actor-gate 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (155) hide show
  1. package/package.json +25 -0
  2. package/src/config/base-config.d.ts +17 -0
  3. package/src/config/base-config.js +33 -0
  4. package/src/config/index.d.ts +5 -0
  5. package/src/config/index.js +5 -0
  6. package/src/config/nextjs-public-config.d.ts +46 -0
  7. package/src/config/nextjs-public-config.js +89 -0
  8. package/src/config/nextjs-server-config.d.ts +32 -0
  9. package/src/config/nextjs-server-config.js +10 -0
  10. package/src/config/react-client.d.ts +23 -0
  11. package/src/config/react-client.js +69 -0
  12. package/src/config/react-config.d.ts +18 -0
  13. package/src/config/react-config.js +38 -0
  14. package/src/core/adapters/access-token-revocation-adapter.d.ts +8 -0
  15. package/src/core/adapters/access-token-revocation-adapter.js +1 -0
  16. package/src/core/adapters/access-token-transport-adapter.d.ts +15 -0
  17. package/src/core/adapters/access-token-transport-adapter.js +1 -0
  18. package/src/core/adapters/authorization-code-adapter.d.ts +21 -0
  19. package/src/core/adapters/authorization-code-adapter.js +1 -0
  20. package/src/core/adapters/authorization-hooks.d.ts +13 -0
  21. package/src/core/adapters/authorization-hooks.js +1 -0
  22. package/src/core/adapters/index.d.ts +14 -0
  23. package/src/core/adapters/index.js +1 -0
  24. package/src/core/adapters/login-method-adapter.d.ts +7 -0
  25. package/src/core/adapters/login-method-adapter.js +1 -0
  26. package/src/core/adapters/oauth-client-adapter.d.ts +13 -0
  27. package/src/core/adapters/oauth-client-adapter.js +1 -0
  28. package/src/core/adapters/oauth-client-management-adapter.d.ts +23 -0
  29. package/src/core/adapters/oauth-client-management-adapter.js +1 -0
  30. package/src/core/adapters/oauth-grant-type.d.ts +1 -0
  31. package/src/core/adapters/oauth-grant-type.js +1 -0
  32. package/src/core/adapters/oauth-policy.d.ts +9 -0
  33. package/src/core/adapters/oauth-policy.js +1 -0
  34. package/src/core/adapters/observability-hooks.d.ts +31 -0
  35. package/src/core/adapters/observability-hooks.js +1 -0
  36. package/src/core/adapters/pending-auth-request-adapter.d.ts +18 -0
  37. package/src/core/adapters/pending-auth-request-adapter.js +1 -0
  38. package/src/core/adapters/refresh-token-adapter.d.ts +24 -0
  39. package/src/core/adapters/refresh-token-adapter.js +1 -0
  40. package/src/core/adapters/session-adapter.d.ts +14 -0
  41. package/src/core/adapters/session-adapter.js +1 -0
  42. package/src/core/adapters/token-adapter.d.ts +15 -0
  43. package/src/core/adapters/token-adapter.js +1 -0
  44. package/src/core/http/bearer-challenge.d.ts +6 -0
  45. package/src/core/http/bearer-challenge.js +16 -0
  46. package/src/core/ids/id-codec.d.ts +6 -0
  47. package/src/core/ids/id-codec.js +30 -0
  48. package/src/core/index.d.ts +9 -0
  49. package/src/core/index.js +7 -0
  50. package/src/core/oauth/pkce.d.ts +9 -0
  51. package/src/core/oauth/pkce.js +30 -0
  52. package/src/core/services/access-token-service.d.ts +42 -0
  53. package/src/core/services/access-token-service.js +304 -0
  54. package/src/core/services/auth-error.d.ts +14 -0
  55. package/src/core/services/auth-error.js +47 -0
  56. package/src/core/services/contracts.d.ts +23 -0
  57. package/src/core/services/contracts.js +1 -0
  58. package/src/core/services/direct-auth-service.d.ts +50 -0
  59. package/src/core/services/direct-auth-service.js +267 -0
  60. package/src/core/services/index.d.ts +7 -0
  61. package/src/core/services/index.js +5 -0
  62. package/src/core/services/mcp-auth-service.d.ts +39 -0
  63. package/src/core/services/mcp-auth-service.js +170 -0
  64. package/src/core/services/oauth-service.d.ts +91 -0
  65. package/src/core/services/oauth-service.js +571 -0
  66. package/src/core/services/observability.d.ts +22 -0
  67. package/src/core/services/observability.js +71 -0
  68. package/src/core/services/revocation-policy.d.ts +21 -0
  69. package/src/core/services/revocation-policy.js +51 -0
  70. package/src/core/sessions/client-session.d.ts +7 -0
  71. package/src/core/sessions/client-session.js +18 -0
  72. package/src/core/tokens/access-claims.d.ts +21 -0
  73. package/src/core/tokens/access-claims.js +128 -0
  74. package/src/core/tokens/id-claims.d.ts +20 -0
  75. package/src/core/tokens/id-claims.js +25 -0
  76. package/src/core/types/auth-contract.d.ts +33 -0
  77. package/src/core/types/auth-contract.js +1 -0
  78. package/src/express/index.d.ts +1 -0
  79. package/src/express/index.js +1 -0
  80. package/src/express/protected-route.d.ts +44 -0
  81. package/src/express/protected-route.js +119 -0
  82. package/src/index.d.ts +8 -0
  83. package/src/index.js +8 -0
  84. package/src/mcp/index.d.ts +1 -0
  85. package/src/mcp/index.js +1 -0
  86. package/src/mcp/json-rpc-auth.d.ts +5 -0
  87. package/src/mcp/json-rpc-auth.js +41 -0
  88. package/src/next/app/catch-all.d.ts +32 -0
  89. package/src/next/app/catch-all.js +82 -0
  90. package/src/next/app/cookies.d.ts +22 -0
  91. package/src/next/app/cookies.js +36 -0
  92. package/src/next/app/direct-auth-handlers.d.ts +55 -0
  93. package/src/next/app/direct-auth-handlers.js +419 -0
  94. package/src/next/app/index.d.ts +8 -0
  95. package/src/next/app/index.js +8 -0
  96. package/src/next/app/mcp-oauth-handlers.d.ts +74 -0
  97. package/src/next/app/mcp-oauth-handlers.js +365 -0
  98. package/src/next/app/protected-route.d.ts +27 -0
  99. package/src/next/app/protected-route.js +59 -0
  100. package/src/next/app/request.d.ts +12 -0
  101. package/src/next/app/request.js +30 -0
  102. package/src/next/app/response.d.ts +16 -0
  103. package/src/next/app/response.js +48 -0
  104. package/src/next/app/wrapper.d.ts +28 -0
  105. package/src/next/app/wrapper.js +78 -0
  106. package/src/next/index.d.ts +6 -0
  107. package/src/next/index.js +5 -0
  108. package/src/next/pages/catch-all.d.ts +19 -0
  109. package/src/next/pages/catch-all.js +60 -0
  110. package/src/next/pages/cookies.d.ts +41 -0
  111. package/src/next/pages/cookies.js +87 -0
  112. package/src/next/pages/direct-auth-handlers.d.ts +58 -0
  113. package/src/next/pages/direct-auth-handlers.js +425 -0
  114. package/src/next/pages/index.d.ts +8 -0
  115. package/src/next/pages/index.js +8 -0
  116. package/src/next/pages/mcp-oauth-handlers.d.ts +77 -0
  117. package/src/next/pages/mcp-oauth-handlers.js +341 -0
  118. package/src/next/pages/protected-route.d.ts +28 -0
  119. package/src/next/pages/protected-route.js +59 -0
  120. package/src/next/pages/request.d.ts +14 -0
  121. package/src/next/pages/request.js +66 -0
  122. package/src/next/pages/response.d.ts +28 -0
  123. package/src/next/pages/response.js +29 -0
  124. package/src/next/pages/wrapper.d.ts +29 -0
  125. package/src/next/pages/wrapper.js +74 -0
  126. package/src/next/rewrites.d.ts +12 -0
  127. package/src/next/rewrites.js +74 -0
  128. package/src/next/shared/auth-http.d.ts +24 -0
  129. package/src/next/shared/auth-http.js +42 -0
  130. package/src/next/shared/auth-routes.d.ts +17 -0
  131. package/src/next/shared/auth-routes.js +153 -0
  132. package/src/next/shared/direct-auth-utils.d.ts +71 -0
  133. package/src/next/shared/direct-auth-utils.js +275 -0
  134. package/src/next/shared/oauth-utils.d.ts +45 -0
  135. package/src/next/shared/oauth-utils.js +308 -0
  136. package/src/next/shared/well-known-utils.d.ts +46 -0
  137. package/src/next/shared/well-known-utils.js +108 -0
  138. package/src/testing/in-memory/in-memory-access-token-revocation-adapter.d.ts +2 -0
  139. package/src/testing/in-memory/in-memory-access-token-revocation-adapter.js +14 -0
  140. package/src/testing/in-memory/in-memory-authorization-code-adapter.d.ts +2 -0
  141. package/src/testing/in-memory/in-memory-authorization-code-adapter.js +36 -0
  142. package/src/testing/in-memory/in-memory-oauth-client-adapter.d.ts +14 -0
  143. package/src/testing/in-memory/in-memory-oauth-client-adapter.js +26 -0
  144. package/src/testing/in-memory/in-memory-pending-auth-request-adapter.d.ts +2 -0
  145. package/src/testing/in-memory/in-memory-pending-auth-request-adapter.js +43 -0
  146. package/src/testing/in-memory/in-memory-refresh-token-adapter.d.ts +2 -0
  147. package/src/testing/in-memory/in-memory-refresh-token-adapter.js +67 -0
  148. package/src/testing/in-memory/in-memory-session-adapter.d.ts +6 -0
  149. package/src/testing/in-memory/in-memory-session-adapter.js +43 -0
  150. package/src/testing/in-memory/index.d.ts +7 -0
  151. package/src/testing/in-memory/index.js +7 -0
  152. package/src/testing/in-memory/test-fixtures.d.ts +5 -0
  153. package/src/testing/in-memory/test-fixtures.js +18 -0
  154. package/src/testing/index.d.ts +2 -0
  155. package/src/testing/index.js +4 -0
@@ -0,0 +1,67 @@
1
+ export function createInMemoryRefreshTokenAdapter() {
2
+ const records = new Map();
3
+ return {
4
+ async create(input) {
5
+ records.set(input.tokenHash, {
6
+ sessionId: input.sessionId,
7
+ tokenHash: input.tokenHash,
8
+ expiresAtUnix: input.expiresAtUnix,
9
+ familyId: input.familyId,
10
+ ...(input.parentTokenHash === undefined
11
+ ? {}
12
+ : { parentTokenHash: input.parentTokenHash }),
13
+ });
14
+ },
15
+ async find(tokenHash) {
16
+ const record = records.get(tokenHash);
17
+ if (!record) {
18
+ return null;
19
+ }
20
+ return {
21
+ sessionId: record.sessionId,
22
+ familyId: record.familyId,
23
+ expiresAtUnix: record.expiresAtUnix,
24
+ ...(record.revokedAtUnix === undefined
25
+ ? {}
26
+ : { revokedAtUnix: record.revokedAtUnix }),
27
+ };
28
+ },
29
+ async consume(tokenHash, nowUnix) {
30
+ const record = records.get(tokenHash);
31
+ if (!record) {
32
+ return null;
33
+ }
34
+ if (record.consumedAtUnix === undefined ||
35
+ record.consumedAtUnix === null) {
36
+ record.consumedAtUnix = nowUnix;
37
+ records.set(tokenHash, record);
38
+ }
39
+ return {
40
+ sessionId: record.sessionId,
41
+ familyId: record.familyId,
42
+ expiresAtUnix: record.expiresAtUnix,
43
+ consumedAtUnix: record.consumedAtUnix,
44
+ ...(record.revokedAtUnix === undefined
45
+ ? {}
46
+ : { revokedAtUnix: record.revokedAtUnix }),
47
+ };
48
+ },
49
+ async revoke(tokenHash, nowUnix) {
50
+ const record = records.get(tokenHash);
51
+ if (!record) {
52
+ return;
53
+ }
54
+ record.revokedAtUnix = nowUnix;
55
+ records.set(tokenHash, record);
56
+ },
57
+ async revokeFamily(familyId, nowUnix) {
58
+ for (const [tokenHash, record] of records.entries()) {
59
+ if (record.familyId !== familyId) {
60
+ continue;
61
+ }
62
+ record.revokedAtUnix = nowUnix;
63
+ records.set(tokenHash, record);
64
+ }
65
+ },
66
+ };
67
+ }
@@ -0,0 +1,6 @@
1
+ import type { SessionAdapter } from '../../core/adapters/session-adapter';
2
+ import type { AuthActor } from '../../core/types/auth-contract';
3
+ export declare function createInMemorySessionAdapter<TSessionId, TUserId, TActor extends AuthActor, TServerSessionData extends Record<string, unknown> = Record<string, never>>(options: {
4
+ createSessionId: () => TSessionId;
5
+ nowUnix?: () => number;
6
+ }): SessionAdapter<TSessionId, TUserId, TActor, TServerSessionData>;
@@ -0,0 +1,43 @@
1
+ export function createInMemorySessionAdapter(options) {
2
+ const records = new Map();
3
+ const nowUnix = options.nowUnix ?? (() => Math.floor(Date.now() / 1000));
4
+ const cloneRecord = (record) => ({
5
+ ...record,
6
+ ...(record.serverSessionData === undefined
7
+ ? {}
8
+ : { serverSessionData: structuredClone(record.serverSessionData) }),
9
+ });
10
+ return {
11
+ async create(input) {
12
+ if (!Number.isSafeInteger(input.ttlSeconds) || input.ttlSeconds <= 0) {
13
+ throw new Error('ttlSeconds must be a positive safe integer.');
14
+ }
15
+ const issuedAtUnix = nowUnix();
16
+ const sessionRecord = {
17
+ sessionId: options.createSessionId(),
18
+ userId: input.userId,
19
+ actor: input.actor,
20
+ ...(input.clientId === undefined ? {} : { clientId: input.clientId }),
21
+ issuedAt: issuedAtUnix,
22
+ expiresAt: issuedAtUnix + input.ttlSeconds,
23
+ ...(input.serverSessionData === undefined
24
+ ? {}
25
+ : { serverSessionData: structuredClone(input.serverSessionData) }),
26
+ };
27
+ records.set(sessionRecord.sessionId, sessionRecord);
28
+ return cloneRecord(sessionRecord);
29
+ },
30
+ async findById(sessionId) {
31
+ const record = records.get(sessionId);
32
+ return record ? cloneRecord(record) : null;
33
+ },
34
+ async revoke(sessionId, revokeUnix) {
35
+ const record = records.get(sessionId);
36
+ if (!record) {
37
+ return;
38
+ }
39
+ record.revokedAt = revokeUnix;
40
+ records.set(sessionId, record);
41
+ },
42
+ };
43
+ }
@@ -0,0 +1,7 @@
1
+ export { createInMemoryAccessTokenRevocationAdapter } from './in-memory-access-token-revocation-adapter';
2
+ export { createInMemoryAuthorizationCodeAdapter } from './in-memory-authorization-code-adapter';
3
+ export { createInMemoryOAuthClientAdapter, type InMemoryOAuthClient, } from './in-memory-oauth-client-adapter';
4
+ export { createInMemoryPendingAuthRequestAdapter } from './in-memory-pending-auth-request-adapter';
5
+ export { createInMemoryRefreshTokenAdapter } from './in-memory-refresh-token-adapter';
6
+ export { createInMemorySessionAdapter } from './in-memory-session-adapter';
7
+ export { createIncrementingIdFactory, createStepClock } from './test-fixtures';
@@ -0,0 +1,7 @@
1
+ export { createInMemoryAccessTokenRevocationAdapter } from './in-memory-access-token-revocation-adapter';
2
+ export { createInMemoryAuthorizationCodeAdapter } from './in-memory-authorization-code-adapter';
3
+ export { createInMemoryOAuthClientAdapter, } from './in-memory-oauth-client-adapter';
4
+ export { createInMemoryPendingAuthRequestAdapter } from './in-memory-pending-auth-request-adapter';
5
+ export { createInMemoryRefreshTokenAdapter } from './in-memory-refresh-token-adapter';
6
+ export { createInMemorySessionAdapter } from './in-memory-session-adapter';
7
+ export { createIncrementingIdFactory, createStepClock } from './test-fixtures';
@@ -0,0 +1,5 @@
1
+ export declare function createStepClock(initialUnix: number): {
2
+ nowUnix: () => number;
3
+ tick: (seconds?: number) => number;
4
+ };
5
+ export declare function createIncrementingIdFactory(initialValue?: number): () => number;
@@ -0,0 +1,18 @@
1
+ export function createStepClock(initialUnix) {
2
+ let currentUnix = initialUnix;
3
+ return {
4
+ nowUnix: () => currentUnix,
5
+ tick: (seconds = 1) => {
6
+ currentUnix += seconds;
7
+ return currentUnix;
8
+ },
9
+ };
10
+ }
11
+ export function createIncrementingIdFactory(initialValue = 1) {
12
+ let current = initialValue;
13
+ return () => {
14
+ const next = current;
15
+ current += 1;
16
+ return next;
17
+ };
18
+ }
@@ -0,0 +1,2 @@
1
+ export declare function createFixedUnixNow(unix: number): () => number;
2
+ export * from './in-memory/index';
@@ -0,0 +1,4 @@
1
+ export function createFixedUnixNow(unix) {
2
+ return () => unix;
3
+ }
4
+ export * from './in-memory/index';