authmi 1.0.0 → 1.2.0

package/dist/chunk-UNKK6FP4.mjs

@@ -1,609 +0,0 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// src/types.ts
-var AuthMiError = class extends Error {
-  constructor(message, code, statusCode) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "AuthMiError";
-  }
-};
-var ScopeError = class extends AuthMiError {
-  constructor(message, requiredScopes, providedScopes) {
-    super(message, "INSUFFICIENT_SCOPES", 403);
-    this.requiredScopes = requiredScopes;
-    this.providedScopes = providedScopes;
-    this.name = "ScopeError";
-  }
-};
-var _LocalStorageTokenStorage = class _LocalStorageTokenStorage {
-  getToken() {
-    if (typeof window === "undefined") return null;
-    return localStorage.getItem(_LocalStorageTokenStorage.KEY);
-  }
-  setToken(token) {
-    if (typeof window === "undefined") return;
-    localStorage.setItem(_LocalStorageTokenStorage.KEY, token);
-  }
-  removeToken() {
-    if (typeof window === "undefined") return;
-    localStorage.removeItem(_LocalStorageTokenStorage.KEY);
-  }
-};
-_LocalStorageTokenStorage.KEY = "authmi_token";
-var LocalStorageTokenStorage = _LocalStorageTokenStorage;
-var MemoryTokenStorage = class {
-  constructor() {
-    this.token = null;
-  }
-  getToken() {
-    return this.token;
-  }
-  setToken(token) {
-    this.token = token;
-  }
-  removeToken() {
-    this.token = null;
-  }
-};
-
-// src/client.ts
-var AuthMiClient = class {
-  constructor(config, tokenStorage) {
-    this.config = {
-      apiKey: "",
-      serviceId: "",
-      clientId: "",
-      clientSecret: "",
-      defaultTokenExpiry: 24,
-      ...config
-    };
-    this.tokenStorage = tokenStorage || new LocalStorageTokenStorage();
-  }
-  /** Build Basic auth header from clientId:clientSecret */
-  basicAuthHeader() {
-    if (this.config.clientId && this.config.clientSecret) {
-      const encoded = btoa(`${this.config.clientId}:${this.config.clientSecret}`);
-      return `Basic ${encoded}`;
-    }
-    return null;
-  }
-  // ============ HTTP Utilities ============
-  async request(endpoint, options = {}, requireAuth = false) {
-    const url = `${this.config.baseUrl}${endpoint}`;
-    const headers = {
-      "Content-Type": "application/json",
-      ...options.headers || {}
-    };
-    const basic = this.basicAuthHeader();
-    if (basic && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = basic;
-    } else if (this.config.apiKey && !requireAuth && !headers["Authorization"]) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
-    }
-    if (requireAuth) {
-      const token = this.getAccessToken();
-      if (token && !headers["Authorization"]) {
-        headers["Authorization"] = `Bearer ${token}`;
-      }
-    }
-    try {
-      const response = await fetch(url, {
-        ...options,
-        headers
-      });
-      const data = await response.json();
-      if (!response.ok) {
-        if (response.status === 403 && data.required && data.provided) {
-          throw new ScopeError(
-            data.error || "Insufficient scopes",
-            data.required,
-            data.provided
-          );
-        }
-        throw new AuthMiError(
-          data.error || `HTTP ${response.status}`,
-          data.code || "UNKNOWN_ERROR",
-          response.status
-        );
-      }
-      return data;
-    } catch (error) {
-      if (error instanceof AuthMiError) {
-        throw error;
-      }
-      throw new AuthMiError(
-        error instanceof Error ? error.message : "Network error",
-        "NETWORK_ERROR"
-      );
-    }
-  }
-  // ============ Configuration ============
-  /**
-   * Update the client's service configuration
-   */
-  configure(config) {
-    this.config = { ...this.config, ...config };
-  }
-  /**
-   * Get current configuration (without sensitive data)
-   */
-  getConfig() {
-    const { apiKey: _, clientSecret: __, ...rest } = this.config;
-    return rest;
-  }
-  // ============ Token Management ============
-  /**
-   * Get the stored access token
-   */
-  getAccessToken() {
-    return this.tokenStorage.getToken();
-  }
-  /**
-   * Store an access token
-   */
-  setAccessToken(token) {
-    this.tokenStorage.setToken(token);
-  }
-  /**
-   * Remove the stored access token (logout)
-   */
-  clearAccessToken() {
-    this.tokenStorage.removeToken();
-  }
-  /**
-   * Check if user is logged in
-   */
-  isLoggedIn() {
-    return !!this.getAccessToken();
-  }
-  // ============ Scope Validation ============
-  /**
-   * Introspect a token or API key and validate required scopes
-   */
-  async introspect(request) {
-    return this.request("/api/v1/introspect", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-  }
-  /**
-   * Validate the current token with optional scope checking
-   */
-  async validateWithScopes(requiredScopes) {
-    const token = this.getAccessToken();
-    if (!token) {
-      return { valid: false, error: "No token provided" };
-    }
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      return { valid: false, error: "Service credentials not configured" };
-    }
-    if (!this.config.serviceId) {
-      return { valid: false, error: "Service ID not configured in AuthMiConfig" };
-    }
-    try {
-      const result = await this.introspect({
-        serviceId: this.config.serviceId,
-        token,
-        requiredScopes
-      });
-      return {
-        valid: result.valid,
-        type: result.type === "bearer" ? "token" : "api_key",
-        scopes: result.scopes,
-        userId: result.userId,
-        email: result.email,
-        error: result.error
-      };
-    } catch (error) {
-      if (error instanceof ScopeError) {
-        return {
-          valid: false,
-          error: error.message,
-          scopes: error.providedScopes
-        };
-      }
-      if (error instanceof AuthMiError && error.statusCode === 401) {
-        return { valid: false, error: "Invalid or expired token" };
-      }
-      throw error;
-    }
-  }
-  /**
-   * Check if the current user has all the required scopes
-   * Throws ScopeError if scopes are insufficient
-   */
-  async requireScopes(...requiredScopes) {
-    const result = await this.validateWithScopes(requiredScopes);
-    if (!result.valid) {
-      throw new AuthMiError(
-        result.error || "Authentication required",
-        "UNAUTHORIZED",
-        401
-      );
-    }
-    const hasScopes = requiredScopes.every(
-      (scope) => result.scopes?.includes(scope)
-    );
-    if (!hasScopes) {
-      throw new ScopeError(
-        `Required scopes: ${requiredScopes.join(", ")}`,
-        requiredScopes,
-        result.scopes || []
-      );
-    }
-    return result;
-  }
-  /**
-   * Execute a function only if the user has the required scopes
-   */
-  async withScope(scopes, fn) {
-    await this.requireScopes(...scopes);
-    return fn();
-  }
-  // ============ OAuth ============
-  /**
-   * Initiate OAuth login flow and return the authorization URL
-   */
-  async initiateOAuth(provider, redirectUri) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for OAuth. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
-    if (!this.config.serviceId) {
-      throw new AuthMiError(
-        "serviceId required for OAuth. Configure the client first.",
-        "MISSING_SERVICE_ID"
-      );
-    }
-    const response = await this.request(
-      "/api/v1/auth/oauth/initiate",
-      {
-        method: "POST",
-        body: JSON.stringify({ provider, redirectUri, client_id: this.config.serviceId })
-      }
-    );
-    return response.url;
-  }
-  /**
-   * Handle OAuth callback URL and store the access token
-   * Returns null if no OAuth params are present in the URL
-   */
-  handleOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    const token = parsedUrl.searchParams.get("token");
-    const userId = parsedUrl.searchParams.get("user_id");
-    const email = parsedUrl.searchParams.get("email");
-    if (!token || !userId || !email) {
-      return null;
-    }
-    this.setAccessToken(token);
-    return { token, userId, email };
-  }
-  /**
-   * Check if the current URL contains OAuth callback params
-   */
-  isOAuthCallback(url) {
-    const parsedUrl = typeof url === "string" ? new URL(url) : url;
-    return parsedUrl.searchParams.has("token") && parsedUrl.searchParams.has("user_id") && parsedUrl.searchParams.has("email");
-  }
-  // ============ Authentication ============
-  /**
-   * Login a user and store the access token
-   */
-  async login(credentials) {
-    if (!this.config.apiKey && !this.config.clientSecret) {
-      throw new AuthMiError(
-        "API key or client credentials required for login. Configure the client first.",
-        "MISSING_CREDENTIALS"
-      );
-    }
-    const response = await this.request("/api/v1/auth/login", {
-      method: "POST",
-      body: JSON.stringify({
-        email: credentials.email,
-        password: credentials.password,
-        client_id: this.config.serviceId,
-        expires_in_hours: credentials.expiresInHours || this.config.defaultTokenExpiry,
-        scopes: credentials.scopes
-      })
-    });
-    const token = {
-      accessToken: response.access_token,
-      tokenType: response.token_type,
-      expiresIn: response.expires_in,
-      expiresAt: response.expires_at,
-      userId: response.user_id,
-      email: response.email,
-      scopes: response.scopes
-    };
-    this.setAccessToken(token.accessToken);
-    return token;
-  }
-  /**
-   * Logout the current user
-   */
-  async logout() {
-    const token = this.getAccessToken();
-    if (token) {
-      try {
-        await this.request("/api/v1/auth/logout", {
-          method: "POST"
-        }, true);
-      } catch (error) {
-      }
-    }
-    this.clearAccessToken();
-  }
-  /**
-   * Validate the current token or an API key
-   * @deprecated Use validateWithScopes instead
-   */
-  async validate(_credential) {
-    return this.validateWithScopes();
-  }
-  /**
-   * Refresh the current token
-   */
-  async refreshToken() {
-    const response = await this.request("/api/v1/auth/refresh", {
-      method: "POST"
-    }, true);
-    const token = {
-      accessToken: response.access_token,
-      tokenType: response.token_type,
-      expiresIn: response.expires_in,
-      expiresAt: response.expires_at,
-      userId: "",
-      // Refresh doesn't return user info
-      email: ""
-    };
-    this.setAccessToken(token.accessToken);
-    return token;
-  }
-  // ============ User Management ============
-  /**
-   * Create a new user (requires admin API key)
-   */
-  async createUser(request) {
-    const response = await this.request("/api/v1/users/create", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-    return {
-      userId: response.user_id,
-      email: response.email,
-      createdAt: response.created_at
-    };
-  }
-  /**
-   * List all users for the service
-   */
-  async listUsers() {
-    const response = await this.request("/api/v1/users/list");
-    return response.users.map((u) => ({
-      userId: u.user_id,
-      email: u.email,
-      createdAt: u.created_at
-    }));
-  }
-  /**
-   * Delete a user
-   */
-  async deleteUser(userId) {
-    await this.request("/api/v1/users/delete", {
-      method: "POST",
-      body: JSON.stringify({ user_id: userId })
-    });
-  }
-  /**
-   * Update user password
-   */
-  async updatePassword(userId, oldPassword, newPassword) {
-    await this.request("/api/v1/users/password", {
-      method: "POST",
-      body: JSON.stringify({
-        user_id: userId,
-        old_password: oldPassword,
-        new_password: newPassword
-      })
-    });
-  }
-  // ============ Scope Management ============
-  /**
-   * List custom scopes for the service
-   */
-  async listScopes() {
-    const response = await this.request("/api/v1/scopes/list");
-    return response.scopes;
-  }
-  /**
-   * Create a custom scope
-   */
-  async createScope(request) {
-    const response = await this.request("/api/v1/scopes/create", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-    return {
-      scopeId: response.scope_id,
-      name: response.name,
-      key: response.key,
-      description: response.description,
-      createdAt: response.created_at
-    };
-  }
-  /**
-   * Delete a custom scope
-   */
-  async deleteScope(scopeId) {
-    await this.request("/api/v1/scopes/delete", {
-      method: "POST",
-      body: JSON.stringify({ scope_id: scopeId })
-    });
-  }
-  // ============ API Key Management ============
-  /**
-   * List all API keys for the service
-   */
-  async listApiKeys() {
-    const response = await this.request("/api/v1/keys/list");
-    return response.keys.map((k) => ({
-      keyId: k.keyId,
-      name: k.name,
-      scope: k.scope,
-      scopes: [],
-      keyType: k.keyType,
-      revoked: k.revoked,
-      createdAt: k.createdAt,
-      tpsLimit: k.tpsLimit
-    }));
-  }
-  /**
-   * Create a new API key with optional custom scopes
-   */
-  async createApiKey(request) {
-    const response = await this.request("/api/v1/keys/create", {
-      method: "POST",
-      body: JSON.stringify({
-        user_id: request.userId,
-        name: request.name,
-        scope: request.scope || "service",
-        scopes: request.scopes,
-        key_type: request.keyType || "service",
-        tps_limit: request.tpsLimit || 100
-      })
-    });
-    return {
-      keyId: response.key_id,
-      apiKey: response.api_key,
-      name: response.name,
-      scope: response.scope,
-      scopes: response.scopes
-    };
-  }
-  /**
-   * Revoke an API key
-   */
-  async revokeApiKey(keyId) {
-    await this.request("/api/v1/keys/revoke", {
-      method: "POST",
-      body: JSON.stringify({ key_id: keyId })
-    });
-  }
-  // ============ Service Management ============
-  /**
-   * Onboard a new service (requires master admin key)
-   */
-  async onboardService(request, masterAdminKey) {
-    const response = await this.request("/api/v1/services/onboard", {
-      method: "POST",
-      headers: {
-        "x-onboarding-admin-key": masterAdminKey
-      },
-      body: JSON.stringify({
-        service_name: request.serviceName,
-        owner_email: request.ownerEmail
-      })
-    });
-    return {
-      serviceId: response.service_id,
-      serviceName: response.service_name,
-      ownerEmail: response.owner_email,
-      adminKeyId: response.admin_key_id,
-      serviceAdminApiKey: response.service_admin_api_key,
-      createdAt: response.created_at
-    };
-  }
-  /**
-   * Delete a service (requires master admin key)
-   */
-  async deleteService(serviceId, masterAdminKey) {
-    await this.request("/api/v1/services/deboard", {
-      method: "POST",
-      headers: {
-        "x-onboarding-admin-key": masterAdminKey
-      },
-      body: JSON.stringify({ service_id: serviceId })
-    });
-  }
-  // ============ Webhook Management ============
-  /**
-   * List webhooks
-   */
-  async listWebhooks() {
-    const response = await this.request(
-      "/api/v1/webhooks/list"
-    );
-    return response.webhooks;
-  }
-  /**
-   * Register a webhook
-   */
-  async registerWebhook(request) {
-    const response = await this.request("/api/v1/webhooks/register", {
-      method: "POST",
-      body: JSON.stringify(request)
-    });
-    return {
-      webhookId: response.webhook_id,
-      url: response.url,
-      events: response.events,
-      active: response.active,
-      createdAt: response.created_at
-    };
-  }
-  /**
-   * Delete a webhook
-   */
-  async deleteWebhook(webhookId) {
-    await this.request("/api/v1/webhooks/delete", {
-      method: "POST",
-      body: JSON.stringify({ webhook_id: webhookId })
-    });
-  }
-};
-
-export {
-  __require,
-  __commonJS,
-  __toESM,
-  AuthMiError,
-  ScopeError,
-  LocalStorageTokenStorage,
-  MemoryTokenStorage,
-  AuthMiClient
-};