authvital-sdk 0.1.1-dev.3.cefb119.0

package/dist/chunk-ETJ5ICJ7.mjs

@@ -0,0 +1,412 @@
+// src/webhooks/types.ts
+var SYNC_EVENT_TYPES = {
+  // Invitations
+  INVITE_CREATED: "invite.created",
+  INVITE_ACCEPTED: "invite.accepted",
+  INVITE_DELETED: "invite.deleted",
+  INVITE_EXPIRED: "invite.expired",
+  // Subjects (users, service accounts, etc.)
+  SUBJECT_CREATED: "subject.created",
+  SUBJECT_UPDATED: "subject.updated",
+  SUBJECT_DELETED: "subject.deleted",
+  SUBJECT_DEACTIVATED: "subject.deactivated",
+  // Memberships
+  MEMBER_JOINED: "member.joined",
+  MEMBER_LEFT: "member.left",
+  MEMBER_ROLE_CHANGED: "member.role_changed",
+  MEMBER_SUSPENDED: "member.suspended",
+  MEMBER_ACTIVATED: "member.activated",
+  // App Access
+  APP_ACCESS_GRANTED: "app_access.granted",
+  APP_ACCESS_REVOKED: "app_access.revoked",
+  APP_ACCESS_ROLE_CHANGED: "app_access.role_changed",
+  // Licenses
+  LICENSE_ASSIGNED: "license.assigned",
+  LICENSE_REVOKED: "license.revoked",
+  LICENSE_CHANGED: "license.changed"
+};
+function isInviteEvent(event) {
+  return event.type.startsWith("invite.");
+}
+function isSubjectEvent(event) {
+  return event.type.startsWith("subject.");
+}
+function isMemberEvent(event) {
+  return event.type.startsWith("member.");
+}
+function isAppAccessEvent(event) {
+  return event.type.startsWith("app_access.");
+}
+function isLicenseEvent(event) {
+  return event.type.startsWith("license.");
+}
+
+// src/webhooks/event-interfaces.ts
+var InviteEventHandler = class {
+  onInviteCreated(_event) {
+  }
+  onInviteAccepted(_event) {
+  }
+  onInviteDeleted(_event) {
+  }
+  onInviteExpired(_event) {
+  }
+};
+var SubjectEventHandler = class {
+  onSubjectCreated(_event) {
+  }
+  onSubjectUpdated(_event) {
+  }
+  onSubjectDeleted(_event) {
+  }
+  onSubjectDeactivated(_event) {
+  }
+};
+var MemberEventHandler = class {
+  onMemberJoined(_event) {
+  }
+  onMemberLeft(_event) {
+  }
+  onMemberRoleChanged(_event) {
+  }
+  onMemberSuspended(_event) {
+  }
+  onMemberActivated(_event) {
+  }
+};
+var AppAccessEventHandler = class {
+  onAppAccessGranted(_event) {
+  }
+  onAppAccessRevoked(_event) {
+  }
+  /**
+   * @deprecated Use onAppAccessRevoked instead. This method exists for backwards compatibility.
+   */
+  onAppAccessDeactivated(event) {
+    return this.onAppAccessRevoked?.(event);
+  }
+  onAppAccessRoleChanged(_event) {
+  }
+};
+var LicenseEventHandler = class {
+  onLicenseAssigned(_event) {
+  }
+  onLicenseRevoked(_event) {
+  }
+  onLicenseChanged(_event) {
+  }
+};
+var AuthVitalEventHandler = class {
+  // Invite events
+  onInviteCreated(_event) {
+  }
+  onInviteAccepted(_event) {
+  }
+  onInviteDeleted(_event) {
+  }
+  onInviteExpired(_event) {
+  }
+  // Subject events
+  onSubjectCreated(_event) {
+  }
+  onSubjectUpdated(_event) {
+  }
+  onSubjectDeleted(_event) {
+  }
+  onSubjectDeactivated(_event) {
+  }
+  // Member events
+  onMemberJoined(_event) {
+  }
+  onMemberLeft(_event) {
+  }
+  onMemberRoleChanged(_event) {
+  }
+  onMemberSuspended(_event) {
+  }
+  onMemberActivated(_event) {
+  }
+  // App access events
+  onAppAccessGranted(_event) {
+  }
+  onAppAccessRevoked(_event) {
+  }
+  /**
+   * @deprecated Use onAppAccessRevoked instead. This method exists for backwards compatibility.
+   */
+  onAppAccessDeactivated(event) {
+    return this.onAppAccessRevoked?.(event);
+  }
+  onAppAccessRoleChanged(_event) {
+  }
+  // License events
+  onLicenseAssigned(_event) {
+  }
+  onLicenseRevoked(_event) {
+  }
+  onLicenseChanged(_event) {
+  }
+  // Catch-all
+  onUnhandledEvent(_event) {
+  }
+};
+
+// src/webhooks/webhook-handler.ts
+import * as crypto from "crypto";
+var AuthVitalWebhooks = class {
+  constructor(options) {
+    this.keysCache = /* @__PURE__ */ new Map();
+    this.keysCacheExpiry = 0;
+    this.jwksUrl = options.jwksUrl;
+    this.maxTimestampAge = options.maxTimestampAge ?? 300;
+    this.keysCacheTtl = options.keysCacheTtl ?? 36e5;
+  }
+  /**
+   * Verify and parse a webhook payload
+   *
+   * @param body - The raw request body (string or object)
+   * @param headers - The request headers (can pass full headers object)
+   * @returns The parsed and verified event
+   * @throws Error if verification fails
+   */
+  async verifyAndParse(body, headers) {
+    const normalizedHeaders = this.normalizeHeaders(headers);
+    const signature = normalizedHeaders["x-authvital-signature"];
+    const keyId = normalizedHeaders["x-authvital-key-id"];
+    const timestamp = normalizedHeaders["x-authvital-timestamp"];
+    if (!signature) {
+      throw new Error("Missing X-AuthVital-Signature header");
+    }
+    if (!keyId) {
+      throw new Error("Missing X-AuthVital-Key-Id header");
+    }
+    if (!timestamp) {
+      throw new Error("Missing X-AuthVital-Timestamp header");
+    }
+    const timestampNum = parseInt(timestamp, 10);
+    if (isNaN(timestampNum)) {
+      throw new Error("Invalid timestamp format");
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const age = now - timestampNum;
+    if (age > this.maxTimestampAge) {
+      throw new Error(`Timestamp too old: ${age}s (max ${this.maxTimestampAge}s)`);
+    }
+    if (age < -60) {
+      throw new Error("Timestamp is in the future");
+    }
+    const bodyString = typeof body === "string" ? body : JSON.stringify(body);
+    const signedPayload = `${timestamp}.${bodyString}`;
+    const publicKey = await this.getPublicKey(keyId);
+    const isValid = crypto.verify(
+      "RSA-SHA256",
+      Buffer.from(signedPayload),
+      publicKey,
+      Buffer.from(signature, "base64")
+    );
+    if (!isValid) {
+      throw new Error("Invalid signature");
+    }
+    const event = typeof body === "string" ? JSON.parse(body) : body;
+    return event;
+  }
+  /**
+   * Verify signature only (without parsing)
+   * Useful if you want to handle parsing yourself
+   */
+  async verify(body, signature, keyId, timestamp) {
+    try {
+      const timestampNum = parseInt(timestamp, 10);
+      const now = Math.floor(Date.now() / 1e3);
+      const age = now - timestampNum;
+      if (age > this.maxTimestampAge || age < -60) {
+        return false;
+      }
+      const bodyString = typeof body === "string" ? body : JSON.stringify(body);
+      const signedPayload = `${timestamp}.${bodyString}`;
+      const publicKey = await this.getPublicKey(keyId);
+      return crypto.verify(
+        "RSA-SHA256",
+        Buffer.from(signedPayload),
+        publicKey,
+        Buffer.from(signature, "base64")
+      );
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Get a public key from the JWKS endpoint
+   */
+  async getPublicKey(kid) {
+    const now = Date.now();
+    if (this.keysCache.has(kid) && now < this.keysCacheExpiry) {
+      return this.keysCache.get(kid);
+    }
+    const response = await fetch(this.jwksUrl);
+    if (!response.ok) {
+      throw new Error(`Failed to fetch JWKS: ${response.status}`);
+    }
+    const jwks = await response.json();
+    this.keysCache.clear();
+    this.keysCacheExpiry = now + this.keysCacheTtl;
+    for (const key of jwks.keys) {
+      if (key.kty === "RSA" && key.n && key.e) {
+        const publicKey2 = crypto.createPublicKey({
+          key: {
+            kty: key.kty,
+            n: key.n,
+            e: key.e
+          },
+          format: "jwk"
+        });
+        this.keysCache.set(key.kid, publicKey2);
+      }
+    }
+    const publicKey = this.keysCache.get(kid);
+    if (!publicKey) {
+      throw new Error(`Key not found: ${kid}`);
+    }
+    return publicKey;
+  }
+  /**
+   * Normalize headers to lowercase keys and string values
+   */
+  normalizeHeaders(headers) {
+    const normalized = {};
+    for (const [key, value] of Object.entries(headers)) {
+      const normalizedKey = key.toLowerCase();
+      normalized[normalizedKey] = Array.isArray(value) ? value[0] : value;
+    }
+    return normalized;
+  }
+  /**
+   * Clear the key cache (useful for testing or key rotation)
+   */
+  clearCache() {
+    this.keysCache.clear();
+    this.keysCacheExpiry = 0;
+  }
+};
+
+// src/webhooks/webhook-router.ts
+var WebhookRouter = class {
+  constructor(options) {
+    const authVitalHost = options.authVitalHost || process.env.AV_HOST;
+    if (!authVitalHost) {
+      throw new Error(
+        "AuthVital URL is required. Either pass authVitalHost in options or set AV_HOST environment variable."
+      );
+    }
+    const jwksUrl = `${authVitalHost.replace(/\/$/, "")}/.well-known/jwks.json`;
+    this.verifier = new AuthVitalWebhooks({
+      jwksUrl,
+      maxTimestampAge: options.maxTimestampAge,
+      keysCacheTtl: options.keysCacheTtl
+    });
+    this.handler = options.handler;
+  }
+  /**
+   * Handle a webhook request
+   */
+  async handle(body, headers) {
+    try {
+      const event = await this.verifier.verifyAndParse(body, headers);
+      await this.dispatch(event);
+      return {
+        status: 200,
+        body: { success: true, message: `Processed ${event.type}` }
+      };
+    } catch (error) {
+      return {
+        status: 400,
+        body: { success: false, error: error.message || "Webhook processing failed" }
+      };
+    }
+  }
+  /**
+   * Dispatch event to the appropriate handler method
+   */
+  async dispatch(event) {
+    const h = this.handler;
+    switch (event.type) {
+      // Invite events
+      case "invite.created":
+        return h.onInviteCreated?.(event);
+      case "invite.accepted":
+        return h.onInviteAccepted?.(event);
+      case "invite.deleted":
+        return h.onInviteDeleted?.(event);
+      case "invite.expired":
+        return h.onInviteExpired?.(event);
+      // Subject events (users, service accounts, machines)
+      case "subject.created":
+        return h.onSubjectCreated?.(event);
+      case "subject.updated":
+        return h.onSubjectUpdated?.(event);
+      case "subject.deleted":
+        return h.onSubjectDeleted?.(event);
+      case "subject.deactivated":
+        return h.onSubjectDeactivated?.(event);
+      // Member events
+      case "member.joined":
+        return h.onMemberJoined?.(event);
+      case "member.left":
+        return h.onMemberLeft?.(event);
+      case "member.role_changed":
+        return h.onMemberRoleChanged?.(event);
+      case "member.suspended":
+        return h.onMemberSuspended?.(event);
+      case "member.activated":
+        return h.onMemberActivated?.(event);
+      // App access events
+      case "app_access.granted":
+        return h.onAppAccessGranted?.(event);
+      case "app_access.revoked":
+        return h.onAppAccessRevoked?.(event);
+      case "app_access.role_changed":
+        return h.onAppAccessRoleChanged?.(event);
+      // License events
+      case "license.assigned":
+        return h.onLicenseAssigned?.(event);
+      case "license.revoked":
+        return h.onLicenseRevoked?.(event);
+      case "license.changed":
+        return h.onLicenseChanged?.(event);
+      default:
+        return h.onUnhandledEvent?.(event);
+    }
+  }
+  /**
+   * Express middleware handler
+   */
+  expressHandler() {
+    return async (req, res) => {
+      const result = await this.handle(req.body, req.headers);
+      res.status(result.status).json(result.body);
+    };
+  }
+  /**
+   * Get the underlying verifier
+   */
+  getVerifier() {
+    return this.verifier;
+  }
+};
+
+export {
+  SYNC_EVENT_TYPES,
+  isInviteEvent,
+  isSubjectEvent,
+  isMemberEvent,
+  isAppAccessEvent,
+  isLicenseEvent,
+  InviteEventHandler,
+  SubjectEventHandler,
+  MemberEventHandler,
+  AppAccessEventHandler,
+  LicenseEventHandler,
+  AuthVitalEventHandler,
+  AuthVitalWebhooks,
+  WebhookRouter
+};