklistEntry>;
+    /**
+     * Blacklist all tokens for a user (global revocation)
+     */
+    blacklistAllUserTokens(authUID: string, reason: string, blacklistedBy: string | null, logger: Logger): Promise<void>;
+    /**
+     * Check if token is blacklisted
+     */
+    isTokenBlacklisted(tokenIdentifier: string, logger: Logger): Promise<boolean>;
+    /**
+     * Get user's token revocation timestamp
+     */
+    getUserTokenRevocationTime(authUID: string, logger: Logger): Promise<Date | null>;
+    /**
+     * Cleanup expired blacklist entries
+     */
+    cleanupExpiredEntries(logger: Logger): Promise<number>;
+    /**
+     * Get token handler configuration
+     */
+    getConfig(): TokenHandlerConfig<TCustomClaims>;
+    /**
+     * Extract authUID from provider token
+     * Different providers may structure this differently
+     */
+    private extractAuthUID;
+    /**
+     * Extract issued-at timestamp from provider token
+     * Different providers may structure this differently
+     */
+    private extractIssuedAt;
+}
+/**
+ * Factory function to create token handler with type safety
+ */
+export declare function createTokenHandler<TCustomClaims = Record<string, any>>(config: TokenHandlerConfig<TCustomClaims>, adapter: ITokenAdapter<TCustomClaims>): TokenHandler<TCustomClaims>;
+//# sourceMappingURL=generic-token-handler.d.ts.map

package/lib/generic-token-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-token-handler.d.ts","sourceRoot":"","sources":["../src/generic-token-handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EACL,aAAa,EACb,aAAa,EACb,uBAAuB,EAEvB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,eAAe,CAAC;AAGvB,qBAAa,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAC3D,YAAW,aAAa,CAAC,aAAa,CAAC;IAKrC,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IAJjB,OAAO,CAAC,gBAAgB,CAAwB;gBAGtC,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC,EACzC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC;IAQ/C;;;OAGG;IACG,eAAe,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IA8FlD;;OAEG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D;;OAEG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAShB;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE;;OAEG;IACG,cAAc,CAClB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,IAAI,EACpB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC;IAW/B;;OAEG;IACG,sBAAsB,CAC1B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC;IAShB;;OAEG;IACG,kBAAkB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAInF;;OAEG;IACG,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAIvF;;OAEG;IACG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI5D;;OAEG;IACH,SAAS,IAAI,kBAAkB,CAAC,aAAa,CAAC;IAI9C;;;OAGG;IACH,OAAO,CAAC,cAAc;IAKtB;;;OAGG;IACH,OAAO,CAAC,eAAe;CAGxB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACpE,MAAM,EAAE,kBAAkB,CAAC,aAAa,CAAC,EACzC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,GACpC,YAAY,CAAC,aAAa,CAAC,CAE7B"}