authmi 1.0.0 → 1.2.0

package/dist/chunk-DMNUO422.mjs

@@ -0,0 +1,706 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/config.ts
+function resolveConfig(provider) {
+  const raw = typeof provider === "function" ? provider() : provider;
+  return {
+    baseUrl: raw.baseUrl,
+    apiKey: raw.apiKey ?? "",
+    serviceId: raw.serviceId ?? "",
+    clientId: raw.clientId ?? "",
+    clientSecret: raw.clientSecret ?? "",
+    defaultTokenExpiry: raw.defaultTokenExpiry ?? 24
+  };
+}
+
+// src/storage/localStorage.ts
+var STORAGE_KEY = "authmi_token";
+var LocalStorageTokenStorage = class {
+  canAccess() {
+    if (typeof window === "undefined") return false;
+    try {
+      const probe = "__authmi_storage_test__";
+      localStorage.setItem(probe, "1");
+      localStorage.removeItem(probe);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  getToken() {
+    if (!this.canAccess()) return null;
+    try {
+      return localStorage.getItem(STORAGE_KEY);
+    } catch {
+      return null;
+    }
+  }
+  setToken(token) {
+    if (!this.canAccess()) return;
+    try {
+      localStorage.setItem(STORAGE_KEY, token);
+    } catch {
+    }
+  }
+  removeToken() {
+    if (!this.canAccess()) return;
+    try {
+      localStorage.removeItem(STORAGE_KEY);
+    } catch {
+    }
+  }
+};
+
+// src/storage/memory.ts
+var MemoryTokenStorage = class {
+  constructor() {
+    this.token = null;
+  }
+  getToken() {
+    return this.token;
+  }
+  setToken(token) {
+    this.token = token;
+  }
+  removeToken() {
+    this.token = null;
+  }
+};
+
+// src/types.ts
+var AuthMiError = class extends Error {
+  constructor(message, code, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AuthMiError";
+  }
+};
+var ScopeError = class extends AuthMiError {
+  constructor(message, requiredScopes, providedScopes) {
+    super(message, "INSUFFICIENT_SCOPES", 403);
+    this.requiredScopes = requiredScopes;
+    this.providedScopes = providedScopes;
+    this.name = "ScopeError";
+  }
+};
+
+// src/client.ts
+var AuthMiClient = class {
+  constructor(config, options) {
+    this.configProvider = config;
+    this.storage = options?.storage ?? (typeof window !== "undefined" ? new LocalStorageTokenStorage() : new MemoryTokenStorage());
+    this.cache = options?.cache || null;
+  }
+  /** Resolve current config (supports lazy evaluation) */
+  get config() {
+    return resolveConfig(this.configProvider);
+  }
+  // ============ HTTP plumbing ============
+  async request(endpoint, options = {}, requireUserToken = false, requireServiceAuth = true) {
+    const cfg = this.config;
+    const url = `${cfg.baseUrl}${endpoint}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...options.headers || {}
+    };
+    if (!headers["Authorization"]) {
+      if (requireUserToken) {
+        const token = await this.storage.getToken();
+        if (token) headers["Authorization"] = `Bearer ${token}`;
+      } else if (requireServiceAuth && cfg.clientId && cfg.clientSecret) {
+        headers["Authorization"] = `Basic ${btoa(`${cfg.clientId}:${cfg.clientSecret}`)}`;
+        headers["X-Service-ID"] = cfg.serviceId || cfg.clientId;
+      } else if (requireServiceAuth && cfg.apiKey) {
+        headers["Authorization"] = `Bearer ${cfg.apiKey}`;
+      }
+    }
+    try {
+      const response = await fetch(url, { ...options, headers });
+      const data = await response.json();
+      if (!response.ok) {
+        if (response.status === 403 && data.required && data.provided) {
+          throw new ScopeError(
+            data.error || "Insufficient scopes",
+            data.required,
+            data.provided
+          );
+        }
+        throw new AuthMiError(
+          data.error || `HTTP ${response.status}`,
+          data.code || "UNKNOWN_ERROR",
+          response.status
+        );
+      }
+      return data;
+    } catch (error) {
+      if (error instanceof AuthMiError) throw error;
+      throw new AuthMiError(
+        error instanceof Error ? error.message : "Network error",
+        "NETWORK_ERROR"
+      );
+    }
+  }
+  // ============ Configuration ============
+  configure(config) {
+    const current = resolveConfig(this.configProvider);
+    this.configProvider = { ...current, ...config };
+  }
+  getConfig() {
+    const { apiKey: _, clientSecret: __, ...rest } = resolveConfig(this.configProvider);
+    return rest;
+  }
+  // ============ Token Management ============
+  async getAccessToken() {
+    return this.storage.getToken();
+  }
+  setAccessToken(token) {
+    this.storage.setToken(token);
+  }
+  clearAccessToken() {
+    this.storage.removeToken();
+  }
+  async isLoggedIn() {
+    const token = await this.storage.getToken();
+    return !!token;
+  }
+  // ============ Auth Endpoints ============
+  async signup(credentials) {
+    const response = await this.request("/api/v1/auth/signup", {
+      method: "POST",
+      body: JSON.stringify(credentials)
+    }, false, false);
+    return this.mapAuthToken(response);
+  }
+  async login(credentials) {
+    const cfg = this.config;
+    const response = await this.request("/api/v1/auth/login", {
+      method: "POST",
+      body: JSON.stringify({
+        email: credentials.email,
+        password: credentials.password,
+        client_id: cfg.serviceId,
+        expires_in_hours: credentials.expiresInHours || cfg.defaultTokenExpiry,
+        scopes: credentials.scopes
+      })
+    }, false, false);
+    const token = this.mapAuthToken(response);
+    this.setAccessToken(token.accessToken);
+    return token;
+  }
+  async logout() {
+    const token = await this.storage.getToken();
+    if (token) {
+      try {
+        await this.request("/api/v1/auth/logout", { method: "POST" }, true);
+      } catch {
+      }
+    }
+    this.clearAccessToken();
+  }
+  async refreshToken() {
+    const response = await this.request("/api/v1/auth/refresh", { method: "POST" }, true);
+    const token = {
+      accessToken: response.access_token,
+      tokenType: "Bearer",
+      expiresIn: response.expires_in,
+      expiresAt: response.expires_at,
+      userId: "",
+      email: ""
+    };
+    this.setAccessToken(token.accessToken);
+    return token;
+  }
+  async getMe() {
+    const response = await this.request("/api/v1/auth/me", {}, true);
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
+  async forgotPassword(request) {
+    return this.request("/api/v1/auth/forgot-password", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
+    }, false, false);
+  }
+  async resetPassword(request) {
+    return this.request("/api/v1/auth/reset-password", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token, new_password: request.newPassword })
+    }, false, false);
+  }
+  async verifyEmail(request) {
+    return this.request("/api/v1/auth/verify-email", {
+      method: "POST",
+      body: JSON.stringify({ token: request.token })
+    }, false, false);
+  }
+  async resendVerification(request) {
+    return this.request("/api/v1/auth/resend-verification", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, client_id: this.config.serviceId })
+    }, false, false);
+  }
+  async deactivateAccount(password) {
+    await this.request("/api/v1/auth/deactivate", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    }, true, false);
+  }
+  mapAuthToken(raw) {
+    return {
+      accessToken: raw.access_token,
+      tokenType: raw.token_type,
+      expiresIn: raw.expires_in,
+      expiresAt: raw.expires_at,
+      userId: raw.user_id,
+      email: raw.email,
+      emailVerified: raw.email_verified,
+      scopes: raw.scopes
+    };
+  }
+  // ============ OAuth ============
+  async initiateOAuth(provider, redirectUri) {
+    const cfg = this.config;
+    if (!cfg.clientId && !cfg.clientSecret && !cfg.apiKey) {
+      throw new AuthMiError("Credentials required for OAuth", "MISSING_CREDENTIALS");
+    }
+    const response = await this.request("/api/v1/auth/oauth/initiate", {
+      method: "POST",
+      body: JSON.stringify({ provider, redirectUri, client_id: cfg.serviceId || cfg.clientId })
+    }, false, false);
+    return response.url;
+  }
+  handleOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    const token = parsed.searchParams.get("token");
+    const userId = parsed.searchParams.get("user_id");
+    const email = parsed.searchParams.get("email");
+    if (!token || !userId || !email) return null;
+    this.setAccessToken(token);
+    return { token, userId, email };
+  }
+  isOAuthCallback(url) {
+    const parsed = typeof url === "string" ? new URL(url) : url;
+    return !!(parsed.searchParams.has("token") && parsed.searchParams.has("user_id") && parsed.searchParams.has("email"));
+  }
+  // ============ SAML ============
+  async initiateSaml(request) {
+    return this.request("/api/v1/auth/saml/initiate", {
+      method: "POST",
+      body: JSON.stringify({ email: request.email, redirect_uri: request.redirectUri })
+    }, false, false);
+  }
+  async parseSamlMetadata(xml) {
+    return this.request("/api/v1/auth/saml/parse-metadata", {
+      method: "POST",
+      body: JSON.stringify({ metadata_xml: xml })
+    }, false, false);
+  }
+  async listSamlConnections() {
+    const response = await this.request("/api/v1/auth/saml/connections");
+    return response.connections;
+  }
+  async createSamlConnection(request) {
+    return this.request("/api/v1/auth/saml/connections", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  async deleteSamlConnection(id) {
+    await this.request(`/api/v1/auth/saml/connections/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  // ============ 2FA ============
+  async setup2fa() {
+    return this.request("/api/v1/auth/2fa/setup", { method: "POST" }, true, false);
+  }
+  async enable2fa(code) {
+    return this.request("/api/v1/auth/2fa/enable", {
+      method: "POST",
+      body: JSON.stringify({ code })
+    }, true, false);
+  }
+  async disable2fa(password) {
+    await this.request("/api/v1/auth/2fa/disable", {
+      method: "POST",
+      body: JSON.stringify({ password })
+    }, true, false);
+  }
+  async regenerateBackupCodes() {
+    return this.request("/api/v1/auth/2fa/backup-codes", { method: "POST" }, true, false);
+  }
+  async challenge2fa(request) {
+    return this.request("/api/v1/auth/2fa/challenge", {
+      method: "POST",
+      body: JSON.stringify(request)
+    }, false, false);
+  }
+  // ============ Users ============
+  async createUser(request) {
+    const response = await this.request(
+      "/api/v1/users/create",
+      {
+        method: "POST",
+        body: JSON.stringify(request)
+      }
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
+  async listUsers() {
+    const response = await this.request("/api/v1/users/list");
+    return response.users.map((u) => ({
+      userId: u.user_id,
+      email: u.email,
+      name: u.name,
+      createdAt: u.created_at
+    }));
+  }
+  async getUser(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}`
+    );
+    return { userId: response.user_id, email: response.email, name: response.name, createdAt: response.created_at };
+  }
+  async deleteUser(userId) {
+    await this.request("/api/v1/users/delete", {
+      method: "POST",
+      body: JSON.stringify({ user_id: userId })
+    });
+  }
+  async deleteUserById(userId) {
+    await this.request(`/api/v1/users/${encodeURIComponent(userId)}`, { method: "DELETE" });
+  }
+  async updatePassword(userId, oldPassword, newPassword) {
+    await this.request("/api/v1/users/password", {
+      method: "POST",
+      body: JSON.stringify({ user_id: userId, old_password: oldPassword, new_password: newPassword })
+    });
+  }
+  // ============ Roles ============
+  async createRole(request) {
+    const response = await this.request(
+      "/api/v1/users/roles/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { roleId: response.role_id, name: response.name, description: response.description, createdAt: response.created_at };
+  }
+  async listRoles() {
+    const response = await this.request("/api/v1/users/roles/list");
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
+  }
+  async deleteRole(roleId) {
+    await this.request(`/api/v1/users/roles/${encodeURIComponent(roleId)}`, { method: "DELETE" });
+  }
+  async assignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/assign", {
+      method: "POST",
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
+    });
+  }
+  async unassignRole(userId, roleId) {
+    await this.request("/api/v1/users/roles/unassign", {
+      method: "POST",
+      body: JSON.stringify({ user_id: userId, role_id: roleId })
+    });
+  }
+  async getUserRoles(userId) {
+    const response = await this.request(
+      `/api/v1/users/${encodeURIComponent(userId)}/roles`
+    );
+    return response.roles.map((r) => ({
+      roleId: r.role_id,
+      name: r.name,
+      description: r.description,
+      createdAt: r.created_at
+    }));
+  }
+  // ============ API Keys ============
+  async listApiKeys() {
+    const response = await this.request("/api/v1/keys/list");
+    return response.keys.map((k) => ({
+      keyId: k.keyId,
+      name: k.name,
+      scope: k.scope,
+      scopes: k.scopes,
+      keyType: k.keyType,
+      tpsLimit: k.tpsLimit,
+      revoked: k.revoked,
+      createdAt: k.createdAt
+    }));
+  }
+  async createApiKey(request) {
+    const response = await this.request(
+      "/api/v1/keys/create",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          user_id: request.userId,
+          name: request.name,
+          scope: request.scope || "service",
+          scopes: request.scopes,
+          key_type: request.keyType || "service",
+          tps_limit: request.tpsLimit || 100
+        })
+      }
+    );
+    return { keyId: response.key_id, apiKey: response.api_key, name: response.name, scope: response.scope, scopes: response.scopes };
+  }
+  async revokeApiKey(keyId) {
+    await this.request("/api/v1/keys/revoke", {
+      method: "POST",
+      body: JSON.stringify({ key_id: keyId })
+    });
+  }
+  // ============ Scopes ============
+  async listScopes() {
+    const response = await this.request("/api/v1/scopes/list");
+    return response.scopes;
+  }
+  async createScope(request) {
+    const response = await this.request(
+      "/api/v1/scopes/create",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { scopeId: response.scope_id, name: response.name, key: response.key, description: response.description, createdAt: response.created_at };
+  }
+  async deleteScope(scopeId) {
+    await this.request("/api/v1/scopes/delete", {
+      method: "POST",
+      body: JSON.stringify({ scope_id: scopeId })
+    });
+  }
+  // ============ Introspection & Validation ============
+  async introspect(request) {
+    if (this.cache && request.token) {
+      const cached = this.cache.get(request.token);
+      if (cached) return cached;
+    }
+    const result = await this.request("/api/v1/introspect", {
+      method: "POST",
+      body: JSON.stringify({
+        serviceId: request.serviceId,
+        token: request.token,
+        apiKey: request.apiKey,
+        requiredScopes: request.requiredScopes
+      })
+    });
+    if (this.cache && request.token) {
+      this.cache.set(request.token, result);
+    }
+    return result;
+  }
+  async validate() {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token stored" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async validateWithScopes(requiredScopes) {
+    const cfg = this.config;
+    const token = await this.storage.getToken();
+    if (!token) return { valid: false, error: "No token provided" };
+    if (!cfg.apiKey && !cfg.clientSecret) return { valid: false, error: "Service credentials not configured" };
+    if (!cfg.serviceId) return { valid: false, error: "Service ID not configured" };
+    try {
+      const result = await this.introspect({ serviceId: cfg.serviceId, token, requiredScopes });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return { valid: false, error: error.message, scopes: error.providedScopes };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  async requireScopes(...requiredScopes) {
+    const result = await this.validateWithScopes(requiredScopes);
+    if (!result.valid) {
+      throw new AuthMiError(result.error || "Authentication required", "UNAUTHORIZED", 401);
+    }
+    const hasScopes = requiredScopes.every((s) => result.scopes?.includes(s));
+    if (!hasScopes) {
+      throw new ScopeError(`Required: ${requiredScopes.join(", ")}`, requiredScopes, result.scopes || []);
+    }
+    return result;
+  }
+  async withScope(scopes, fn) {
+    await this.requireScopes(...scopes);
+    return fn();
+  }
+  // ============ Webhooks ============
+  async listWebhooks() {
+    const response = await this.request("/api/v1/webhooks/list");
+    return response.webhooks;
+  }
+  async registerWebhook(request) {
+    const response = await this.request(
+      "/api/v1/webhooks/register",
+      { method: "POST", body: JSON.stringify(request) }
+    );
+    return { webhookId: response.webhook_id, url: response.url, events: response.events, active: response.active, createdAt: response.created_at };
+  }
+  async deleteWebhook(webhookId) {
+    await this.request("/api/v1/webhooks/delete", {
+      method: "POST",
+      body: JSON.stringify({ webhook_id: webhookId })
+    });
+  }
+  // ============ Billing ============
+  async listPlans() {
+    const response = await this.request("/api/v1/billing/plans");
+    return response.plans;
+  }
+  async getSubscription() {
+    return this.request("/api/v1/billing/subscription");
+  }
+  async createCheckout(priceId) {
+    return this.request("/api/v1/billing/checkout", {
+      method: "POST",
+      body: JSON.stringify({ price_id: priceId })
+    });
+  }
+  async createPortalSession() {
+    return this.request("/api/v1/billing/portal", { method: "POST" });
+  }
+  // ============ Audit ============
+  async getAuditLogs(query) {
+    const params = new URLSearchParams();
+    if (query?.limit) params.set("limit", String(query.limit));
+    if (query?.offset) params.set("offset", String(query.offset));
+    if (query?.actorId) params.set("actor_id", query.actorId);
+    if (query?.action) params.set("action", query.action);
+    if (query?.resourceType) params.set("resource_type", query.resourceType);
+    if (query?.startDate) params.set("start_date", query.startDate);
+    if (query?.endDate) params.set("end_date", query.endDate);
+    const qs = params.toString();
+    const response = await this.request(
+      `/api/v1/audit-logs${qs ? `?${qs}` : ""}`
+    );
+    return response.logs;
+  }
+  // ============ Services ============
+  async getService(serviceId) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`);
+  }
+  async updateService(serviceId, data) {
+    return this.request(`/api/v1/services/${encodeURIComponent(serviceId)}`, {
+      method: "POST",
+      body: JSON.stringify(data)
+    });
+  }
+  async rotateClientSecret(serviceId) {
+    return this.request(
+      `/api/v1/services/${encodeURIComponent(serviceId)}/rotate-secret`,
+      { method: "POST" }
+    );
+  }
+  // ============ JWKS ============
+  async getJwks(serviceId) {
+    return this.request(`/.well-known/jwks.json?service_id=${encodeURIComponent(serviceId)}`);
+  }
+  // ============ Onboarding (admin only) ============
+  async onboardService(request, masterAdminKey) {
+    const response = await this.request("/api/v1/services/onboard", {
+      method: "POST",
+      headers: {
+        "x-onboarding-admin-key": masterAdminKey
+      },
+      body: JSON.stringify({
+        service_name: request.serviceName,
+        owner_email: request.ownerEmail
+      })
+    });
+    return {
+      serviceId: response.service_id,
+      serviceName: response.service_name,
+      ownerEmail: response.owner_email,
+      adminKeyId: response.admin_key_id,
+      serviceAdminApiKey: response.service_admin_api_key,
+      createdAt: response.created_at
+    };
+  }
+  async deleteService(serviceId, masterAdminKey) {
+    await this.request("/api/v1/services/deboard", {
+      method: "POST",
+      headers: {
+        "x-onboarding-admin-key": masterAdminKey
+      },
+      body: JSON.stringify({ service_id: serviceId })
+    });
+  }
+};
+
+export {
+  __require,
+  __commonJS,
+  __toESM,
+  LocalStorageTokenStorage,
+  MemoryTokenStorage,
+  AuthMiError,
+  ScopeError,
+  AuthMiClient
+};