canopycms 0.0.0

package/dist/auth/cache.js

@@ -0,0 +1,8 @@
+/**
+ * Server-only auth cache exports.
+ * These use node:fs/promises and must NOT be imported in client bundles.
+ * Use 'canopycms/auth/cache' as the import path.
+ */
+export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache';
+export { CachingAuthPlugin } from './caching-auth-plugin';
+//# sourceMappingURL=cache.js.map

package/dist/auth/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/auth/cache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/auth/caching-auth-plugin.d.ts

@@ -0,0 +1,42 @@
+import type { AuthPlugin } from './plugin';
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
+import type { CanopyUserId, CanopyGroupId } from '../types';
+/**
+ * Generic cache provider interface for auth metadata.
+ * Any auth system can implement its own cache backend
+ * (file-based, Redis, in-memory, etc.)
+ */
+export interface AuthCacheProvider {
+    getUser(userId: CanopyUserId): Promise<UserSearchResult | null>;
+    getGroup(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
+    getAllUsers(): Promise<UserSearchResult[]>;
+    getAllGroups(): Promise<GroupMetadata[]>;
+    getUserExternalGroups(userId: CanopyUserId): Promise<CanopyGroupId[]>;
+}
+/**
+ * Token verifier function type.
+ * Given a request context, extracts and verifies the auth token,
+ * returning the user ID on success.
+ */
+export type TokenVerifier = (context: unknown) => Promise<{
+    userId: CanopyUserId;
+} | null>;
+/**
+ * Auth plugin that wraps a token verifier with cached metadata lookups.
+ *
+ * Used in environments where the auth provider API is not reachable
+ * (e.g., Lambda with no internet). JWT verification is done locally,
+ * and user/group metadata comes from a cache populated externally
+ * (e.g., by an EC2 worker).
+ */
+export declare class CachingAuthPlugin implements AuthPlugin {
+    private readonly verifyToken;
+    private readonly cache;
+    constructor(verifyToken: TokenVerifier, cache: AuthCacheProvider);
+    authenticate(context: unknown): Promise<AuthenticationResult>;
+    searchUsers(query: string, limit?: number): Promise<UserSearchResult[]>;
+    getUserMetadata(userId: CanopyUserId): Promise<UserSearchResult | null>;
+    getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
+    listGroups(limit?: number): Promise<GroupMetadata[]>;
+}
+//# sourceMappingURL=caching-auth-plugin.d.ts.map

package/dist/auth/caching-auth-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caching-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAK3D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAC/D,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACxC,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;CACtE;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAAC,CAAA;AAE1F;;;;;;;GAOG;AACH,qBAAa,iBAAkB,YAAW,UAAU;IAEhD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,WAAW,EAAE,aAAa,EAC1B,KAAK,EAAE,iBAAiB;IAGrC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoC7D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAenE,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAIvE,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIvE,UAAU,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAQvD"}

package/dist/auth/caching-auth-plugin.js

@@ -0,0 +1,78 @@
+import { createDebugLogger } from '../utils/debug';
+const log = createDebugLogger({ prefix: 'CachingAuthPlugin' });
+/**
+ * Auth plugin that wraps a token verifier with cached metadata lookups.
+ *
+ * Used in environments where the auth provider API is not reachable
+ * (e.g., Lambda with no internet). JWT verification is done locally,
+ * and user/group metadata comes from a cache populated externally
+ * (e.g., by an EC2 worker).
+ */
+export class CachingAuthPlugin {
+    constructor(verifyToken, cache) {
+        this.verifyToken = verifyToken;
+        this.cache = cache;
+    }
+    async authenticate(context) {
+        const identity = await this.verifyToken(context);
+        if (!identity) {
+            return { success: false, error: 'No valid authentication token' };
+        }
+        try {
+            const user = await this.cache.getUser(identity.userId);
+            const externalGroups = await this.cache.getUserExternalGroups(identity.userId);
+            return {
+                success: true,
+                user: {
+                    userId: identity.userId,
+                    name: user?.name ?? identity.userId,
+                    email: user?.email,
+                    avatarUrl: user?.avatarUrl,
+                    externalGroups,
+                },
+            };
+        }
+        catch {
+            // Cache error — still return authenticated with minimal info
+            log.debug('auth', 'Cache lookup failed, returning minimal user', {
+                userId: identity.userId,
+            });
+            return {
+                success: true,
+                user: {
+                    userId: identity.userId,
+                    name: identity.userId,
+                    externalGroups: [],
+                },
+            };
+        }
+    }
+    async searchUsers(query, limit = 10) {
+        try {
+            const allUsers = await this.cache.getAllUsers();
+            const lowerQuery = query.toLowerCase();
+            return allUsers
+                .filter((u) => u.name.toLowerCase().includes(lowerQuery) || u.email.toLowerCase().includes(lowerQuery))
+                .slice(0, limit);
+        }
+        catch {
+            return [];
+        }
+    }
+    async getUserMetadata(userId) {
+        return this.cache.getUser(userId);
+    }
+    async getGroupMetadata(groupId) {
+        return this.cache.getGroup(groupId);
+    }
+    async listGroups(limit = 50) {
+        try {
+            const allGroups = await this.cache.getAllGroups();
+            return allGroups.slice(0, limit);
+        }
+        catch {
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=caching-auth-plugin.js.map

package/dist/auth/caching-auth-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caching-auth-plugin.js","sourceRoot":"","sources":["../../src/auth/caching-auth-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAsB9D;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAC5B,YACmB,WAA0B,EAC1B,KAAwB;QADxB,gBAAW,GAAX,WAAW,CAAe;QAC1B,UAAK,GAAL,KAAK,CAAmB;IACxC,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,OAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAA;QACnE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAE9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM;oBACnC,KAAK,EAAE,IAAI,EAAE,KAAK;oBAClB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,cAAc;iBACf;aACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,6CAA6C,EAAE;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAA;YACF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,QAAQ,CAAC,MAAM;oBACrB,cAAc,EAAE,EAAE;iBACnB;aACF,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QACzC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;YACtC,OAAO,QAAQ;iBACZ,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC1F;iBACA,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAoB;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAA;YACjD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;CACF"}

package/dist/auth/context-helpers.d.ts

@@ -0,0 +1,31 @@
+import type { CanopyRequest } from '../http/types';
+/**
+ * Headers-like interface for auth context.
+ * Framework-agnostic - matches Web Headers, Next.js Headers, and any similar interface.
+ */
+export interface HeadersLike {
+    get(name: string): string | null;
+}
+/**
+ * Type guard to check if context is a CanopyRequest.
+ * CanopyRequest has both 'header' method and 'method' property.
+ */
+export declare function isCanopyRequest(context: unknown): context is CanopyRequest;
+/**
+ * Type guard to check if context is a headers-like object.
+ * Headers have a 'get' method for retrieving header values.
+ */
+export declare function isHeadersLike(context: unknown): context is HeadersLike;
+/**
+ * Extract headers from various auth context types.
+ * Supports CanopyRequest (API routes) and any headers-like object (server components).
+ *
+ * @returns HeadersLike object or null if context type is unsupported
+ */
+export declare function extractHeaders(context: unknown): HeadersLike | null;
+/**
+ * Validate auth context and throw helpful error if unsupported.
+ * Use this in auth plugins to provide clear error messages.
+ */
+export declare function validateAuthContext(context: unknown): HeadersLike;
+//# sourceMappingURL=context-helpers.d.ts.map

package/dist/auth/context-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-helpers.d.ts","sourceRoot":"","sources":["../../src/auth/context-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CACjC;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,aAAa,CAQ1E;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,WAAW,CAOtE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAanE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,CAYjE"}

package/dist/auth/context-helpers.js

@@ -0,0 +1,53 @@
+/**
+ * Type guard to check if context is a CanopyRequest.
+ * CanopyRequest has both 'header' method and 'method' property.
+ */
+export function isCanopyRequest(context) {
+    return (typeof context === 'object' &&
+        context !== null &&
+        'header' in context &&
+        'method' in context &&
+        typeof context.header === 'function');
+}
+/**
+ * Type guard to check if context is a headers-like object.
+ * Headers have a 'get' method for retrieving header values.
+ */
+export function isHeadersLike(context) {
+    return (typeof context === 'object' &&
+        context !== null &&
+        'get' in context &&
+        typeof context.get === 'function');
+}
+/**
+ * Extract headers from various auth context types.
+ * Supports CanopyRequest (API routes) and any headers-like object (server components).
+ *
+ * @returns HeadersLike object or null if context type is unsupported
+ */
+export function extractHeaders(context) {
+    if (isCanopyRequest(context)) {
+        // Wrap CanopyRequest.header() as HeadersLike.get()
+        return {
+            get: (name) => context.header(name),
+        };
+    }
+    if (isHeadersLike(context)) {
+        return context;
+    }
+    return null;
+}
+/**
+ * Validate auth context and throw helpful error if unsupported.
+ * Use this in auth plugins to provide clear error messages.
+ */
+export function validateAuthContext(context) {
+    const headers = extractHeaders(context);
+    if (!headers) {
+        throw new Error('Invalid auth context: expected CanopyRequest or Headers object. ' +
+            'Received: ' +
+            (context === null ? 'null' : typeof context));
+    }
+    return headers;
+}
+//# sourceMappingURL=context-helpers.js.map

package/dist/auth/context-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-helpers.js","sourceRoot":"","sources":["../../src/auth/context-helpers.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,QAAQ,IAAI,OAAO;QACnB,QAAQ,IAAI,OAAO;QACnB,OAAQ,OAAmC,CAAC,MAAM,KAAK,UAAU,CAClE,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,KAAK,IAAI,OAAO;QAChB,OAAQ,OAAmC,CAAC,GAAG,KAAK,UAAU,CAC/D,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,mDAAmD;QACnD,OAAO;YACL,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;SAC5C,CAAA;IACH,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kEAAkE;YAChE,YAAY;YACZ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,CAC/C,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/auth/file-based-auth-cache.d.ts

@@ -0,0 +1,46 @@
+import type { AuthCacheProvider } from './caching-auth-plugin';
+import type { UserSearchResult, GroupMetadata } from './types';
+import type { CanopyUserId, CanopyGroupId } from '../types';
+/**
+ * File-based auth cache provider.
+ * Reads JSON files from a directory that is populated externally
+ * (e.g., by an EC2 worker running refreshClerkCache).
+ *
+ * Supports two directory layouts:
+ * - Snapshot layout: {cachePath}/current/ symlink → snapshot-{ts}/ directory
+ * - Flat layout: files directly in {cachePath}/
+ *
+ * Expects:
+ * - users.json   — { users: UserSearchResult[] }
+ * - orgs.json    — { groups: GroupMetadata[] }
+ * - memberships.json — { memberships: { [userId]: groupId[] } }
+ *
+ * Caches in memory and re-reads when file mtime changes.
+ */
+export declare class FileBasedAuthCache implements AuthCacheProvider {
+    private readonly cachePath;
+    private cache;
+    private lastMtime;
+    constructor(cachePath: string);
+    getUser(userId: CanopyUserId): Promise<UserSearchResult | null>;
+    getGroup(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
+    getAllUsers(): Promise<UserSearchResult[]>;
+    getAllGroups(): Promise<GroupMetadata[]>;
+    getUserExternalGroups(userId: CanopyUserId): Promise<CanopyGroupId[]>;
+    private ensureLoaded;
+    private loadFromDisk;
+    private readJsonFile;
+    private emptyCache;
+}
+/**
+ * Write auth cache files atomically using a snapshot directory and symlink swap.
+ *
+ * 1. Writes files to a timestamped snapshot directory: {cachePath}/snapshot-{ts}/
+ * 2. Creates a temporary symlink, then atomically renames it to {cachePath}/current
+ * 3. Cleans up old snapshot directories (keeps the 2 most recent)
+ *
+ * This ensures readers (FileBasedAuthCache) always see a consistent set of files:
+ * either the old snapshot or the new one, never a mix.
+ */
+export declare function writeAuthCacheSnapshot(cachePath: string, files: Record<string, unknown>): Promise<string>;
+//# sourceMappingURL=file-based-auth-cache.d.ts.map

package/dist/auth/file-based-auth-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-based-auth-cache.d.ts","sourceRoot":"","sources":["../../src/auth/file-based-auth-cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA6D3D;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,kBAAmB,YAAW,iBAAiB;IAI9C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAHtC,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,SAAS,CAAI;gBAEQ,SAAS,EAAE,MAAM;IAExC,OAAO,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAK/D,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAK/D,WAAW,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK1C,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAKxC,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;YAK7D,YAAY;YAqCZ,YAAY;YA4CZ,YAAY;IAU1B,OAAO,CAAC,UAAU;CASnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/auth/file-based-auth-cache.js

@@ -0,0 +1,226 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { createDebugLogger } from '../utils/debug';
+const log = createDebugLogger({ prefix: 'FileBasedAuthCache' });
+/**
+ * Resolve the active cache directory.
+ *
+ * Supports two layouts:
+ * 1. Snapshot layout (preferred): {cachePath}/current → {cachePath}/snapshot-{ts}/
+ *    The `current` symlink points to the active snapshot directory.
+ * 2. Flat layout (legacy/simple): files directly in {cachePath}/
+ *
+ * Returns the directory path where users.json, orgs.json, memberships.json live.
+ */
+async function resolveActiveCacheDir(cachePath) {
+    const currentLink = path.join(cachePath, 'current');
+    try {
+        const target = await fs.readlink(currentLink);
+        // Symlink target may be relative or absolute
+        const resolved = path.isAbsolute(target) ? target : path.resolve(cachePath, target);
+        // SECURITY: Validate that resolved target stays within the expected cache directory
+        const normalizedCache = path.resolve(cachePath);
+        const normalizedTarget = path.resolve(resolved);
+        if (!normalizedTarget.startsWith(normalizedCache + path.sep) &&
+            normalizedTarget !== normalizedCache) {
+            log.debug('cache', 'Symlink target escapes cache directory', {
+                cachePath: normalizedCache,
+                target: normalizedTarget,
+            });
+            return cachePath;
+        }
+        return resolved;
+    }
+    catch {
+        // No symlink — fall back to flat layout
+        return cachePath;
+    }
+}
+/**
+ * File-based auth cache provider.
+ * Reads JSON files from a directory that is populated externally
+ * (e.g., by an EC2 worker running refreshClerkCache).
+ *
+ * Supports two directory layouts:
+ * - Snapshot layout: {cachePath}/current/ symlink → snapshot-{ts}/ directory
+ * - Flat layout: files directly in {cachePath}/
+ *
+ * Expects:
+ * - users.json   — { users: UserSearchResult[] }
+ * - orgs.json    — { groups: GroupMetadata[] }
+ * - memberships.json — { memberships: { [userId]: groupId[] } }
+ *
+ * Caches in memory and re-reads when file mtime changes.
+ */
+export class FileBasedAuthCache {
+    constructor(cachePath) {
+        this.cachePath = cachePath;
+        this.cache = null;
+        this.lastMtime = 0;
+    }
+    async getUser(userId) {
+        const cache = await this.ensureLoaded();
+        return cache.users.get(userId) ?? null;
+    }
+    async getGroup(groupId) {
+        const cache = await this.ensureLoaded();
+        return cache.groups.get(groupId) ?? null;
+    }
+    async getAllUsers() {
+        const cache = await this.ensureLoaded();
+        return cache.allUsers;
+    }
+    async getAllGroups() {
+        const cache = await this.ensureLoaded();
+        return cache.allGroups;
+    }
+    async getUserExternalGroups(userId) {
+        const cache = await this.ensureLoaded();
+        return cache.memberships.get(userId) ?? [];
+    }
+    async ensureLoaded() {
+        const activeDir = await resolveActiveCacheDir(this.cachePath);
+        const usersPath = path.join(activeDir, 'users.json');
+        const orgsPath = path.join(activeDir, 'orgs.json');
+        const membershipsPath = path.join(activeDir, 'memberships.json');
+        // Check max mtime across all three files for cache freshness
+        let maxMtime = 0;
+        for (const filePath of [usersPath, orgsPath, membershipsPath]) {
+            try {
+                const stat = await fs.stat(filePath);
+                maxMtime = Math.max(maxMtime, stat.mtimeMs);
+            }
+            catch {
+                // File doesn't exist — continue checking others
+            }
+        }
+        if (maxMtime === 0) {
+            // No cache files exist — return empty cache
+            if (!this.cache) {
+                this.cache = this.emptyCache();
+            }
+            return this.cache;
+        }
+        // If max mtime hasn't changed and we have a cache, return it
+        if (this.cache && maxMtime === this.lastMtime) {
+            return this.cache;
+        }
+        // Load fresh data
+        this.cache = await this.loadFromDisk(activeDir);
+        this.lastMtime = maxMtime;
+        return this.cache;
+    }
+    async loadFromDisk(dir) {
+        const usersPath = path.join(dir, 'users.json');
+        const orgsPath = path.join(dir, 'orgs.json');
+        const membershipsPath = path.join(dir, 'memberships.json');
+        const [usersData, orgsData, membershipsData] = await Promise.all([
+            this.readJsonFile(usersPath, { users: [] }),
+            this.readJsonFile(orgsPath, { groups: [] }),
+            this.readJsonFile(membershipsPath, {
+                memberships: {},
+            }),
+        ]);
+        const users = new Map();
+        for (const user of usersData.users) {
+            users.set(user.id, user);
+        }
+        const groups = new Map();
+        for (const group of orgsData.groups) {
+            groups.set(group.id, group);
+        }
+        const memberships = new Map();
+        for (const [userId, groupIds] of Object.entries(membershipsData.memberships)) {
+            memberships.set(userId, groupIds);
+        }
+        log.debug('cache', 'Loaded auth cache', {
+            dir,
+            users: users.size,
+            groups: groups.size,
+            memberships: memberships.size,
+        });
+        return {
+            users,
+            groups,
+            memberships,
+            allUsers: usersData.users,
+            allGroups: orgsData.groups,
+        };
+    }
+    async readJsonFile(filePath, fallback) {
+        try {
+            const content = await fs.readFile(filePath, 'utf-8');
+            return JSON.parse(content);
+        }
+        catch {
+            log.debug('cache', 'Cache file not found or invalid', { path: filePath });
+            return fallback;
+        }
+    }
+    emptyCache() {
+        return {
+            users: new Map(),
+            groups: new Map(),
+            memberships: new Map(),
+            allUsers: [],
+            allGroups: [],
+        };
+    }
+}
+/**
+ * Write auth cache files atomically using a snapshot directory and symlink swap.
+ *
+ * 1. Writes files to a timestamped snapshot directory: {cachePath}/snapshot-{ts}/
+ * 2. Creates a temporary symlink, then atomically renames it to {cachePath}/current
+ * 3. Cleans up old snapshot directories (keeps the 2 most recent)
+ *
+ * This ensures readers (FileBasedAuthCache) always see a consistent set of files:
+ * either the old snapshot or the new one, never a mix.
+ */
+export async function writeAuthCacheSnapshot(cachePath, files) {
+    await fs.mkdir(cachePath, { recursive: true });
+    const timestamp = Date.now();
+    const snapshotDir = path.join(cachePath, `snapshot-${timestamp}`);
+    await fs.mkdir(snapshotDir, { recursive: true });
+    // Write all files to the snapshot directory
+    for (const [fileName, data] of Object.entries(files)) {
+        const tmpPath = path.join(snapshotDir, `${fileName}.tmp`);
+        const finalPath = path.join(snapshotDir, fileName);
+        await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), 'utf-8');
+        await fs.rename(tmpPath, finalPath);
+    }
+    // Atomic symlink swap: create temp symlink, rename over current
+    const currentLink = path.join(cachePath, 'current');
+    const tmpLink = path.join(cachePath, `current-${timestamp}`);
+    await fs.symlink(snapshotDir, tmpLink);
+    await fs.rename(tmpLink, currentLink);
+    // Clean up old snapshots (keep the 2 most recent)
+    await cleanupOldSnapshots(cachePath, 2);
+    return snapshotDir;
+}
+async function cleanupOldSnapshots(cachePath, keepCount) {
+    let entries;
+    try {
+        entries = await fs.readdir(cachePath);
+    }
+    catch {
+        return;
+    }
+    const snapshots = entries
+        .filter((e) => e.startsWith('snapshot-'))
+        .sort()
+        .reverse();
+    // Skip the most recent `keepCount` snapshots
+    for (const snapshot of snapshots.slice(keepCount)) {
+        try {
+            await fs.rm(path.join(cachePath, snapshot), {
+                recursive: true,
+                force: true,
+            });
+        }
+        catch {
+            // Best effort cleanup
+        }
+    }
+}
+//# sourceMappingURL=file-based-auth-cache.js.map

package/dist/auth/file-based-auth-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-based-auth-cache.js","sourceRoot":"","sources":["../../src/auth/file-based-auth-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAI5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAsB/D;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC7C,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACnF,oFAAoF;QACpF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/C,IACE,CAAC,gBAAgB,CAAC,UAAU,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC;YACxD,gBAAgB,KAAK,eAAe,EACpC,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,wCAAwC,EAAE;gBAC3D,SAAS,EAAE,eAAe;gBAC1B,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAA;YACF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;QACxC,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,kBAAkB;IAI7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;QAHtC,UAAK,GAAuB,IAAI,CAAA;QAChC,cAAS,GAAG,CAAC,CAAA;IAE4B,CAAC;IAElD,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAsB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,OAAO,KAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,OAAO,KAAK,CAAC,SAAS,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAoB;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;QACvC,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;QAEhE,6DAA6D;QAC7D,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,KAAK,MAAM,QAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACpC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,4CAA4C;YAC5C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;YAChC,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAA;QACnB,CAAC;QAED,6DAA6D;QAC7D,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC,KAAK,CAAA;QACnB,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;QAC/C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAW;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;QAE1D,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,IAAI,CAAC,YAAY,CAAc,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACxD,IAAI,CAAC,YAAY,CAAe,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzD,IAAI,CAAC,YAAY,CAAoB,eAAe,EAAE;gBACpD,WAAW,EAAE,EAAE;aAChB,CAAC;SACH,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAA;QACvD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAA;QACtD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC7B,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAA;QAC5D,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7E,WAAW,CAAC,GAAG,CAAC,MAAsB,EAAE,QAA2B,CAAC,CAAA;QACtE,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE;YACtC,GAAG;YACH,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,WAAW,EAAE,WAAW,CAAC,IAAI;SAC9B,CAAC,CAAA;QAEF,OAAO;YACL,KAAK;YACL,MAAM;YACN,WAAW;YACX,QAAQ,EAAE,SAAS,CAAC,KAAK;YACzB,SAAS,EAAE,QAAQ,CAAC,MAAM;SAC3B,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAI,QAAgB,EAAE,QAAW;QACzD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YACzE,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,OAAO;YACL,KAAK,EAAE,IAAI,GAAG,EAAE;YAChB,MAAM,EAAE,IAAI,GAAG,EAAE;YACjB,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,EAAE;SACd,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,KAA8B;IAE9B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAE9C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,SAAS,EAAE,CAAC,CAAA;IACjE,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEhD,4CAA4C;IAC5C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,MAAM,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAClD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,gEAAgE;IAChE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,SAAS,EAAE,CAAC,CAAA;IAC5D,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAErC,kDAAkD;IAClD,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAEvC,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,SAAiB;IACrE,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,OAAO;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;SACxC,IAAI,EAAE;SACN,OAAO,EAAE,CAAA;IAEZ,6CAA6C;IAC7C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,6 @@
+export type { AuthPlugin, AuthPluginFactory } from './plugin';
+export type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
+export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers';
+export type { HeadersLike } from './context-helpers';
+export type { AuthCacheProvider, TokenVerifier } from './caching-auth-plugin';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAC7D,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpD,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,2 @@
+export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,mBAAmB,CAAA"}

package/dist/auth/plugin.d.ts

@@ -0,0 +1,48 @@
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
+import type { CanopyUserId, CanopyGroupId } from '../types';
+/**
+ * Abstract auth provider interface.
+ * Implement this to integrate different auth systems (Clerk, Auth0, NextAuth, etc.)
+ */
+export interface AuthPlugin {
+    /**
+     * Authenticate user from request context.
+     * Returns user identity (without final groups) - core will apply bootstrap admins.
+     *
+     * @param context - Framework-specific context (CanopyRequest, headers, etc.)
+     * @returns AuthenticationResult with user identity or error
+     */
+    authenticate(context: unknown): Promise<AuthenticationResult>;
+    /**
+     * Search for users (for permission management UI)
+     * @param query - Search string (email, name, etc.)
+     * @param limit - Max results (default 10)
+     */
+    searchUsers(query: string, limit?: number): Promise<UserSearchResult[]>;
+    /**
+     * Get detailed user metadata by ID
+     */
+    getUserMetadata(userId: CanopyUserId): Promise<UserSearchResult | null>;
+    /**
+     * Get group/organization metadata by ID
+     */
+    getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
+    /**
+     * List all groups (for permission UI dropdowns)
+     */
+    listGroups(limit?: number): Promise<GroupMetadata[]>;
+    /**
+     * Search for external groups/organizations (for group management UI)
+     * Optional - only needed if auth provider supports external groups
+     * @param query - Search string (name, ID, etc.)
+     */
+    searchExternalGroups?(query: string): Promise<Array<{
+        id: CanopyGroupId;
+        name: string;
+    }>>;
+}
+/**
+ * Factory function type for creating auth plugins
+ */
+export type AuthPluginFactory<TConfig = unknown> = (config: TConfig) => AuthPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/auth/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE3D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAE7D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEvE;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IAEvE;;OAEG;IACH,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IAEpD;;;;OAIG;IACH,oBAAoB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAA;CAC1F;AAED;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAA"}

package/dist/auth/plugin.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=plugin.js.map

package/dist/auth/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":""}

package/dist/auth/types.d.ts

@@ -0,0 +1,36 @@
+import type { CanopyUserId, CanopyGroupId } from '../types';
+/**
+ * User search result for permission UI
+ */
+export interface UserSearchResult {
+    id: CanopyUserId;
+    name: string;
+    email: string;
+    avatarUrl?: string;
+}
+/**
+ * Group metadata for permission UI
+ */
+export interface GroupMetadata {
+    id: CanopyGroupId;
+    name: string;
+    description?: string;
+    memberCount?: number;
+}
+/**
+ * Authentication result from auth plugins.
+ * Returns user identity (without final groups) on success.
+ */
+export interface AuthenticationResult {
+    success: boolean;
+    user?: {
+        userId: CanopyUserId;
+        email?: string;
+        name?: string;
+        avatarUrl?: string;
+        /** Groups from external auth provider (e.g., Clerk organizations) */
+        externalGroups?: CanopyGroupId[];
+    };
+    error?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE3D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,YAAY,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,aAAa,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,YAAY,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,qEAAqE;QACrE,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;KACjC,CAAA;IACD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map