blendsdk 5.33.0

package/dist/webafx-auth/memory-auth-provider.d.ts

@@ -0,0 +1,100 @@
+/**
+ * In-memory authentication provider for testing and development.
+ *
+ * Validates tokens against a pre-configured map of token → AuthResult.
+ * No network calls, no crypto — pure map lookup. Provides runtime
+ * helpers (`addToken`, `removeToken`) for dynamic test scenarios.
+ *
+ * @example
+ * ```typescript
+ * const provider = new MemoryAuthProvider({
+ *     validTokens: {
+ *         'admin-token': { sub: 'admin-1', claims: { role: 'admin' }, token: 'admin-token' },
+ *         'user-token': { sub: 'user-1', claims: { role: 'user' }, token: 'user-token' },
+ *     },
+ * });
+ *
+ * const result = await provider.authenticate(req);
+ * // result is AuthResult if the Bearer token matches a key, undefined otherwise
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { AuthProvider } from "./abstract-auth-provider.js";
+import type { AuthResult, MemoryAuthConfig } from "./types.js";
+/**
+ * In-memory mock authentication provider.
+ *
+ * Designed for use in unit tests, integration tests, and local development
+ * where a real identity provider is unnecessary. Tokens are validated by
+ * simple map lookup — if the token string exists as a key, the corresponding
+ * AuthResult is returned.
+ *
+ * Supports runtime manipulation of the token map via `addToken()` and
+ * `removeToken()`, making it easy to set up and tear down test scenarios.
+ */
+export declare class MemoryAuthProvider extends AuthProvider {
+    /** Map of valid token strings to their corresponding AuthResult */
+    protected tokens: Map<string, AuthResult>;
+    /**
+     * Create a new in-memory auth provider.
+     *
+     * @param config - Optional configuration with pre-populated valid tokens.
+     *   If omitted, starts with an empty token map.
+     */
+    constructor(config?: MemoryAuthConfig);
+    /**
+     * Validate a token by looking it up in the pre-configured map.
+     *
+     * Returns the matching AuthResult if found, undefined otherwise.
+     * No crypto, no network — pure map lookup.
+     *
+     * @param token - Raw token string extracted from the request
+     * @returns AuthResult if the token is in the map, undefined otherwise
+     */
+    validate(token: string): Promise<AuthResult | undefined>;
+    /**
+     * Health check — always returns true.
+     *
+     * The in-memory provider has no external dependencies and is always
+     * operational as long as the process is running.
+     *
+     * @returns Always true
+     */
+    health(): Promise<boolean>;
+    /**
+     * Graceful shutdown — clears all stored tokens.
+     *
+     * Releases the token map entries. After shutdown, all subsequent
+     * `validate()` calls will return undefined.
+     */
+    shutdown(): Promise<void>;
+    /**
+     * Add a valid token at runtime.
+     *
+     * Useful in test setup to register tokens for specific test scenarios
+     * without needing to recreate the provider.
+     *
+     * @param token - The token string to register
+     * @param result - The AuthResult to return when this token is validated
+     */
+    addToken(token: string, result: AuthResult): void;
+    /**
+     * Remove a token at runtime.
+     *
+     * Useful in test teardown or to simulate token revocation scenarios.
+     *
+     * @param token - The token string to remove
+     * @returns true if the token existed and was removed, false otherwise
+     */
+    removeToken(token: string): boolean;
+    /**
+     * Get the number of currently registered tokens.
+     *
+     * Useful in test assertions to verify the token map state.
+     *
+     * @returns Number of valid tokens in the map
+     */
+    getTokenCount(): number;
+}
+//# sourceMappingURL=memory-auth-provider.d.ts.map

package/dist/webafx-auth/memory-auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-auth-provider.d.ts","sourceRoot":"","sources":["../src/memory-auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,SAAQ,YAAY;IAChD,mEAAmE;IACnE,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE1C;;;;;OAKG;gBACS,MAAM,CAAC,EAAE,gBAAgB;IAWrC;;;;;;;;OAQG;IACG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAI9D;;;;;;;OAOG;IACG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAIhC;;;;;OAKG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAIjD;;;;;;;OAOG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAInC;;;;;;OAMG;IACH,aAAa,IAAI,MAAM;CAG1B"}

package/dist/webafx-auth/memory-auth-provider.js

@@ -0,0 +1,122 @@
+/**
+ * In-memory authentication provider for testing and development.
+ *
+ * Validates tokens against a pre-configured map of token → AuthResult.
+ * No network calls, no crypto — pure map lookup. Provides runtime
+ * helpers (`addToken`, `removeToken`) for dynamic test scenarios.
+ *
+ * @example
+ * ```typescript
+ * const provider = new MemoryAuthProvider({
+ *     validTokens: {
+ *         'admin-token': { sub: 'admin-1', claims: { role: 'admin' }, token: 'admin-token' },
+ *         'user-token': { sub: 'user-1', claims: { role: 'user' }, token: 'user-token' },
+ *     },
+ * });
+ *
+ * const result = await provider.authenticate(req);
+ * // result is AuthResult if the Bearer token matches a key, undefined otherwise
+ * ```
+ *
+ * @packageDocumentation
+ */
+import { AuthProvider } from "./abstract-auth-provider.js";
+/**
+ * In-memory mock authentication provider.
+ *
+ * Designed for use in unit tests, integration tests, and local development
+ * where a real identity provider is unnecessary. Tokens are validated by
+ * simple map lookup — if the token string exists as a key, the corresponding
+ * AuthResult is returned.
+ *
+ * Supports runtime manipulation of the token map via `addToken()` and
+ * `removeToken()`, making it easy to set up and tear down test scenarios.
+ */
+export class MemoryAuthProvider extends AuthProvider {
+    /** Map of valid token strings to their corresponding AuthResult */
+    tokens;
+    /**
+     * Create a new in-memory auth provider.
+     *
+     * @param config - Optional configuration with pre-populated valid tokens.
+     *   If omitted, starts with an empty token map.
+     */
+    constructor(config) {
+        super(config ?? {});
+        // Convert the plain object to a Map for O(1) lookups.
+        // Default to empty map if no tokens are configured.
+        this.tokens = new Map(Object.entries(config?.validTokens ?? {}));
+    }
+    // -----------------------------------------------------------------------
+    // Abstract Method Implementations
+    // -----------------------------------------------------------------------
+    /**
+     * Validate a token by looking it up in the pre-configured map.
+     *
+     * Returns the matching AuthResult if found, undefined otherwise.
+     * No crypto, no network — pure map lookup.
+     *
+     * @param token - Raw token string extracted from the request
+     * @returns AuthResult if the token is in the map, undefined otherwise
+     */
+    async validate(token) {
+        return this.tokens.get(token);
+    }
+    /**
+     * Health check — always returns true.
+     *
+     * The in-memory provider has no external dependencies and is always
+     * operational as long as the process is running.
+     *
+     * @returns Always true
+     */
+    async health() {
+        return true;
+    }
+    /**
+     * Graceful shutdown — clears all stored tokens.
+     *
+     * Releases the token map entries. After shutdown, all subsequent
+     * `validate()` calls will return undefined.
+     */
+    async shutdown() {
+        this.tokens.clear();
+    }
+    // -----------------------------------------------------------------------
+    // Test Helpers (not part of the abstract AuthProvider contract)
+    // -----------------------------------------------------------------------
+    /**
+     * Add a valid token at runtime.
+     *
+     * Useful in test setup to register tokens for specific test scenarios
+     * without needing to recreate the provider.
+     *
+     * @param token - The token string to register
+     * @param result - The AuthResult to return when this token is validated
+     */
+    addToken(token, result) {
+        this.tokens.set(token, result);
+    }
+    /**
+     * Remove a token at runtime.
+     *
+     * Useful in test teardown or to simulate token revocation scenarios.
+     *
+     * @param token - The token string to remove
+     * @returns true if the token existed and was removed, false otherwise
+     */
+    removeToken(token) {
+        return this.tokens.delete(token);
+    }
+    /**
+     * Get the number of currently registered tokens.
+     *
+     * Useful in test assertions to verify the token map state.
+     *
+     * @returns Number of valid tokens in the map
+     */
+    getTokenCount() {
+        return this.tokens.size;
+    }
+}
+//# sourceMappingURL=memory-auth-provider.js.map

package/dist/webafx-auth/memory-auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-auth-provider.js","sourceRoot":"","sources":["../src/memory-auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAChD,mEAAmE;IACzD,MAAM,CAA0B;IAE1C;;;;;OAKG;IACH,YAAY,MAAyB;QACjC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpB,sDAAsD;QACtD,oDAAoD;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,0EAA0E;IAC1E,kCAAkC;IAClC,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM;QACR,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACV,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,0EAA0E;IAC1E,gEAAgE;IAChE,0EAA0E;IAE1E;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAa,EAAE,MAAkB;QACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,KAAa;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,aAAa;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5B,CAAC;CACJ"}

package/dist/webafx-auth/types.d.ts

@@ -0,0 +1,333 @@
+/**
+ * Type definitions and constants for the @blendsdk/webafx-auth package.
+ *
+ * Defines configuration interfaces for all authentication providers
+ * (JWT, Introspection, OIDC, Tenant, Memory) and their environment-based
+ * factory. Constants provide sensible defaults for service naming and
+ * plugin priority.
+ *
+ * @packageDocumentation
+ */
+import type { Request } from "express";
+/**
+ * Result of successful authentication.
+ * Represents the validated identity extracted from a token.
+ *
+ * This is the value set on `req.services.set('user', authResult)` by the
+ * auth plugin middleware. Controllers access it via `req.services.getUser<AuthResult>()`.
+ */
+export interface AuthResult {
+    /** Unique subject identifier (user ID) */
+    sub: string;
+    /** All claims/attributes from the token or introspection response */
+    claims: Record<string, unknown>;
+    /** Original raw token string (useful for forwarding to downstream services) */
+    token: string;
+    /** Token expiration timestamp (seconds since epoch), if available */
+    exp?: number;
+    /** Scopes/permissions granted by the token */
+    scopes?: string[];
+    /** Tenant identifier (set by TenantAuthProvider) */
+    tenantId?: string;
+}
+/**
+ * Function that extracts a token string from an Express request.
+ *
+ * @param req - Express request object
+ * @returns The extracted token string, or undefined if not found
+ */
+export type TokenExtractor = (req: Request) => string | undefined;
+/**
+ * Where to look for tokens. Tried in order — first match wins.
+ *
+ * Built-in sources:
+ * - `'header'` — extracts from `Authorization: Bearer <token>`
+ * - `'cookie'` — extracts from configured cookie name
+ * - `'query'`  — extracts from configured query parameter
+ *
+ * Custom source:
+ * - `{ extractor: (req) => string | undefined }` — custom extraction function
+ */
+export type TokenSource = "header" | "cookie" | "query" | {
+    extractor: TokenExtractor;
+};
+/**
+ * Optional claims mapping function.
+ *
+ * Transforms raw provider-specific claims into the standardized AuthResult
+ * format. If not provided, the AuthProvider base class uses a default mapper
+ * that extracts `sub`, `exp`, and `scope` from the raw claims.
+ *
+ * @param token - The original raw token string
+ * @param rawClaims - The raw claims object from the token or introspection response
+ * @returns A fully-formed AuthResult
+ */
+export type ClaimsMapper = (token: string, rawClaims: Record<string, unknown>) => AuthResult;
+/**
+ * Base configuration shared by all auth providers.
+ *
+ * Every provider extends this with backend-specific options (secret, issuer,
+ * introspection URL, etc.). The base config covers token extraction and
+ * claims mapping — concerns shared by all providers.
+ */
+export interface AuthProviderConfig {
+    /**
+     * Service name for WebAFX service container registration.
+     * Default: `'auth'`. Use different names for multi-auth scenarios.
+     */
+    serviceName?: string;
+    /**
+     * Token extraction sources, tried in order. First match wins.
+     * Default: `['header']` (Authorization: Bearer)
+     */
+    tokenSources?: TokenSource[];
+    /**
+     * Cookie name for cookie-based token extraction.
+     * Only used when `'cookie'` is in `tokenSources`.
+     * Default: `'auth_token'`
+     */
+    cookieName?: string;
+    /**
+     * Query parameter name for query-based token extraction.
+     * Only used when `'query'` is in `tokenSources`.
+     * Default: `'token'`
+     */
+    queryParamName?: string;
+    /**
+     * Optional claims mapping function.
+     * Transforms raw token claims into the AuthResult format.
+     * If not provided, a default mapper extracts `sub`, `exp`, `scope`.
+     */
+    mapClaims?: ClaimsMapper;
+}
+/**
+ * Configuration for JwtAuthProvider.
+ *
+ * Validates self-issued JWTs locally using HMAC or RSA keys via the
+ * `oauth4webapi` library's `jwtVerify()`. No network calls needed.
+ */
+export interface JwtAuthConfig extends AuthProviderConfig {
+    /**
+     * Signing secret or public key for JWT verification.
+     * - `string` — HMAC secret (HS256/HS384/HS512)
+     * - `CryptoKey` — RSA/EC public key for RS256/ES256 etc.
+     */
+    secret: string | CryptoKey;
+    /**
+     * Allowed JWT algorithms.
+     * Default: `['HS256']` for string secrets, auto-detected for CryptoKey
+     */
+    algorithms?: string[];
+    /**
+     * Expected JWT issuer (`iss` claim). If set, tokens with a different
+     * issuer are rejected.
+     */
+    issuer?: string;
+    /**
+     * Expected JWT audience (`aud` claim). If set, tokens without a
+     * matching audience are rejected.
+     */
+    audience?: string | string[];
+    /**
+     * Clock tolerance in seconds for `exp`/`nbf` checks.
+     * Accounts for clock skew between servers. Default: 0
+     */
+    clockTolerance?: number;
+}
+/**
+ * Configuration for IntrospectionAuthProvider.
+ *
+ * Validates opaque tokens by calling an OAuth2 token introspection endpoint
+ * (RFC 7662). Includes a built-in response cache to avoid hammering the
+ * auth server on every request.
+ */
+export interface IntrospectionAuthConfig extends AuthProviderConfig {
+    /**
+     * URL of the OAuth2 introspection endpoint.
+     * Example: `'https://auth.example.com/oauth2/introspect'`
+     */
+    introspectionUrl: string;
+    /**
+     * Client ID for authenticating with the introspection endpoint.
+     * Used in HTTP Basic auth or as `client_id` form param.
+     */
+    clientId: string;
+    /**
+     * Client secret for authenticating with the introspection endpoint.
+     */
+    clientSecret: string;
+    /**
+     * Cache TTL in seconds for introspection responses.
+     * Prevents calling the auth server on every request.
+     * Default: 60 (1 minute)
+     */
+    cacheTTL?: number;
+    /**
+     * Maximum number of cached introspection responses.
+     * When exceeded, the least-recently-used entries are evicted.
+     * Default: 1000
+     */
+    maxCacheSize?: number;
+    /**
+     * HTTP request timeout in milliseconds.
+     * Default: 5000 (5 seconds)
+     */
+    timeout?: number;
+}
+/**
+ * Configuration for OidcAuthProvider.
+ *
+ * Validates JWTs using OIDC discovery and JWKS rotation via the
+ * `openid-client` library. Automatically discovers the OIDC provider's
+ * configuration and fetches the public key set on first use.
+ */
+export interface OidcAuthConfig extends AuthProviderConfig {
+    /**
+     * OIDC issuer URL (used for discovery).
+     * Example: `'https://accounts.google.com'`
+     *
+     * The provider appends `/.well-known/openid-configuration` automatically.
+     */
+    issuerUrl: string;
+    /**
+     * Expected client ID (used to verify the `aud` claim).
+     */
+    clientId: string;
+    /**
+     * Expected audience values beyond clientId.
+     * If set, the token's `aud` claim must include clientId or one of these.
+     */
+    audience?: string[];
+    /**
+     * Clock tolerance in seconds for `exp`/`nbf` checks. Default: 0
+     */
+    clockTolerance?: number;
+    /**
+     * HTTP request timeout in milliseconds for discovery and JWKS fetches.
+     * Default: 10000 (10 seconds)
+     */
+    timeout?: number;
+}
+/**
+ * Function that resolves a tenant identifier from a request.
+ *
+ * @param req - Express request object
+ * @returns The resolved tenant ID, or undefined if not determinable
+ */
+export type TenantResolver = (req: Request) => string | undefined;
+/**
+ * Factory function that creates an AuthProvider for a specific tenant.
+ *
+ * Called once per tenant and cached. The returned provider handles all
+ * authentication for that tenant.
+ *
+ * @param tenantId - The resolved tenant identifier
+ * @returns An AuthProvider instance configured for the tenant
+ */
+export type TenantProviderFactory = (tenantId: string) => Promise<AuthProviderLike>;
+/**
+ * Minimal interface that TenantAuthProvider delegates to.
+ *
+ * This avoids a circular dependency on the full AuthProvider class —
+ * any object with `validate()`, `health()`, and `shutdown()` qualifies.
+ * In practice, all concrete AuthProvider subclasses satisfy this.
+ */
+export interface AuthProviderLike {
+    /** Validate a token and return the authenticated identity */
+    validate(token: string): Promise<AuthResult | undefined>;
+    /** Health check for this provider */
+    health(): Promise<boolean>;
+    /** Graceful shutdown for this provider */
+    shutdown(): Promise<void>;
+}
+/**
+ * Configuration for TenantAuthProvider.
+ *
+ * Resolves a tenant from each request, then delegates authentication
+ * to a per-tenant provider. Providers are created lazily and cached
+ * with LRU eviction.
+ */
+export interface TenantAuthConfig extends AuthProviderConfig {
+    /**
+     * Function that resolves the tenant ID from each request.
+     * Use one of the built-in `tenantResolvers` or provide a custom function.
+     */
+    resolveTenant: TenantResolver;
+    /**
+     * Factory that creates an AuthProvider for a specific tenant.
+     * Called once per tenant and the result is cached.
+     */
+    createProvider: TenantProviderFactory;
+    /**
+     * Maximum number of cached tenant providers.
+     * When exceeded, the least-recently-used tenant provider is shut down
+     * and evicted. Default: 100
+     */
+    maxTenants?: number;
+}
+/**
+ * Configuration for MemoryAuthProvider.
+ *
+ * A testing-only provider with a pre-configured mapping of token → AuthResult.
+ * Use in integration tests with `memoryAuthPlugin()` to avoid real auth flows.
+ */
+export interface MemoryAuthConfig extends AuthProviderConfig {
+    /**
+     * Map of token strings to their corresponding auth results.
+     * When a token matches a key, the corresponding AuthResult is returned.
+     *
+     * @example
+     * ```typescript
+     * validTokens: {
+     *     'test-admin-token': { sub: 'admin-1', claims: { role: 'admin' }, token: 'test-admin-token' },
+     *     'test-user-token': { sub: 'user-1', claims: { role: 'user' }, token: 'test-user-token' },
+     * }
+     * ```
+     */
+    validTokens?: Record<string, AuthResult>;
+}
+/**
+ * Configuration for the `createAuthProvider()` environment-based factory.
+ *
+ * Determines which provider to create based on the `type` field.
+ * Provider-specific fields are only used when the matching type is selected.
+ */
+export interface AuthFactoryConfig extends AuthProviderConfig {
+    /** Auth provider backend type */
+    type: "jwt" | "introspection" | "oidc" | "memory";
+    /** JWT signing secret or public key */
+    secret?: string | CryptoKey;
+    /** Allowed JWT algorithms */
+    algorithms?: string[];
+    /** Expected issuer (JWT: iss claim, OIDC: discovery URL) */
+    issuer?: string;
+    /** OIDC issuer URL for discovery */
+    issuerUrl?: string;
+    /** Client ID (introspection, OIDC) */
+    clientId?: string;
+    /** Client secret (introspection) */
+    clientSecret?: string;
+    /** Expected audience (JWT, OIDC) */
+    audience?: string | string[];
+    /** Introspection endpoint URL */
+    introspectionUrl?: string;
+    /** Introspection cache TTL in seconds */
+    cacheTTL?: number;
+    /** Clock tolerance in seconds */
+    clockTolerance?: number;
+    /** HTTP timeout in milliseconds */
+    timeout?: number;
+    /** Pre-configured valid tokens for testing */
+    validTokens?: Record<string, AuthResult>;
+}
+/** Default service name for auth when not specified */
+export declare const DEFAULT_SERVICE_NAME = "auth";
+/** Default plugin priority — installs early (before feature plugins) */
+export declare const DEFAULT_PLUGIN_PRIORITY = 10;
+/** Default cookie name for cookie-based token extraction */
+export declare const DEFAULT_COOKIE_NAME = "auth_token";
+/** Default query parameter name for query-based token extraction */
+export declare const DEFAULT_QUERY_PARAM_NAME = "token";
+/** Default token sources — Authorization: Bearer header only */
+export declare const DEFAULT_TOKEN_SOURCES: TokenSource[];
+//# sourceMappingURL=types.d.ts.map

package/dist/webafx-auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACvB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IAEZ,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IAEd,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,MAAM,WAAW,GACjB,QAAQ,GACR,QAAQ,GACR,OAAO,GACP;IAAE,SAAS,EAAE,cAAc,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,CACvB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KACjC,UAAU,CAAC;AAMhB;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAE7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;OAIG;IACH,SAAS,CAAC,EAAE,YAAY,CAAC;CAC5B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACrD;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAE3B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IAC/D;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,kBAAkB;IACtD;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAChC,QAAQ,EAAE,MAAM,KACf,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAEzD,qCAAqC;IACrC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3B,0CAA0C;IAC1C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IACxD;;;OAGG;IACH,aAAa,EAAE,cAAc,CAAC;IAE9B;;;OAGG;IACH,cAAc,EAAE,qBAAqB,CAAC;IAEtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IACxD;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC5C;AAMD;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IACzD,iCAAiC;IACjC,IAAI,EAAE,KAAK,GAAG,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;IAIlD,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE5B,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAItB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,oCAAoC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAI7B,iCAAiC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CAC5C;AAMD,uDAAuD;AACvD,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,EAAE,WAAW,EAAe,CAAC"}

package/dist/webafx-auth/types.js

@@ -0,0 +1,24 @@
+/**
+ * Type definitions and constants for the @blendsdk/webafx-auth package.
+ *
+ * Defines configuration interfaces for all authentication providers
+ * (JWT, Introspection, OIDC, Tenant, Memory) and their environment-based
+ * factory. Constants provide sensible defaults for service naming and
+ * plugin priority.
+ *
+ * @packageDocumentation
+ */
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Default service name for auth when not specified */
+export const DEFAULT_SERVICE_NAME = "auth";
+/** Default plugin priority — installs early (before feature plugins) */
+export const DEFAULT_PLUGIN_PRIORITY = 10;
+/** Default cookie name for cookie-based token extraction */
+export const DEFAULT_COOKIE_NAME = "auth_token";
+/** Default query parameter name for query-based token extraction */
+export const DEFAULT_QUERY_PARAM_NAME = "token";
+/** Default token sources — Authorization: Bearer header only */
+export const DEFAULT_TOKEN_SOURCES = ["header"];
+//# sourceMappingURL=types.js.map

package/dist/webafx-auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAoaH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAkB,CAAC,QAAQ,CAAC,CAAC"}