authmi 1.0.0 → 1.1.0

package/dist/client-DmZsG2xs.d.ts

@@ -0,0 +1,406 @@
+interface AuthMiConfig {
+    /** Base URL of the AuthMi API — e.g. "https://api.authmi.dev" */
+    baseUrl: string;
+    /** Service API Key for admin/M2M operations (k-xxx.ak-yyy) */
+    apiKey?: string;
+    /** Service ID (svc-xxx) — required for token introspection */
+    serviceId?: string;
+    /** Client ID for Basic auth — alternative to apiKey for service-level auth */
+    clientId?: string;
+    /** Client Secret for Basic auth */
+    clientSecret?: string;
+    /** Default token expiration in hours (default: 24) */
+    defaultTokenExpiry?: number;
+}
+type ConfigProvider = AuthMiConfig | (() => AuthMiConfig);
+
+/**
+ * Abstract token persistence layer.
+ *
+ * Implementations can be synchronous or async — the client awaits the result
+ * so both forms work transparently.
+ */
+interface TokenStorage {
+    getToken(): string | null | Promise<string | null>;
+    setToken(token: string): void | Promise<void>;
+    removeToken(): void | Promise<void>;
+}
+
+declare class IntrospectCache {
+    private store;
+    private defaultTtlMs;
+    constructor(ttlMs?: number);
+    /** Build a cache key from the token (simple hash) */
+    private key;
+    get(token: string): IntrospectResponse | undefined;
+    set(token: string, result: IntrospectResponse, ttlMs?: number): void;
+    invalidate(token: string): void;
+    clear(): void;
+}
+
+declare class AuthMiError extends Error {
+    code: string;
+    statusCode?: number | undefined;
+    constructor(message: string, code: string, statusCode?: number | undefined);
+}
+declare class ScopeError extends AuthMiError {
+    requiredScopes: string[];
+    providedScopes: string[];
+    constructor(message: string, requiredScopes: string[], providedScopes: string[]);
+}
+
+interface ClientOptions {
+    storage?: TokenStorage;
+    cache?: IntrospectCache | false;
+}
+interface SignupCredentials {
+    email: string;
+    password: string;
+    name?: string;
+    client_id: string;
+}
+interface LoginCredentials {
+    email: string;
+    password: string;
+    expiresInHours?: number;
+    scopes?: string[];
+}
+interface AuthToken {
+    accessToken: string;
+    tokenType: "Bearer";
+    expiresIn: number;
+    expiresAt: string;
+    userId: string;
+    email: string;
+    emailVerified?: boolean;
+    scopes?: string[];
+}
+interface ForgotPasswordRequest {
+    email: string;
+}
+interface ResetPasswordRequest {
+    token: string;
+    newPassword: string;
+}
+interface VerifyEmailRequest {
+    token: string;
+}
+interface ResendVerificationRequest {
+    email: string;
+}
+type OAuthProvider = "google" | "github";
+interface OAuthInitiateResponse {
+    url: string;
+}
+interface OAuthCallbackResult {
+    token: string;
+    userId: string;
+    email: string;
+}
+interface SamlInitiateRequest {
+    email: string;
+    redirectUri?: string;
+}
+interface SamlConnection {
+    id: string;
+    serviceId: string;
+    label: string;
+    idpEntityId: string;
+    idpSsoUrl: string;
+    createdAt: string;
+}
+interface CreateSamlConnectionRequest {
+    serviceId: string;
+    label: string;
+    idpEntityId: string;
+    idpSsoUrl: string;
+    idpCertificate: string;
+    attributeMapping?: string;
+}
+interface Setup2FAResult {
+    secret: string;
+    qr_uri: string;
+}
+interface Enable2FAResult {
+    backup_codes: string[];
+}
+interface Challenge2FARequest {
+    challenge_token: string;
+    code?: string;
+    backup_code?: string;
+}
+interface BackupCodesResult {
+    backup_codes: string[];
+}
+interface User {
+    userId: string;
+    email: string;
+    name?: string;
+    createdAt: string;
+}
+interface CreateUserRequest {
+    email: string;
+    password: string;
+    name?: string;
+    userId?: string;
+    scopes?: string[];
+}
+interface Role {
+    roleId: string;
+    name: string;
+    description?: string;
+    createdAt: string;
+}
+interface CreateRoleRequest {
+    name: string;
+    description?: string;
+    permissions?: string[];
+}
+interface ApiKey {
+    keyId: string;
+    name: string;
+    scope: string;
+    scopes?: string[];
+    keyType: string;
+    tpsLimit: number;
+    revoked: boolean;
+    createdAt: string;
+}
+interface CreateApiKeyRequest {
+    name: string;
+    userId?: string;
+    scope?: string;
+    scopes?: string[];
+    keyType?: string;
+    tpsLimit?: number;
+}
+interface CreateApiKeyResponse {
+    keyId: string;
+    apiKey: string;
+    name: string;
+    scope: string;
+    scopes: string[];
+}
+interface Scope {
+    scopeId: string;
+    name: string;
+    key: string;
+    description?: string;
+    createdAt: string;
+}
+interface CreateScopeRequest {
+    name: string;
+    key: string;
+    description?: string;
+}
+interface IntrospectRequest {
+    serviceId: string;
+    token?: string;
+    apiKey?: string;
+    requiredScopes?: string[];
+}
+interface IntrospectResponse {
+    valid: boolean;
+    type?: "bearer" | "api_key";
+    userId?: string;
+    email?: string;
+    scopes?: string[];
+    keyId?: string;
+    error?: string;
+    required?: string[];
+    provided?: string[];
+}
+interface ValidationResult {
+    valid: boolean;
+    type?: "token" | "api_key";
+    serviceId?: string;
+    scope?: "admin" | "service" | "user";
+    scopes?: string[];
+    userId?: string;
+    email?: string;
+    keyId?: string;
+    error?: string;
+}
+interface Webhook {
+    webhookId: string;
+    url: string;
+    events: string[];
+    active: boolean;
+    createdAt: string;
+}
+interface RegisterWebhookRequest {
+    url: string;
+    events: string[];
+    secret?: string;
+}
+interface Plan {
+    planId: string;
+    name: string;
+    stripePriceId: string;
+    description: string;
+    monthlyPrice: number;
+    features: string[];
+}
+interface Subscription {
+    subscriptionId: string;
+    planId: string;
+    status: string;
+    currentPeriodEnd: string;
+    stripeSubscriptionId?: string;
+}
+interface CheckoutResponse {
+    url: string;
+    sessionId: string;
+}
+interface PortalResponse {
+    url: string;
+}
+interface ServiceDetail {
+    serviceId: string;
+    serviceName: string;
+    ownerEmail: string;
+    createdAt: string;
+    userCount: number;
+    apiKeyCount: number;
+    webhookCount: number;
+    twoFactorPolicy?: "disabled" | "optional" | "required";
+    allowSignup?: boolean;
+}
+interface UpdateServiceRequest {
+    serviceName?: string;
+    allowedCallbackUrls?: string[];
+    allowedLogoutUrls?: string[];
+    allowedOrigins?: string[];
+    twoFactorPolicy?: "disabled" | "optional" | "required";
+    allowSignup?: boolean;
+}
+interface AuditLog {
+    id: string;
+    action: string;
+    actorId: string;
+    actorEmail?: string;
+    resourceType: string;
+    resourceId: string;
+    metadata?: Record<string, unknown>;
+    createdAt: string;
+}
+interface AuditLogQuery {
+    limit?: number;
+    offset?: number;
+    actorId?: string;
+    action?: string;
+    resourceType?: string;
+    startDate?: string;
+    endDate?: string;
+}
+interface JwksResponse {
+    keys: JsonWebKey[];
+}
+
+interface OnboardRequest {
+    serviceName: string;
+    ownerEmail: string;
+}
+interface OnboardResponse {
+    serviceId: string;
+    serviceName: string;
+    ownerEmail: string;
+    adminKeyId: string;
+    serviceAdminApiKey: string;
+    createdAt: string;
+}
+declare class AuthMiClient {
+    private configProvider;
+    private storage;
+    private cache;
+    constructor(config: ConfigProvider, options?: ClientOptions);
+    /** Resolve current config (supports lazy evaluation) */
+    private get config();
+    private request;
+    configure(config: Partial<AuthMiConfig>): void;
+    getConfig(): Omit<AuthMiConfig, "apiKey" | "clientSecret">;
+    getAccessToken(): Promise<string | null>;
+    setAccessToken(token: string): void;
+    clearAccessToken(): void;
+    isLoggedIn(): Promise<boolean>;
+    signup(credentials: SignupCredentials): Promise<AuthToken>;
+    login(credentials: LoginCredentials): Promise<AuthToken>;
+    logout(): Promise<void>;
+    refreshToken(): Promise<AuthToken>;
+    getMe(): Promise<User>;
+    forgotPassword(request: ForgotPasswordRequest): Promise<{
+        message: string;
+    }>;
+    resetPassword(request: ResetPasswordRequest): Promise<{
+        message: string;
+    }>;
+    verifyEmail(request: VerifyEmailRequest): Promise<{
+        message: string;
+    }>;
+    resendVerification(request: ResendVerificationRequest): Promise<{
+        message: string;
+    }>;
+    deactivateAccount(password: string): Promise<void>;
+    private mapAuthToken;
+    initiateOAuth(provider: OAuthProvider, redirectUri: string): Promise<string>;
+    handleOAuthCallback(url: string | URL): OAuthCallbackResult | null;
+    isOAuthCallback(url: string | URL): boolean;
+    initiateSaml(request: SamlInitiateRequest): Promise<{
+        url: string;
+        relayState?: string;
+    }>;
+    parseSamlMetadata(xml: string): Promise<{
+        idpEntityId: string;
+        idpSsoUrl: string;
+        idpCertificate: string;
+    }>;
+    listSamlConnections(): Promise<SamlConnection[]>;
+    createSamlConnection(request: CreateSamlConnectionRequest): Promise<SamlConnection>;
+    deleteSamlConnection(id: string): Promise<void>;
+    setup2fa(): Promise<Setup2FAResult>;
+    enable2fa(code: string): Promise<Enable2FAResult>;
+    disable2fa(password: string): Promise<void>;
+    regenerateBackupCodes(): Promise<BackupCodesResult>;
+    challenge2fa(request: Challenge2FARequest): Promise<AuthToken>;
+    createUser(request: CreateUserRequest): Promise<User>;
+    listUsers(): Promise<User[]>;
+    getUser(userId: string): Promise<User>;
+    deleteUser(userId: string): Promise<void>;
+    deleteUserById(userId: string): Promise<void>;
+    updatePassword(userId: string, oldPassword: string, newPassword: string): Promise<void>;
+    createRole(request: CreateRoleRequest): Promise<Role>;
+    listRoles(): Promise<Role[]>;
+    deleteRole(roleId: string): Promise<void>;
+    assignRole(userId: string, roleId: string): Promise<void>;
+    unassignRole(userId: string, roleId: string): Promise<void>;
+    getUserRoles(userId: string): Promise<Role[]>;
+    listApiKeys(): Promise<ApiKey[]>;
+    createApiKey(request: CreateApiKeyRequest): Promise<CreateApiKeyResponse>;
+    revokeApiKey(keyId: string): Promise<void>;
+    listScopes(): Promise<Scope[]>;
+    createScope(request: CreateScopeRequest): Promise<Scope>;
+    deleteScope(scopeId: string): Promise<void>;
+    introspect(request: IntrospectRequest): Promise<IntrospectResponse>;
+    validate(): Promise<ValidationResult>;
+    validateWithScopes(requiredScopes?: string[]): Promise<ValidationResult>;
+    requireScopes(...requiredScopes: string[]): Promise<ValidationResult>;
+    withScope<T>(scopes: string[], fn: () => Promise<T>): Promise<T>;
+    listWebhooks(): Promise<Webhook[]>;
+    registerWebhook(request: RegisterWebhookRequest): Promise<Webhook>;
+    deleteWebhook(webhookId: string): Promise<void>;
+    listPlans(): Promise<Plan[]>;
+    getSubscription(): Promise<Subscription>;
+    createCheckout(priceId: string): Promise<CheckoutResponse>;
+    createPortalSession(): Promise<PortalResponse>;
+    getAuditLogs(query?: AuditLogQuery): Promise<AuditLog[]>;
+    getService(serviceId: string): Promise<ServiceDetail>;
+    updateService(serviceId: string, data: UpdateServiceRequest): Promise<ServiceDetail>;
+    rotateClientSecret(serviceId: string): Promise<{
+        clientSecret: string;
+    }>;
+    getJwks(serviceId: string): Promise<JwksResponse>;
+    onboardService(request: OnboardRequest, masterAdminKey: string): Promise<OnboardResponse>;
+    deleteService(serviceId: string, masterAdminKey: string): Promise<void>;
+}
+
+export { type ApiKey as A, type BackupCodesResult as B, type Challenge2FARequest as C, type ServiceDetail as D, type Enable2FAResult as E, type ForgotPasswordRequest as F, type Setup2FAResult as G, type SignupCredentials as H, IntrospectCache as I, type JwksResponse as J, type Subscription as K, type LoginCredentials as L, type User as M, type VerifyEmailRequest as N, type OAuthCallbackResult as O, type Plan as P, type RegisterWebhookRequest as R, type SamlConnection as S, type TokenStorage as T, type UpdateServiceRequest as U, type ValidationResult as V, type Webhook as W, type AuditLog as a, type AuditLogQuery as b, AuthMiClient as c, type AuthMiConfig as d, AuthMiError as e, type AuthToken as f, type CheckoutResponse as g, type ClientOptions as h, type ConfigProvider as i, type CreateApiKeyRequest as j, type CreateApiKeyResponse as k, type CreateRoleRequest as l, type CreateSamlConnectionRequest as m, type CreateScopeRequest as n, type CreateUserRequest as o, type IntrospectRequest as p, type IntrospectResponse as q, type OAuthInitiateResponse as r, type OAuthProvider as s, type PortalResponse as t, type ResendVerificationRequest as u, type ResetPasswordRequest as v, type Role as w, type SamlInitiateRequest as x, type Scope as y, ScopeError as z };

package/dist/index.d.mts

@@ -1,31 +1,56 @@
-export { A as ApiKey, a as AuthMiClient, b as AuthMiConfig, c as AuthMiError, d as AuthToken, C as CreateApiKeyRequest, e as CreateApiKeyResponse, f as CreateScopeRequest, g as CreateUserRequest, I as IntrospectRequest, h as IntrospectResponse, L as LocalStorageTokenStorage, i as LoginCredentials, M as MemoryTokenStorage, O as OAuthCallbackResult, j as OAuthInitiateResponse, k as OAuthProvider, l as OnboardRequest, m as OnboardResponse, R as RegisterWebhookRequest, S as Scope, n as ScopeError, o as Service, T as TokenStorage, U as User, p as UserListResponse, V as ValidationResult, W as Webhook } from './client-D6JiIhlU.mjs';
+import { T as TokenStorage } from './client-DmZsG2xs.mjs';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.mjs';
+
+declare class LocalStorageTokenStorage implements TokenStorage {
+    private canAccess;
+    getToken(): string | null;
+    setToken(token: string): void;
+    removeToken(): void;
+}
+
+interface CookieOptions {
+    /** Cookie name (default: "authmi_token") */
+    name?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    domain?: string;
+    path?: string;
+    maxAge?: number;
+}
+declare class CookieTokenStorage implements TokenStorage {
+    private cookieStr;
+    private options;
+    /**
+     * @param cookieStr  The raw `Cookie` header value (server-side) or `document.cookie` (browser).
+     *                   Pass an empty string in environments where cookies are managed via Set-Cookie.
+     */
+    constructor(cookieStr?: string, options?: CookieOptions);
+    /** Update the raw cookie string (e.g. per-request in server middleware) */
+    setCookieString(cookieStr: string): void;
+    /** Escape special regex characters in a string */
+    private static escapeRegex;
+    getToken(): string | null;
+    private lastSetCookie;
+    setToken(token: string): void;
+    /** The last Set-Cookie header generated by setToken() or removeToken() */
+    getSetCookieHeader(): string | undefined;
+    removeToken(): void;
+}
+
+declare class MemoryTokenStorage implements TokenStorage {
+    private token;
+    getToken(): string | null;
+    setToken(token: string): void;
+    removeToken(): void;
+}
 
 /**
  * Auth Mi Client
  *
  * Official client library for Auth Mi - Multi-tenant authentication-as-a-service
- *
- * @example
- * ```typescript
- * import { AuthMiClient } from "authmi";
- *
- * const client = new AuthMiClient({
- *   baseUrl: "https://authmi.dev",
- *   serviceId: "svc-xxx",
- *   apiKey: "ak-xxx",
- * });
- *
- * // Login
- * const token = await client.login({
- *   email: "user@example.com",
- *   password: "password123",
- * });
- *
- * // Validate token
- * const isValid = await client.validate();
- * ```
  */
 
-declare const VERSION = "1.0.0";
+declare const VERSION = "1.1.0";
 
-export { VERSION };
+export { type CookieOptions, CookieTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenStorage, VERSION };

package/dist/index.d.ts

@@ -1,31 +1,56 @@
-export { A as ApiKey, a as AuthMiClient, b as AuthMiConfig, c as AuthMiError, d as AuthToken, C as CreateApiKeyRequest, e as CreateApiKeyResponse, f as CreateScopeRequest, g as CreateUserRequest, I as IntrospectRequest, h as IntrospectResponse, L as LocalStorageTokenStorage, i as LoginCredentials, M as MemoryTokenStorage, O as OAuthCallbackResult, j as OAuthInitiateResponse, k as OAuthProvider, l as OnboardRequest, m as OnboardResponse, R as RegisterWebhookRequest, S as Scope, n as ScopeError, o as Service, T as TokenStorage, U as User, p as UserListResponse, V as ValidationResult, W as Webhook } from './client-D6JiIhlU.js';
+import { T as TokenStorage } from './client-DmZsG2xs.js';
+export { A as ApiKey, a as AuditLog, b as AuditLogQuery, c as AuthMiClient, d as AuthMiConfig, e as AuthMiError, f as AuthToken, B as BackupCodesResult, C as Challenge2FARequest, g as CheckoutResponse, h as ClientOptions, i as ConfigProvider, j as CreateApiKeyRequest, k as CreateApiKeyResponse, l as CreateRoleRequest, m as CreateSamlConnectionRequest, n as CreateScopeRequest, o as CreateUserRequest, E as Enable2FAResult, F as ForgotPasswordRequest, I as IntrospectCache, p as IntrospectRequest, q as IntrospectResponse, J as JwksResponse, L as LoginCredentials, O as OAuthCallbackResult, r as OAuthInitiateResponse, s as OAuthProvider, P as Plan, t as PortalResponse, R as RegisterWebhookRequest, u as ResendVerificationRequest, v as ResetPasswordRequest, w as Role, S as SamlConnection, x as SamlInitiateRequest, y as Scope, z as ScopeError, D as ServiceDetail, G as Setup2FAResult, H as SignupCredentials, K as Subscription, U as UpdateServiceRequest, M as User, V as ValidationResult, N as VerifyEmailRequest, W as Webhook } from './client-DmZsG2xs.js';
+
+declare class LocalStorageTokenStorage implements TokenStorage {
+    private canAccess;
+    getToken(): string | null;
+    setToken(token: string): void;
+    removeToken(): void;
+}
+
+interface CookieOptions {
+    /** Cookie name (default: "authmi_token") */
+    name?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "lax" | "strict" | "none";
+    domain?: string;
+    path?: string;
+    maxAge?: number;
+}
+declare class CookieTokenStorage implements TokenStorage {
+    private cookieStr;
+    private options;
+    /**
+     * @param cookieStr  The raw `Cookie` header value (server-side) or `document.cookie` (browser).
+     *                   Pass an empty string in environments where cookies are managed via Set-Cookie.
+     */
+    constructor(cookieStr?: string, options?: CookieOptions);
+    /** Update the raw cookie string (e.g. per-request in server middleware) */
+    setCookieString(cookieStr: string): void;
+    /** Escape special regex characters in a string */
+    private static escapeRegex;
+    getToken(): string | null;
+    private lastSetCookie;
+    setToken(token: string): void;
+    /** The last Set-Cookie header generated by setToken() or removeToken() */
+    getSetCookieHeader(): string | undefined;
+    removeToken(): void;
+}
+
+declare class MemoryTokenStorage implements TokenStorage {
+    private token;
+    getToken(): string | null;
+    setToken(token: string): void;
+    removeToken(): void;
+}
 
 /**
  * Auth Mi Client
  *
  * Official client library for Auth Mi - Multi-tenant authentication-as-a-service
- *
- * @example
- * ```typescript
- * import { AuthMiClient } from "authmi";
- *
- * const client = new AuthMiClient({
- *   baseUrl: "https://authmi.dev",
- *   serviceId: "svc-xxx",
- *   apiKey: "ak-xxx",
- * });
- *
- * // Login
- * const token = await client.login({
- *   email: "user@example.com",
- *   password: "password123",
- * });
- *
- * // Validate token
- * const isValid = await client.validate();
- * ```
  */
 
-declare const VERSION = "1.0.0";
+declare const VERSION = "1.1.0";
 
-export { VERSION };
+export { type CookieOptions, CookieTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenStorage, VERSION };