@xemahq/xema-npm-auth-plugin 0.1.2

package/dist/plugin.d.ts

@@ -0,0 +1,26 @@
+import { JwtVerifier } from './jwks';
+import { type PluginLogger } from './logger';
+import { type PackageAccessContext, type RemoteUser, type VerdaccioCallback, type XemaAuthPluginConfig } from './types';
+interface VerdaccioStuff {
+    logger?: unknown;
+    config?: unknown;
+}
+export interface XemaNpmAuthPlugin {
+    authenticate(user: string, password: string, cb: VerdaccioCallback): void;
+    allow_access(user: RemoteUser, pkg: PackageAccessContext, cb: VerdaccioCallback): void;
+    allow_publish(user: RemoteUser, pkg: PackageAccessContext, cb: VerdaccioCallback): void;
+}
+export interface BuildPluginDeps {
+    env?: NodeJS.ProcessEnv;
+    verifier?: JwtVerifier;
+    logger?: PluginLogger;
+}
+export declare function buildPlugin(config: XemaAuthPluginConfig, deps?: BuildPluginDeps): XemaNpmAuthPlugin;
+declare function pluginFactory(config: XemaAuthPluginConfig, stuff?: VerdaccioStuff): XemaNpmAuthPlugin;
+export default pluginFactory;
+export { pluginFactory };
+export { buildPlugin as __buildBiomeForTests };
+export { JwtVerifier } from './jwks';
+export * from './types';
+export { classifyPackage, evaluateAcl, packageTierToVisibility } from './acl';
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAClB,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAE1B,MAAM,SAAS,CAAC;AAKjB,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,CACV,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,iBAAiB,GACpB,IAAI,CAAC;IACR,YAAY,CACV,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,oBAAoB,EACzB,EAAE,EAAE,iBAAiB,GACpB,IAAI,CAAC;IACR,aAAa,CACX,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,oBAAoB,EACzB,EAAE,EAAE,iBAAiB,GACpB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAE9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAExB,QAAQ,CAAC,EAAE,WAAW,CAAC;IAEvB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAMD,wBAAgB,WAAW,CACzB,MAAM,EAAE,oBAAoB,EAC5B,IAAI,GAAE,eAAoB,GACzB,iBAAiB,CAgInB;AA2ED,iBAAS,aAAa,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,GAAE,cAAmB,GAAG,iBAAiB,CAGlG;AAID,eAAe,aAAa,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,CAAC;AAEzB,OAAO,EAAE,WAAW,IAAI,oBAAoB,EAAE,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC"}

package/dist/plugin.js

@@ -0,0 +1,197 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageTierToVisibility = exports.evaluateAcl = exports.classifyPackage = exports.JwtVerifier = void 0;
+exports.buildPlugin = buildPlugin;
+exports.__buildBiomeForTests = buildPlugin;
+exports.pluginFactory = pluginFactory;
+const acl_1 = require("./acl");
+const jwks_1 = require("./jwks");
+const logger_1 = require("./logger");
+const types_1 = require("./types");
+const ANONYMOUS_USERNAME = '$anonymous';
+const AUTHENTICATED_GROUP = '$authenticated';
+function buildPlugin(config, deps = {}) {
+    const env = deps.env ?? process.env;
+    const logger = deps.logger ?? (0, logger_1.adaptVerdaccioLogger)(undefined);
+    const verifier = deps.verifier ??
+        new jwks_1.JwtVerifier({
+            jwksUrl: requireEnv(config.keycloakRealmUrl ?? env.KEYCLOAK_REALM_URL, 'KEYCLOAK_REALM_URL'),
+            ...(config.expectedIssuer !== undefined
+                ? { expectedIssuer: config.expectedIssuer }
+                : env.KEYCLOAK_EXPECTED_ISSUER !== undefined
+                    ? { expectedIssuer: env.KEYCLOAK_EXPECTED_ISSUER }
+                    : {}),
+            ...(config.jwksRefreshMs !== undefined
+                ? { refreshMs: config.jwksRefreshMs }
+                : {}),
+            logger,
+        });
+    return {
+        authenticate(user, password, cb) {
+            const cid = (0, logger_1.newCorrelationId)();
+            if (!password) {
+                logger.debug('authenticate skipped (empty password = anonymous read)', {
+                    cid,
+                    user,
+                });
+                cb(null, false);
+                return;
+            }
+            void verifier
+                .verify(password)
+                .then((claims) => {
+                logger.info('authenticate ok', {
+                    cid,
+                    sub: claims.sub,
+                    orgId: claims.x_org_id,
+                    role: claims.x_role,
+                });
+                cb(null, [
+                    AUTHENTICATED_GROUP,
+                    `xema:role:${claims.x_role}`,
+                    `xema:org:${claims.x_org_id}`,
+                    `xema:sub:${claims.sub}`,
+                ]);
+            })
+                .catch((err) => {
+                logger.warn('authenticate denied', {
+                    cid,
+                    user,
+                    error: err.message,
+                });
+                cb(null, false);
+            });
+        },
+        allow_access(remoteUser, pkg, cb) {
+            const cid = (0, logger_1.newCorrelationId)();
+            const claims = claimsFromRemoteUser(remoteUser);
+            const decision = (0, acl_1.evaluateAcl)({
+                packageName: pkg.name,
+                action: 'access',
+                claims,
+            });
+            if (decision.allow) {
+                logger.debug('allow_access ok', {
+                    cid,
+                    pkg: pkg.name,
+                    orgId: claims?.x_org_id,
+                    role: claims?.x_role,
+                });
+                cb(null, true);
+                return;
+            }
+            logger.warn('allow_access denied', {
+                cid,
+                pkg: pkg.name,
+                reason: decision.reason,
+                message: decision.message,
+                orgId: claims?.x_org_id,
+                role: claims?.x_role,
+            });
+            cb(buildDenyError(decision.reason, decision.message), false);
+        },
+        allow_publish(remoteUser, pkg, cb) {
+            const cid = (0, logger_1.newCorrelationId)();
+            const claims = claimsFromRemoteUser(remoteUser);
+            const decision = (0, acl_1.evaluateAcl)({
+                packageName: pkg.name,
+                action: 'publish',
+                claims,
+            });
+            if (decision.allow) {
+                logger.info('allow_publish ok', {
+                    cid,
+                    pkg: pkg.name,
+                    orgId: claims?.x_org_id,
+                    role: claims?.x_role,
+                    sub: claims?.sub,
+                });
+                cb(null, true);
+                return;
+            }
+            logger.warn('allow_publish denied', {
+                cid,
+                pkg: pkg.name,
+                reason: decision.reason,
+                message: decision.message,
+                orgId: claims?.x_org_id,
+                role: claims?.x_role,
+            });
+            cb(buildDenyError(decision.reason, decision.message), false);
+        },
+    };
+}
+function requireEnv(value, name) {
+    if (!value) {
+        throw new Error(`[xema-jwt] required env "${name}" is missing — plugin refuses to start (constitutional rule: no silent fallback to "auth disabled")`);
+    }
+    return value;
+}
+function claimsFromRemoteUser(remoteUser) {
+    const groups = remoteUser.real_groups ?? remoteUser.groups ?? [];
+    if (!groups.includes(AUTHENTICATED_GROUP)) {
+        return undefined;
+    }
+    let role;
+    let orgId;
+    let sub;
+    for (const g of groups) {
+        if (g.startsWith('xema:role:')) {
+            const candidate = g.slice('xema:role:'.length);
+            if (candidate === types_1.XemaRegistryRole.Platform ||
+                candidate === types_1.XemaRegistryRole.OrgAdmin ||
+                candidate === types_1.XemaRegistryRole.OrgMember ||
+                candidate === types_1.XemaRegistryRole.Anonymous) {
+                role = candidate;
+            }
+        }
+        else if (g.startsWith('xema:org:')) {
+            orgId = g.slice('xema:org:'.length);
+        }
+        else if (g.startsWith('xema:sub:')) {
+            sub = g.slice('xema:sub:'.length);
+        }
+    }
+    if (!role || !orgId || !sub) {
+        return undefined;
+    }
+    return {
+        sub,
+        exp: Number.MAX_SAFE_INTEGER,
+        x_org_id: orgId,
+        x_role: role,
+    };
+}
+function buildDenyError(reason, message) {
+    const err = new Error(message);
+    err.code = 'XEMA_ACL_DENIED';
+    err.reason = reason;
+    return err;
+}
+function pluginFactory(config, stuff = {}) {
+    const logger = (0, logger_1.adaptVerdaccioLogger)(stuff.logger);
+    return buildPlugin(config, { logger });
+}
+exports.default = pluginFactory;
+var jwks_2 = require("./jwks");
+Object.defineProperty(exports, "JwtVerifier", { enumerable: true, get: function () { return jwks_2.JwtVerifier; } });
+__exportStar(require("./types"), exports);
+var acl_2 = require("./acl");
+Object.defineProperty(exports, "classifyPackage", { enumerable: true, get: function () { return acl_2.classifyPackage; } });
+Object.defineProperty(exports, "evaluateAcl", { enumerable: true, get: function () { return acl_2.evaluateAcl; } });
+Object.defineProperty(exports, "packageTierToVisibility", { enumerable: true, get: function () { return acl_2.packageTierToVisibility; } });
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA0EA,kCAmIC;AAqFuB,2CAAoB;AAFnC,sCAAa;AA9QtB,+BAAoC;AACpC,iCAAqC;AACrC,qCAIkB;AAClB,mCAQiB;AAEjB,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAsC7C,SAAgB,WAAW,CACzB,MAA4B,EAC5B,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAA,6BAAoB,EAAC,SAAS,CAAC,CAAC;IAE9D,MAAM,QAAQ,GACZ,IAAI,CAAC,QAAQ;QACb,IAAI,kBAAW,CAAC;YACd,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;gBAC3C,CAAC,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,wBAAwB,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE;gBACrC,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;SACP,CAAC,CAAC;IAEL,OAAO;QACL,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAA,yBAAgB,GAAE,CAAC;YAK/B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE;oBACrE,GAAG;oBACH,IAAI;iBACL,CAAC,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,KAAK,QAAQ;iBACV,MAAM,CAAC,QAAQ,CAAC;iBAChB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;oBAC7B,GAAG;oBACH,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,KAAK,EAAE,MAAM,CAAC,QAAQ;oBACtB,IAAI,EAAE,MAAM,CAAC,MAAM;iBACpB,CAAC,CAAC;gBAIH,EAAE,CAAC,IAAI,EAAE;oBACP,mBAAmB;oBACnB,aAAa,MAAM,CAAC,MAAM,EAAE;oBAC5B,YAAY,MAAM,CAAC,QAAQ,EAAE;oBAC7B,YAAY,MAAM,CAAC,GAAG,EAAE;iBACzB,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;gBACpB,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;oBACjC,GAAG;oBACH,IAAI;oBACJ,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;gBAGH,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,YAAY,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,GAAG,GAAG,IAAA,yBAAgB,GAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAA,iBAAW,EAAC;gBAC3B,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,MAAM,EAAE,QAAQ;gBAChB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE;oBAC9B,GAAG;oBACH,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,KAAK,EAAE,MAAM,EAAE,QAAQ;oBACvB,IAAI,EAAE,MAAM,EAAE,MAAM;iBACrB,CAAC,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACjC,GAAG;gBACH,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,MAAM,EAAE,QAAQ;gBACvB,IAAI,EAAE,MAAM,EAAE,MAAM;aACrB,CAAC,CAAC;YAIH,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QAED,aAAa,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;YAC/B,MAAM,GAAG,GAAG,IAAA,yBAAgB,GAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,IAAA,iBAAW,EAAC;gBAC3B,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,MAAM,EAAE,SAAS;gBACjB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;oBAC9B,GAAG;oBACH,GAAG,EAAE,GAAG,CAAC,IAAI;oBACb,KAAK,EAAE,MAAM,EAAE,QAAQ;oBACvB,IAAI,EAAE,MAAM,EAAE,MAAM;oBACpB,GAAG,EAAE,MAAM,EAAE,GAAG;iBACjB,CAAC,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACf,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBAClC,GAAG;gBACH,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,MAAM,EAAE,QAAQ;gBACvB,IAAI,EAAE,MAAM,EAAE,MAAM;aACrB,CAAC,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB,EAAE,IAAY;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,qGAAqG,CACtI,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,SAAS,oBAAoB,CAAC,UAAsB;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAkC,CAAC;IACvC,IAAI,KAAyB,CAAC;IAC9B,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,IACE,SAAS,KAAK,wBAAgB,CAAC,QAAQ;gBACvC,SAAS,KAAK,wBAAgB,CAAC,QAAQ;gBACvC,SAAS,KAAK,wBAAgB,CAAC,SAAS;gBACxC,SAAS,KAAK,wBAAgB,CAAC,SAAS,EACxC,CAAC;gBACD,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAI5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAID,OAAO;QACL,GAAG;QACH,GAAG,EAAE,MAAM,CAAC,gBAAgB;QAC5B,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAqB,EAAE,OAAe;IAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAG9B,GAAyD,CAAC,IAAI,GAAG,iBAAiB,CAAC;IACnF,GAAyD,CAAC,MAAM,GAAG,MAAM,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,SAAS,aAAa,CAAC,MAA4B,EAAE,QAAwB,EAAE;IAC7E,MAAM,MAAM,GAAG,IAAA,6BAAoB,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAID,kBAAe,aAAa,CAAC;AAK7B,+BAAqC;AAA5B,mGAAA,WAAW,OAAA;AACpB,0CAAwB;AACxB,6BAA8E;AAArE,sGAAA,eAAe,OAAA;AAAE,kGAAA,WAAW,OAAA;AAAE,8GAAA,uBAAuB,OAAA"}

package/dist/types.d.ts

@@ -0,0 +1,57 @@
+export declare enum XemaRegistryRole {
+    Platform = "platform",
+    OrgAdmin = "org_admin",
+    OrgMember = "org_member",
+    Anonymous = "anonymous"
+}
+export interface XemaJwtClaims {
+    sub: string;
+    exp: number;
+    iat?: number;
+    x_org_id: string;
+    x_role: XemaRegistryRole;
+}
+export type AclDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: AclDenyReason;
+    message: string;
+};
+export declare enum AclDenyReason {
+    MissingJwt = "missing_jwt",
+    InvalidJwt = "invalid_jwt",
+    ExpiredJwt = "expired_jwt",
+    WrongRoleForSystem = "wrong_role_for_system",
+    WrongRoleForSystemShareablePublish = "wrong_role_for_system_shareable_publish",
+    AnonymousOrgRead = "anonymous_org_read",
+    CrossOrgAccess = "cross_org_access",
+    UnknownPackagePattern = "unknown_package_pattern"
+}
+export declare enum PackageTier {
+    System = "system",
+    SystemShareable = "system_shareable",
+    Org = "org",
+    Uplink = "uplink"
+}
+export interface ClassifiedPackage {
+    tier: PackageTier;
+    orgScope: string | null;
+    raw: string;
+}
+export interface PackageAccessContext {
+    name: string;
+}
+export interface RemoteUser {
+    name?: string | null;
+    groups?: string[];
+    real_groups?: string[];
+    error?: string;
+}
+export interface XemaAuthPluginConfig {
+    keycloakRealmUrl?: string;
+    expectedIssuer?: string;
+    jwksRefreshMs?: number;
+}
+export type VerdaccioCallback = (err: Error | null, result?: string[] | boolean) => void;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAqBA,oBAAY,gBAAgB;IAC1B,QAAQ,aAAa;IACrB,QAAQ,cAAc;IACtB,SAAS,eAAe;IACxB,SAAS,cAAc;CACxB;AAGD,MAAM,WAAW,aAAa;IAE5B,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,EAAE,MAAM,CAAC;IAEZ,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAOD,MAAM,MAAM,WAAW,GACnB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GACf;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7D,oBAAY,aAAa;IACvB,UAAU,gBAAgB;IAC1B,UAAU,gBAAgB;IAC1B,UAAU,gBAAgB;IAC1B,kBAAkB,0BAA0B;IAC5C,kCAAkC,4CAA4C;IAC9E,gBAAgB,uBAAuB;IACvC,cAAc,qBAAqB;IACnC,qBAAqB,4BAA4B;CAClD;AAGD,oBAAY,WAAW;IACrB,MAAM,WAAW;IACjB,eAAe,qBAAqB;IACpC,GAAG,QAAQ;IAEX,MAAM,WAAW;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,WAAW,CAAC;IAElB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,GAAG,EAAE,MAAM,CAAC;CACb;AAGD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAGD,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,MAAM,WAAW,oBAAoB;IAKnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAGD,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,KAAK,GAAG,IAAI,EACjB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,KACxB,IAAI,CAAC"}

package/dist/types.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageTier = exports.AclDenyReason = exports.XemaRegistryRole = void 0;
+var XemaRegistryRole;
+(function (XemaRegistryRole) {
+    XemaRegistryRole["Platform"] = "platform";
+    XemaRegistryRole["OrgAdmin"] = "org_admin";
+    XemaRegistryRole["OrgMember"] = "org_member";
+    XemaRegistryRole["Anonymous"] = "anonymous";
+})(XemaRegistryRole || (exports.XemaRegistryRole = XemaRegistryRole = {}));
+var AclDenyReason;
+(function (AclDenyReason) {
+    AclDenyReason["MissingJwt"] = "missing_jwt";
+    AclDenyReason["InvalidJwt"] = "invalid_jwt";
+    AclDenyReason["ExpiredJwt"] = "expired_jwt";
+    AclDenyReason["WrongRoleForSystem"] = "wrong_role_for_system";
+    AclDenyReason["WrongRoleForSystemShareablePublish"] = "wrong_role_for_system_shareable_publish";
+    AclDenyReason["AnonymousOrgRead"] = "anonymous_org_read";
+    AclDenyReason["CrossOrgAccess"] = "cross_org_access";
+    AclDenyReason["UnknownPackagePattern"] = "unknown_package_pattern";
+})(AclDenyReason || (exports.AclDenyReason = AclDenyReason = {}));
+var PackageTier;
+(function (PackageTier) {
+    PackageTier["System"] = "system";
+    PackageTier["SystemShareable"] = "system_shareable";
+    PackageTier["Org"] = "org";
+    PackageTier["Uplink"] = "uplink";
+})(PackageTier || (exports.PackageTier = PackageTier = {}));
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAqBA,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,yCAAqB,CAAA;IACrB,0CAAsB,CAAA;IACtB,4CAAwB,CAAA;IACxB,2CAAuB,CAAA;AACzB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAyBD,IAAY,aASX;AATD,WAAY,aAAa;IACvB,2CAA0B,CAAA;IAC1B,2CAA0B,CAAA;IAC1B,2CAA0B,CAAA;IAC1B,6DAA4C,CAAA;IAC5C,+FAA8E,CAAA;IAC9E,wDAAuC,CAAA;IACvC,oDAAmC,CAAA;IACnC,kEAAiD,CAAA;AACnD,CAAC,EATW,aAAa,6BAAb,aAAa,QASxB;AAGD,IAAY,WAMX;AAND,WAAY,WAAW;IACrB,gCAAiB,CAAA;IACjB,mDAAoC,CAAA;IACpC,0BAAW,CAAA;IAEX,gCAAiB,CAAA;AACnB,CAAC,EANW,WAAW,2BAAX,WAAW,QAMtB"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@xemahq/xema-npm-auth-plugin",
+  "version": "0.1.2",
+  "description": "Verdaccio auth plugin: validates Keycloak JWTs and enforces Xema's four-tier RegistryVisibilityTier ACL (System / SystemShareable / Org / External) on every authenticate/allow_access/allow_publish call.",
+  "main": "dist/plugin.cjs",
+  "types": "dist/plugin.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com",
+    "access": "restricted"
+  },
+  "dependencies": {
+    "@xemahq/kernel-contracts": "^0.2.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^30.0.0",
+    "@types/node": "25.2.3",
+    "esbuild": "^0.25.4",
+    "jest": "^30.3.0",
+    "ts-jest": "^29.4.9",
+    "typescript": "5.9.3"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "build": "tsc -p tsconfig.json && node ./scripts/bundle.mjs",
+    "bundle": "node ./scripts/bundle.mjs",
+    "test": "jest --config jest.config.ts"
+  }
+}