authmi 1.0.0

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+export { A as ApiKey, a as AuthMiClient, b as AuthMiConfig, c as AuthMiError, d as AuthToken, C as CreateApiKeyRequest, e as CreateApiKeyResponse, f as CreateScopeRequest, g as CreateUserRequest, I as IntrospectRequest, h as IntrospectResponse, L as LocalStorageTokenStorage, i as LoginCredentials, M as MemoryTokenStorage, O as OAuthCallbackResult, j as OAuthInitiateResponse, k as OAuthProvider, l as OnboardRequest, m as OnboardResponse, R as RegisterWebhookRequest, S as Scope, n as ScopeError, o as Service, T as TokenStorage, U as User, p as UserListResponse, V as ValidationResult, W as Webhook } from './client-D6JiIhlU.js';
+
+/**
+ * Auth Mi Client
+ *
+ * Official client library for Auth Mi - Multi-tenant authentication-as-a-service
+ *
+ * @example
+ * ```typescript
+ * import { AuthMiClient } from "authmi";
+ *
+ * const client = new AuthMiClient({
+ *   baseUrl: "https://authmi.dev",
+ *   serviceId: "svc-xxx",
+ *   apiKey: "ak-xxx",
+ * });
+ *
+ * // Login
+ * const token = await client.login({
+ *   email: "user@example.com",
+ *   password: "password123",
+ * });
+ *
+ * // Validate token
+ * const isValid = await client.validate();
+ * ```
+ */
+
+declare const VERSION = "1.0.0";
+
+export { VERSION };

package/dist/index.js

@@ -0,0 +1,609 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AuthMiClient: () => AuthMiClient,
+  AuthMiError: () => AuthMiError,
+  LocalStorageTokenStorage: () => LocalStorageTokenStorage,
+  MemoryTokenStorage: () => MemoryTokenStorage,
+  ScopeError: () => ScopeError,
+  VERSION: () => VERSION
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/types.ts
+var AuthMiError = class extends Error {
+  constructor(message, code, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AuthMiError";
+  }
+};
+var ScopeError = class extends AuthMiError {
+  constructor(message, requiredScopes, providedScopes) {
+    super(message, "INSUFFICIENT_SCOPES", 403);
+    this.requiredScopes = requiredScopes;
+    this.providedScopes = providedScopes;
+    this.name = "ScopeError";
+  }
+};
+var _LocalStorageTokenStorage = class _LocalStorageTokenStorage {
+  getToken() {
+    if (typeof window === "undefined") return null;
+    return localStorage.getItem(_LocalStorageTokenStorage.KEY);
+  }
+  setToken(token) {
+    if (typeof window === "undefined") return;
+    localStorage.setItem(_LocalStorageTokenStorage.KEY, token);
+  }
+  removeToken() {
+    if (typeof window === "undefined") return;
+    localStorage.removeItem(_LocalStorageTokenStorage.KEY);
+  }
+};
+_LocalStorageTokenStorage.KEY = "authmi_token";
+var LocalStorageTokenStorage = _LocalStorageTokenStorage;
+var MemoryTokenStorage = class {
+  constructor() {
+    this.token = null;
+  }
+  getToken() {
+    return this.token;
+  }
+  setToken(token) {
+    this.token = token;
+  }
+  removeToken() {
+    this.token = null;
+  }
+};
+
+// src/client.ts
+var AuthMiClient = class {
+  constructor(config, tokenStorage) {
+    this.config = {
+      apiKey: "",
+      serviceId: "",
+      clientId: "",
+      clientSecret: "",
+      defaultTokenExpiry: 24,
+      ...config
+    };
+    this.tokenStorage = tokenStorage || new LocalStorageTokenStorage();
+  }
+  /** Build Basic auth header from clientId:clientSecret */
+  basicAuthHeader() {
+    if (this.config.clientId && this.config.clientSecret) {
+      const encoded = btoa(`${this.config.clientId}:${this.config.clientSecret}`);
+      return `Basic ${encoded}`;
+    }
+    return null;
+  }
+  // ============ HTTP Utilities ============
+  async request(endpoint, options = {}, requireAuth = false) {
+    const url = `${this.config.baseUrl}${endpoint}`;
+    const headers = {
+      "Content-Type": "application/json",
+      ...options.headers || {}
+    };
+    const basic = this.basicAuthHeader();
+    if (basic && !requireAuth && !headers["Authorization"]) {
+      headers["Authorization"] = basic;
+    } else if (this.config.apiKey && !requireAuth && !headers["Authorization"]) {
+      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
+    }
+    if (requireAuth) {
+      const token = this.getAccessToken();
+      if (token && !headers["Authorization"]) {
+        headers["Authorization"] = `Bearer ${token}`;
+      }
+    }
+    try {
+      const response = await fetch(url, {
+        ...options,
+        headers
+      });
+      const data = await response.json();
+      if (!response.ok) {
+        if (response.status === 403 && data.required && data.provided) {
+          throw new ScopeError(
+            data.error || "Insufficient scopes",
+            data.required,
+            data.provided
+          );
+        }
+        throw new AuthMiError(
+          data.error || `HTTP ${response.status}`,
+          data.code || "UNKNOWN_ERROR",
+          response.status
+        );
+      }
+      return data;
+    } catch (error) {
+      if (error instanceof AuthMiError) {
+        throw error;
+      }
+      throw new AuthMiError(
+        error instanceof Error ? error.message : "Network error",
+        "NETWORK_ERROR"
+      );
+    }
+  }
+  // ============ Configuration ============
+  /**
+   * Update the client's service configuration
+   */
+  configure(config) {
+    this.config = { ...this.config, ...config };
+  }
+  /**
+   * Get current configuration (without sensitive data)
+   */
+  getConfig() {
+    const { apiKey: _, clientSecret: __, ...rest } = this.config;
+    return rest;
+  }
+  // ============ Token Management ============
+  /**
+   * Get the stored access token
+   */
+  getAccessToken() {
+    return this.tokenStorage.getToken();
+  }
+  /**
+   * Store an access token
+   */
+  setAccessToken(token) {
+    this.tokenStorage.setToken(token);
+  }
+  /**
+   * Remove the stored access token (logout)
+   */
+  clearAccessToken() {
+    this.tokenStorage.removeToken();
+  }
+  /**
+   * Check if user is logged in
+   */
+  isLoggedIn() {
+    return !!this.getAccessToken();
+  }
+  // ============ Scope Validation ============
+  /**
+   * Introspect a token or API key and validate required scopes
+   */
+  async introspect(request) {
+    return this.request("/api/v1/introspect", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+  }
+  /**
+   * Validate the current token with optional scope checking
+   */
+  async validateWithScopes(requiredScopes) {
+    const token = this.getAccessToken();
+    if (!token) {
+      return { valid: false, error: "No token provided" };
+    }
+    if (!this.config.apiKey && !this.config.clientSecret) {
+      return { valid: false, error: "Service credentials not configured" };
+    }
+    if (!this.config.serviceId) {
+      return { valid: false, error: "Service ID not configured in AuthMiConfig" };
+    }
+    try {
+      const result = await this.introspect({
+        serviceId: this.config.serviceId,
+        token,
+        requiredScopes
+      });
+      return {
+        valid: result.valid,
+        type: result.type === "bearer" ? "token" : "api_key",
+        scopes: result.scopes,
+        userId: result.userId,
+        email: result.email,
+        error: result.error
+      };
+    } catch (error) {
+      if (error instanceof ScopeError) {
+        return {
+          valid: false,
+          error: error.message,
+          scopes: error.providedScopes
+        };
+      }
+      if (error instanceof AuthMiError && error.statusCode === 401) {
+        return { valid: false, error: "Invalid or expired token" };
+      }
+      throw error;
+    }
+  }
+  /**
+   * Check if the current user has all the required scopes
+   * Throws ScopeError if scopes are insufficient
+   */
+  async requireScopes(...requiredScopes) {
+    const result = await this.validateWithScopes(requiredScopes);
+    if (!result.valid) {
+      throw new AuthMiError(
+        result.error || "Authentication required",
+        "UNAUTHORIZED",
+        401
+      );
+    }
+    const hasScopes = requiredScopes.every(
+      (scope) => result.scopes?.includes(scope)
+    );
+    if (!hasScopes) {
+      throw new ScopeError(
+        `Required scopes: ${requiredScopes.join(", ")}`,
+        requiredScopes,
+        result.scopes || []
+      );
+    }
+    return result;
+  }
+  /**
+   * Execute a function only if the user has the required scopes
+   */
+  async withScope(scopes, fn) {
+    await this.requireScopes(...scopes);
+    return fn();
+  }
+  // ============ OAuth ============
+  /**
+   * Initiate OAuth login flow and return the authorization URL
+   */
+  async initiateOAuth(provider, redirectUri) {
+    if (!this.config.apiKey && !this.config.clientSecret) {
+      throw new AuthMiError(
+        "API key or client credentials required for OAuth. Configure the client first.",
+        "MISSING_CREDENTIALS"
+      );
+    }
+    if (!this.config.serviceId) {
+      throw new AuthMiError(
+        "serviceId required for OAuth. Configure the client first.",
+        "MISSING_SERVICE_ID"
+      );
+    }
+    const response = await this.request(
+      "/api/v1/auth/oauth/initiate",
+      {
+        method: "POST",
+        body: JSON.stringify({ provider, redirectUri, client_id: this.config.serviceId })
+      }
+    );
+    return response.url;
+  }
+  /**
+   * Handle OAuth callback URL and store the access token
+   * Returns null if no OAuth params are present in the URL
+   */
+  handleOAuthCallback(url) {
+    const parsedUrl = typeof url === "string" ? new URL(url) : url;
+    const token = parsedUrl.searchParams.get("token");
+    const userId = parsedUrl.searchParams.get("user_id");
+    const email = parsedUrl.searchParams.get("email");
+    if (!token || !userId || !email) {
+      return null;
+    }
+    this.setAccessToken(token);
+    return { token, userId, email };
+  }
+  /**
+   * Check if the current URL contains OAuth callback params
+   */
+  isOAuthCallback(url) {
+    const parsedUrl = typeof url === "string" ? new URL(url) : url;
+    return parsedUrl.searchParams.has("token") && parsedUrl.searchParams.has("user_id") && parsedUrl.searchParams.has("email");
+  }
+  // ============ Authentication ============
+  /**
+   * Login a user and store the access token
+   */
+  async login(credentials) {
+    if (!this.config.apiKey && !this.config.clientSecret) {
+      throw new AuthMiError(
+        "API key or client credentials required for login. Configure the client first.",
+        "MISSING_CREDENTIALS"
+      );
+    }
+    const response = await this.request("/api/v1/auth/login", {
+      method: "POST",
+      body: JSON.stringify({
+        email: credentials.email,
+        password: credentials.password,
+        client_id: this.config.serviceId,
+        expires_in_hours: credentials.expiresInHours || this.config.defaultTokenExpiry,
+        scopes: credentials.scopes
+      })
+    });
+    const token = {
+      accessToken: response.access_token,
+      tokenType: response.token_type,
+      expiresIn: response.expires_in,
+      expiresAt: response.expires_at,
+      userId: response.user_id,
+      email: response.email,
+      scopes: response.scopes
+    };
+    this.setAccessToken(token.accessToken);
+    return token;
+  }
+  /**
+   * Logout the current user
+   */
+  async logout() {
+    const token = this.getAccessToken();
+    if (token) {
+      try {
+        await this.request("/api/v1/auth/logout", {
+          method: "POST"
+        }, true);
+      } catch (error) {
+      }
+    }
+    this.clearAccessToken();
+  }
+  /**
+   * Validate the current token or an API key
+   * @deprecated Use validateWithScopes instead
+   */
+  async validate(_credential) {
+    return this.validateWithScopes();
+  }
+  /**
+   * Refresh the current token
+   */
+  async refreshToken() {
+    const response = await this.request("/api/v1/auth/refresh", {
+      method: "POST"
+    }, true);
+    const token = {
+      accessToken: response.access_token,
+      tokenType: response.token_type,
+      expiresIn: response.expires_in,
+      expiresAt: response.expires_at,
+      userId: "",
+      // Refresh doesn't return user info
+      email: ""
+    };
+    this.setAccessToken(token.accessToken);
+    return token;
+  }
+  // ============ User Management ============
+  /**
+   * Create a new user (requires admin API key)
+   */
+  async createUser(request) {
+    const response = await this.request("/api/v1/users/create", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+    return {
+      userId: response.user_id,
+      email: response.email,
+      createdAt: response.created_at
+    };
+  }
+  /**
+   * List all users for the service
+   */
+  async listUsers() {
+    const response = await this.request("/api/v1/users/list");
+    return response.users.map((u) => ({
+      userId: u.user_id,
+      email: u.email,
+      createdAt: u.created_at
+    }));
+  }
+  /**
+   * Delete a user
+   */
+  async deleteUser(userId) {
+    await this.request("/api/v1/users/delete", {
+      method: "POST",
+      body: JSON.stringify({ user_id: userId })
+    });
+  }
+  /**
+   * Update user password
+   */
+  async updatePassword(userId, oldPassword, newPassword) {
+    await this.request("/api/v1/users/password", {
+      method: "POST",
+      body: JSON.stringify({
+        user_id: userId,
+        old_password: oldPassword,
+        new_password: newPassword
+      })
+    });
+  }
+  // ============ Scope Management ============
+  /**
+   * List custom scopes for the service
+   */
+  async listScopes() {
+    const response = await this.request("/api/v1/scopes/list");
+    return response.scopes;
+  }
+  /**
+   * Create a custom scope
+   */
+  async createScope(request) {
+    const response = await this.request("/api/v1/scopes/create", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+    return {
+      scopeId: response.scope_id,
+      name: response.name,
+      key: response.key,
+      description: response.description,
+      createdAt: response.created_at
+    };
+  }
+  /**
+   * Delete a custom scope
+   */
+  async deleteScope(scopeId) {
+    await this.request("/api/v1/scopes/delete", {
+      method: "POST",
+      body: JSON.stringify({ scope_id: scopeId })
+    });
+  }
+  // ============ API Key Management ============
+  /**
+   * List all API keys for the service
+   */
+  async listApiKeys() {
+    const response = await this.request("/api/v1/keys/list");
+    return response.keys.map((k) => ({
+      keyId: k.keyId,
+      name: k.name,
+      scope: k.scope,
+      scopes: [],
+      keyType: k.keyType,
+      revoked: k.revoked,
+      createdAt: k.createdAt,
+      tpsLimit: k.tpsLimit
+    }));
+  }
+  /**
+   * Create a new API key with optional custom scopes
+   */
+  async createApiKey(request) {
+    const response = await this.request("/api/v1/keys/create", {
+      method: "POST",
+      body: JSON.stringify({
+        user_id: request.userId,
+        name: request.name,
+        scope: request.scope || "service",
+        scopes: request.scopes,
+        key_type: request.keyType || "service",
+        tps_limit: request.tpsLimit || 100
+      })
+    });
+    return {
+      keyId: response.key_id,
+      apiKey: response.api_key,
+      name: response.name,
+      scope: response.scope,
+      scopes: response.scopes
+    };
+  }
+  /**
+   * Revoke an API key
+   */
+  async revokeApiKey(keyId) {
+    await this.request("/api/v1/keys/revoke", {
+      method: "POST",
+      body: JSON.stringify({ key_id: keyId })
+    });
+  }
+  // ============ Service Management ============
+  /**
+   * Onboard a new service (requires master admin key)
+   */
+  async onboardService(request, masterAdminKey) {
+    const response = await this.request("/api/v1/services/onboard", {
+      method: "POST",
+      headers: {
+        "x-onboarding-admin-key": masterAdminKey
+      },
+      body: JSON.stringify({
+        service_name: request.serviceName,
+        owner_email: request.ownerEmail
+      })
+    });
+    return {
+      serviceId: response.service_id,
+      serviceName: response.service_name,
+      ownerEmail: response.owner_email,
+      adminKeyId: response.admin_key_id,
+      serviceAdminApiKey: response.service_admin_api_key,
+      createdAt: response.created_at
+    };
+  }
+  /**
+   * Delete a service (requires master admin key)
+   */
+  async deleteService(serviceId, masterAdminKey) {
+    await this.request("/api/v1/services/deboard", {
+      method: "POST",
+      headers: {
+        "x-onboarding-admin-key": masterAdminKey
+      },
+      body: JSON.stringify({ service_id: serviceId })
+    });
+  }
+  // ============ Webhook Management ============
+  /**
+   * List webhooks
+   */
+  async listWebhooks() {
+    const response = await this.request(
+      "/api/v1/webhooks/list"
+    );
+    return response.webhooks;
+  }
+  /**
+   * Register a webhook
+   */
+  async registerWebhook(request) {
+    const response = await this.request("/api/v1/webhooks/register", {
+      method: "POST",
+      body: JSON.stringify(request)
+    });
+    return {
+      webhookId: response.webhook_id,
+      url: response.url,
+      events: response.events,
+      active: response.active,
+      createdAt: response.created_at
+    };
+  }
+  /**
+   * Delete a webhook
+   */
+  async deleteWebhook(webhookId) {
+    await this.request("/api/v1/webhooks/delete", {
+      method: "POST",
+      body: JSON.stringify({ webhook_id: webhookId })
+    });
+  }
+};
+
+// src/index.ts
+var VERSION = "1.0.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthMiClient,
+  AuthMiError,
+  LocalStorageTokenStorage,
+  MemoryTokenStorage,
+  ScopeError,
+  VERSION
+});

package/dist/index.mjs

@@ -0,0 +1,18 @@
+import {
+  AuthMiClient,
+  AuthMiError,
+  LocalStorageTokenStorage,
+  MemoryTokenStorage,
+  ScopeError
+} from "./chunk-UNKK6FP4.mjs";
+
+// src/index.ts
+var VERSION = "1.0.0";
+export {
+  AuthMiClient,
+  AuthMiError,
+  LocalStorageTokenStorage,
+  MemoryTokenStorage,
+  ScopeError,
+  VERSION
+};