digitaltwin-core 0.14.2 → 1.0.0

package/dist/auth/auth_provider.d.ts

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Authentication provider interface and types for the Digital Twin framework.
+ *
+ * This module defines the contract for authentication providers, allowing the framework
+ * to support multiple authentication mechanisms (gateway headers, JWT tokens, etc.).
+ */
+import type { AuthenticatedUser } from './types.js';
+/**
+ * Authentication mode for the Digital Twin framework.
+ *
+ * - `gateway`: Parse authentication from gateway headers (x-user-id, x-user-roles)
+ * - `jwt`: Validate JWT tokens from Authorization header
+ * - `none`: Disable authentication (development/testing only)
+ */
+export type AuthMode = 'gateway' | 'jwt' | 'none';
+/**
+ * JWT-specific configuration options.
+ */
+export interface JwtConfig {
+    /** Secret key for HMAC algorithms (HS256, HS384, HS512) */
+    secret?: string;
+    /** Public key for RSA/EC algorithms (RS256, RS384, RS512, ES256, ES384, ES512) */
+    publicKey?: string;
+    /** JWT algorithm (default: 'HS256') */
+    algorithm?: string;
+    /** Expected token issuer for validation */
+    issuer?: string;
+    /** Expected token audience for validation */
+    audience?: string;
+    /** Claim name for user ID (default: 'sub') */
+    userIdClaim?: string;
+    /** Claim name for roles (default: 'roles', supports nested paths like 'realm_access.roles') */
+    rolesClaim?: string;
+}
+/**
+ * Authentication configuration for the Digital Twin framework.
+ */
+export interface AuthProviderConfig {
+    /** Authentication mode */
+    mode: AuthMode;
+    /** Name of the admin role (default: 'admin') */
+    adminRoleName?: string;
+    /** JWT-specific configuration (required when mode is 'jwt') */
+    jwt?: JwtConfig;
+    /** Anonymous user ID for 'none' mode (default: 'anonymous') */
+    anonymousUserId?: string;
+}
+/**
+ * Request-like object for authentication parsing.
+ *
+ * This interface allows the auth provider to work with any request object
+ * that has headers, without requiring a full Express Request.
+ */
+export interface AuthRequest {
+    /** Request headers */
+    headers: Record<string, string | string[] | undefined>;
+}
+/**
+ * Authentication provider interface.
+ *
+ * Implement this interface to create custom authentication mechanisms.
+ * The framework provides three built-in providers:
+ * - GatewayAuthProvider: For API gateway authentication (Apache APISIX, KrakenD)
+ * - JwtAuthProvider: For direct JWT token validation
+ * - NoAuthProvider: For development/testing without authentication
+ *
+ * @example
+ * ```typescript
+ * // Using the factory (recommended)
+ * const provider = AuthProviderFactory.fromEnv()
+ *
+ * // In a handler
+ * const user = provider.parseRequest(req)
+ * if (!user) {
+ *     return { status: 401, content: 'Authentication required' }
+ * }
+ * ```
+ */
+export interface AuthProvider {
+    /**
+     * Parse the request and return the authenticated user.
+     *
+     * @param req - Request object with headers
+     * @returns Authenticated user, or null if not authenticated or invalid
+     */
+    parseRequest(req: AuthRequest): AuthenticatedUser | null;
+    /**
+     * Check if the request has valid authentication.
+     *
+     * This is a quick check that can be used before full parsing.
+     *
+     * @param req - Request object with headers
+     * @returns true if the request has valid authentication credentials
+     */
+    hasValidAuth(req: AuthRequest): boolean;
+    /**
+     * Check if the authenticated user has admin privileges.
+     *
+     * @param req - Request object with headers
+     * @returns true if the user has the admin role
+     */
+    isAdmin(req: AuthRequest): boolean;
+    /**
+     * Get the user ID from the request.
+     *
+     * @param req - Request object with headers
+     * @returns User ID, or null if not authenticated
+     */
+    getUserId(req: AuthRequest): string | null;
+    /**
+     * Get the user roles from the request.
+     *
+     * @param req - Request object with headers
+     * @returns Array of role names, empty array if not authenticated
+     */
+    getUserRoles(req: AuthRequest): string[];
+}
+//# sourceMappingURL=auth_provider.d.ts.map

package/dist/auth/auth_provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_provider.d.ts","sourceRoot":"","sources":["../../src/auth/auth_provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEnD;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,CAAA;AAEjD;;GAEG;AACH,MAAM,WAAW,SAAS;IACtB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+FAA+F;IAC/F,UAAU,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,0BAA0B;IAC1B,IAAI,EAAE,QAAQ,CAAA;IACd,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;CACzD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,GAAG,IAAI,CAAA;IAExD;;;;;;;OAOG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAA;IAEvC;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAA;IAElC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAAA;IAE1C;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAAA;CAC3C"}

package/dist/auth/auth_provider.js

@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Authentication provider interface and types for the Digital Twin framework.
+ *
+ * This module defines the contract for authentication providers, allowing the framework
+ * to support multiple authentication mechanisms (gateway headers, JWT tokens, etc.).
+ */
+export {};
+//# sourceMappingURL=auth_provider.js.map

package/dist/auth/auth_provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_provider.js","sourceRoot":"","sources":["../../src/auth/auth_provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/auth/auth_provider_factory.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @fileoverview Factory for creating authentication providers.
+ *
+ * This module provides a factory for creating the appropriate authentication
+ * provider based on configuration or environment variables.
+ */
+import type { AuthProvider, AuthProviderConfig } from './auth_provider.js';
+/**
+ * Factory for creating authentication providers.
+ *
+ * Use this factory to create the appropriate authentication provider based on
+ * configuration or environment variables.
+ *
+ * @example
+ * ```typescript
+ * // Create from environment variables (recommended)
+ * const provider = AuthProviderFactory.fromEnv()
+ *
+ * // Create from explicit configuration
+ * const provider = AuthProviderFactory.create({
+ *     mode: 'jwt',
+ *     jwt: { secret: 'your-secret' }
+ * })
+ * ```
+ */
+export declare class AuthProviderFactory {
+    /**
+     * Create an authentication provider from explicit configuration.
+     *
+     * @param config - Authentication configuration
+     * @returns Configured authentication provider
+     * @throws Error if configuration is invalid
+     *
+     * @example
+     * ```typescript
+     * // Gateway mode (default)
+     * const provider = AuthProviderFactory.create({ mode: 'gateway' })
+     *
+     * // JWT mode
+     * const provider = AuthProviderFactory.create({
+     *     mode: 'jwt',
+     *     jwt: { secret: 'your-secret', algorithm: 'HS256' }
+     * })
+     *
+     * // No auth mode (development only)
+     * const provider = AuthProviderFactory.create({ mode: 'none' })
+     * ```
+     */
+    static create(config: AuthProviderConfig): AuthProvider;
+    /**
+     * Create an authentication provider from environment variables.
+     *
+     * Environment variables:
+     * - `AUTH_MODE`: Authentication mode ('gateway', 'jwt', 'none'). Default: 'gateway'
+     * - `AUTH_ADMIN_ROLE`: Name of admin role. Default: 'admin'
+     *
+     * For JWT mode:
+     * - `JWT_SECRET`: Secret key for HMAC algorithms
+     * - `JWT_PUBLIC_KEY`: Public key content for RSA/EC algorithms
+     * - `JWT_PUBLIC_KEY_FILE`: Path to public key file
+     * - `JWT_ALGORITHM`: Algorithm (default: 'HS256')
+     * - `JWT_ISSUER`: Expected token issuer
+     * - `JWT_AUDIENCE`: Expected token audience
+     * - `JWT_USER_ID_CLAIM`: Claim for user ID (default: 'sub')
+     * - `JWT_ROLES_CLAIM`: Claim for roles (default: 'roles')
+     *
+     * For no-auth mode:
+     * - `DIGITALTWIN_DISABLE_AUTH`: Set to 'true' to disable auth
+     * - `DIGITALTWIN_ANONYMOUS_USER_ID`: Anonymous user ID (default: 'anonymous')
+     *
+     * @returns Configured authentication provider
+     *
+     * @example
+     * ```typescript
+     * // Gateway mode (default, no env vars needed)
+     * // AUTH_MODE=gateway or not set
+     * const provider = AuthProviderFactory.fromEnv()
+     *
+     * // JWT mode
+     * // AUTH_MODE=jwt
+     * // JWT_SECRET=your-secret
+     * const provider = AuthProviderFactory.fromEnv()
+     *
+     * // Disable auth for development
+     * // DIGITALTWIN_DISABLE_AUTH=true
+     * const provider = AuthProviderFactory.fromEnv()
+     * ```
+     */
+    static fromEnv(): AuthProvider;
+}
+//# sourceMappingURL=auth_provider_factory.d.ts.map

package/dist/auth/auth_provider_factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_provider_factory.d.ts","sourceRoot":"","sources":["../../src/auth/auth_provider_factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAY,MAAM,oBAAoB,CAAA;AAKpF;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAmB;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY;IAgBvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,MAAM,CAAC,OAAO,IAAI,YAAY;CAkDjC"}

package/dist/auth/auth_provider_factory.js

@@ -0,0 +1,146 @@
+/**
+ * @fileoverview Factory for creating authentication providers.
+ *
+ * This module provides a factory for creating the appropriate authentication
+ * provider based on configuration or environment variables.
+ */
+import * as fs from 'fs';
+import { GatewayAuthProvider } from './providers/gateway_auth_provider.js';
+import { JwtAuthProvider } from './providers/jwt_auth_provider.js';
+import { NoAuthProvider } from './providers/no_auth_provider.js';
+/**
+ * Factory for creating authentication providers.
+ *
+ * Use this factory to create the appropriate authentication provider based on
+ * configuration or environment variables.
+ *
+ * @example
+ * ```typescript
+ * // Create from environment variables (recommended)
+ * const provider = AuthProviderFactory.fromEnv()
+ *
+ * // Create from explicit configuration
+ * const provider = AuthProviderFactory.create({
+ *     mode: 'jwt',
+ *     jwt: { secret: 'your-secret' }
+ * })
+ * ```
+ */
+export class AuthProviderFactory {
+    /**
+     * Create an authentication provider from explicit configuration.
+     *
+     * @param config - Authentication configuration
+     * @returns Configured authentication provider
+     * @throws Error if configuration is invalid
+     *
+     * @example
+     * ```typescript
+     * // Gateway mode (default)
+     * const provider = AuthProviderFactory.create({ mode: 'gateway' })
+     *
+     * // JWT mode
+     * const provider = AuthProviderFactory.create({
+     *     mode: 'jwt',
+     *     jwt: { secret: 'your-secret', algorithm: 'HS256' }
+     * })
+     *
+     * // No auth mode (development only)
+     * const provider = AuthProviderFactory.create({ mode: 'none' })
+     * ```
+     */
+    static create(config) {
+        switch (config.mode) {
+            case 'gateway':
+                return new GatewayAuthProvider(config.adminRoleName);
+            case 'jwt':
+                return new JwtAuthProvider(config);
+            case 'none':
+                return new NoAuthProvider(config.anonymousUserId);
+            default:
+                throw new Error(`Unknown auth mode: ${config.mode}`);
+        }
+    }
+    /**
+     * Create an authentication provider from environment variables.
+     *
+     * Environment variables:
+     * - `AUTH_MODE`: Authentication mode ('gateway', 'jwt', 'none'). Default: 'gateway'
+     * - `AUTH_ADMIN_ROLE`: Name of admin role. Default: 'admin'
+     *
+     * For JWT mode:
+     * - `JWT_SECRET`: Secret key for HMAC algorithms
+     * - `JWT_PUBLIC_KEY`: Public key content for RSA/EC algorithms
+     * - `JWT_PUBLIC_KEY_FILE`: Path to public key file
+     * - `JWT_ALGORITHM`: Algorithm (default: 'HS256')
+     * - `JWT_ISSUER`: Expected token issuer
+     * - `JWT_AUDIENCE`: Expected token audience
+     * - `JWT_USER_ID_CLAIM`: Claim for user ID (default: 'sub')
+     * - `JWT_ROLES_CLAIM`: Claim for roles (default: 'roles')
+     *
+     * For no-auth mode:
+     * - `DIGITALTWIN_DISABLE_AUTH`: Set to 'true' to disable auth
+     * - `DIGITALTWIN_ANONYMOUS_USER_ID`: Anonymous user ID (default: 'anonymous')
+     *
+     * @returns Configured authentication provider
+     *
+     * @example
+     * ```typescript
+     * // Gateway mode (default, no env vars needed)
+     * // AUTH_MODE=gateway or not set
+     * const provider = AuthProviderFactory.fromEnv()
+     *
+     * // JWT mode
+     * // AUTH_MODE=jwt
+     * // JWT_SECRET=your-secret
+     * const provider = AuthProviderFactory.fromEnv()
+     *
+     * // Disable auth for development
+     * // DIGITALTWIN_DISABLE_AUTH=true
+     * const provider = AuthProviderFactory.fromEnv()
+     * ```
+     */
+    static fromEnv() {
+        const adminRoleName = process.env.AUTH_ADMIN_ROLE || process.env.DIGITALTWIN_ADMIN_ROLE_NAME || 'admin';
+        // Check if auth is disabled (legacy env var)
+        if (process.env.DIGITALTWIN_DISABLE_AUTH === 'true') {
+            return new NoAuthProvider(process.env.DIGITALTWIN_ANONYMOUS_USER_ID || 'anonymous');
+        }
+        const mode = (process.env.AUTH_MODE || 'gateway');
+        if (mode === 'none') {
+            return new NoAuthProvider(process.env.DIGITALTWIN_ANONYMOUS_USER_ID || 'anonymous');
+        }
+        if (mode === 'gateway') {
+            return new GatewayAuthProvider(adminRoleName);
+        }
+        if (mode === 'jwt') {
+            // Load public key from file if specified
+            let publicKey;
+            if (process.env.JWT_PUBLIC_KEY_FILE) {
+                publicKey = fs.readFileSync(process.env.JWT_PUBLIC_KEY_FILE, 'utf-8');
+            }
+            else if (process.env.JWT_PUBLIC_KEY) {
+                publicKey = process.env.JWT_PUBLIC_KEY;
+            }
+            const secret = process.env.JWT_SECRET;
+            if (!secret && !publicKey) {
+                throw new Error('JWT mode requires either JWT_SECRET or JWT_PUBLIC_KEY/JWT_PUBLIC_KEY_FILE');
+            }
+            return new JwtAuthProvider({
+                mode: 'jwt',
+                adminRoleName,
+                jwt: {
+                    secret,
+                    publicKey,
+                    algorithm: process.env.JWT_ALGORITHM || 'HS256',
+                    issuer: process.env.JWT_ISSUER,
+                    audience: process.env.JWT_AUDIENCE,
+                    userIdClaim: process.env.JWT_USER_ID_CLAIM || 'sub',
+                    rolesClaim: process.env.JWT_ROLES_CLAIM || 'roles'
+                }
+            });
+        }
+        throw new Error(`Unknown AUTH_MODE: ${mode}`);
+    }
+}
+//# sourceMappingURL=auth_provider_factory.js.map

package/dist/auth/auth_provider_factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_provider_factory.js","sourceRoot":"","sources":["../../src/auth/auth_provider_factory.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAEhE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,MAAM,CAAC,MAA0B;QACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,SAAS;gBACV,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YAExD,KAAK,KAAK;gBACN,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;YAEtC,KAAK,MAAM;gBACP,OAAO,IAAI,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YAErD;gBACI,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,MAAM,CAAC,OAAO;QACV,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,OAAO,CAAA;QAEvG,6CAA6C;QAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,WAAW,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,CAAa,CAAA;QAE7D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAClB,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,WAAW,CAAC,CAAA;QACvF,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACjB,yCAAyC;YACzC,IAAI,SAA6B,CAAA;YACjC,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;gBAClC,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAA;YACzE,CAAC;iBAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;gBACpC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;YAC1C,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAA;YAErC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;YAChG,CAAC;YAED,OAAO,IAAI,eAAe,CAAC;gBACvB,IAAI,EAAE,KAAK;gBACX,aAAa;gBACb,GAAG,EAAE;oBACD,MAAM;oBACN,SAAS;oBACT,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;oBAC/C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;oBAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY;oBAClC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,KAAK;oBACnD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO;iBACrD;aACJ,CAAC,CAAA;QACN,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;CACJ"}

package/dist/auth/index.d.ts

@@ -0,0 +1,8 @@
+export type { AuthProvider, AuthRequest, AuthMode, AuthProviderConfig, JwtConfig } from './auth_provider.js';
+export { AuthProviderFactory } from './auth_provider_factory.js';
+export { GatewayAuthProvider, JwtAuthProvider, NoAuthProvider } from './providers/index.js';
+export { ApisixAuthParser } from './apisix_parser.js';
+export { UserService } from './user_service.js';
+export { AuthConfig } from './auth_config.js';
+export type { AuthenticatedUser, UserRecord, AuthContext, AuthenticatedRequest } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAG3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,7 @@
+export { AuthProviderFactory } from './auth_provider_factory.js';
+export { GatewayAuthProvider, JwtAuthProvider, NoAuthProvider } from './providers/index.js';
+// Backward-compatible API
+export { ApisixAuthParser } from './apisix_parser.js';
+export { UserService } from './user_service.js';
+export { AuthConfig } from './auth_config.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE3F,0BAA0B;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/auth/providers/gateway_auth_provider.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview Gateway authentication provider for API Gateway authentication.
+ *
+ * This provider parses authentication information from HTTP headers set by an API gateway
+ * (such as Apache APISIX or KrakenD) after validating JWT tokens with an identity provider.
+ *
+ * Expected headers:
+ * - `x-user-id`: User identifier (UUID from Keycloak)
+ * - `x-user-roles`: Comma-separated list of user roles
+ */
+import type { AuthProvider, AuthRequest } from '../auth_provider.js';
+import type { AuthenticatedUser } from '../types.js';
+/**
+ * Authentication provider for API Gateway authentication.
+ *
+ * This is the default authentication mode for Digital Twin applications deployed
+ * behind an API gateway like Apache APISIX or KrakenD.
+ *
+ * @example
+ * ```typescript
+ * const provider = new GatewayAuthProvider('admin')
+ *
+ * // In a handler
+ * const user = provider.parseRequest(req)
+ * if (!user) {
+ *     return { status: 401, content: 'Authentication required' }
+ * }
+ *
+ * if (provider.isAdmin(req)) {
+ *     // Admin-only logic
+ * }
+ * ```
+ */
+export declare class GatewayAuthProvider implements AuthProvider {
+    #private;
+    /**
+     * Creates a new GatewayAuthProvider.
+     *
+     * @param adminRoleName - Name of the admin role (default: 'admin')
+     */
+    constructor(adminRoleName?: string);
+    /**
+     * Parse the request headers and return the authenticated user.
+     *
+     * @param req - Request object with headers
+     * @returns Authenticated user, or null if x-user-id header is missing
+     */
+    parseRequest(req: AuthRequest): AuthenticatedUser | null;
+    /**
+     * Check if the request has the x-user-id header.
+     *
+     * @param req - Request object with headers
+     * @returns true if x-user-id header is present
+     */
+    hasValidAuth(req: AuthRequest): boolean;
+    /**
+     * Check if the user has the admin role.
+     *
+     * @param req - Request object with headers
+     * @returns true if x-user-roles contains the admin role
+     */
+    isAdmin(req: AuthRequest): boolean;
+    /**
+     * Get the user ID from the x-user-id header.
+     *
+     * @param req - Request object with headers
+     * @returns User ID, or null if header is missing
+     */
+    getUserId(req: AuthRequest): string | null;
+    /**
+     * Get the user roles from the x-user-roles header.
+     *
+     * @param req - Request object with headers
+     * @returns Array of role names, empty array if header is missing
+     */
+    getUserRoles(req: AuthRequest): string[];
+}
+//# sourceMappingURL=gateway_auth_provider.d.ts.map

package/dist/auth/providers/gateway_auth_provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway_auth_provider.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/gateway_auth_provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,mBAAoB,YAAW,YAAY;;IAGpD;;;;OAIG;gBACS,aAAa,SAAU;IAInC;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,GAAG,IAAI;IASxD;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO;IAIvC;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO;IAKlC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI;IAI1C;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE;CAkB3C"}

package/dist/auth/providers/gateway_auth_provider.js

@@ -0,0 +1,109 @@
+/**
+ * @fileoverview Gateway authentication provider for API Gateway authentication.
+ *
+ * This provider parses authentication information from HTTP headers set by an API gateway
+ * (such as Apache APISIX or KrakenD) after validating JWT tokens with an identity provider.
+ *
+ * Expected headers:
+ * - `x-user-id`: User identifier (UUID from Keycloak)
+ * - `x-user-roles`: Comma-separated list of user roles
+ */
+/**
+ * Authentication provider for API Gateway authentication.
+ *
+ * This is the default authentication mode for Digital Twin applications deployed
+ * behind an API gateway like Apache APISIX or KrakenD.
+ *
+ * @example
+ * ```typescript
+ * const provider = new GatewayAuthProvider('admin')
+ *
+ * // In a handler
+ * const user = provider.parseRequest(req)
+ * if (!user) {
+ *     return { status: 401, content: 'Authentication required' }
+ * }
+ *
+ * if (provider.isAdmin(req)) {
+ *     // Admin-only logic
+ * }
+ * ```
+ */
+export class GatewayAuthProvider {
+    #adminRoleName;
+    /**
+     * Creates a new GatewayAuthProvider.
+     *
+     * @param adminRoleName - Name of the admin role (default: 'admin')
+     */
+    constructor(adminRoleName = 'admin') {
+        this.#adminRoleName = adminRoleName;
+    }
+    /**
+     * Parse the request headers and return the authenticated user.
+     *
+     * @param req - Request object with headers
+     * @returns Authenticated user, or null if x-user-id header is missing
+     */
+    parseRequest(req) {
+        const userId = this.#getHeader(req.headers, 'x-user-id');
+        if (!userId)
+            return null;
+        const roles = this.getUserRoles(req);
+        return { id: userId, roles };
+    }
+    /**
+     * Check if the request has the x-user-id header.
+     *
+     * @param req - Request object with headers
+     * @returns true if x-user-id header is present
+     */
+    hasValidAuth(req) {
+        return !!this.#getHeader(req.headers, 'x-user-id');
+    }
+    /**
+     * Check if the user has the admin role.
+     *
+     * @param req - Request object with headers
+     * @returns true if x-user-roles contains the admin role
+     */
+    isAdmin(req) {
+        const roles = this.getUserRoles(req);
+        return roles.includes(this.#adminRoleName);
+    }
+    /**
+     * Get the user ID from the x-user-id header.
+     *
+     * @param req - Request object with headers
+     * @returns User ID, or null if header is missing
+     */
+    getUserId(req) {
+        return this.#getHeader(req.headers, 'x-user-id');
+    }
+    /**
+     * Get the user roles from the x-user-roles header.
+     *
+     * @param req - Request object with headers
+     * @returns Array of role names, empty array if header is missing
+     */
+    getUserRoles(req) {
+        const rolesHeader = this.#getHeader(req.headers, 'x-user-roles');
+        if (!rolesHeader)
+            return [];
+        return rolesHeader
+            .split(',')
+            .map(r => r.trim())
+            .filter(Boolean);
+    }
+    /**
+     * Get a header value as a string.
+     * Handles both string and string[] header values.
+     */
+    #getHeader(headers, name) {
+        const value = headers[name];
+        if (!value)
+            return null;
+        return Array.isArray(value) ? value[0] : value;
+    }
+}
+//# sourceMappingURL=gateway_auth_provider.js.map

package/dist/auth/providers/gateway_auth_provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway_auth_provider.js","sourceRoot":"","sources":["../../../src/auth/providers/gateway_auth_provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,mBAAmB;IACnB,cAAc,CAAQ;IAE/B;;;;OAIG;IACH,YAAY,aAAa,GAAG,OAAO;QAC/B,IAAI,CAAC,cAAc,GAAG,aAAa,CAAA;IACvC,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,GAAgB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAEpC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,GAAgB;QACzB,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACtD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,GAAgB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,GAAgB;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACpD,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,GAAgB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAChE,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAA;QAC3B,OAAO,WAAW;aACb,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAClB,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,OAAsD,EAAE,IAAY;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,CAAC;CACJ"}

package/dist/auth/providers/index.d.ts

@@ -0,0 +1,4 @@
+export { GatewayAuthProvider } from './gateway_auth_provider.js';
+export { JwtAuthProvider } from './jwt_auth_provider.js';
+export { NoAuthProvider } from './no_auth_provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/auth/providers/index.js

@@ -0,0 +1,4 @@
+export { GatewayAuthProvider } from './gateway_auth_provider.js';
+export { JwtAuthProvider } from './jwt_auth_provider.js';
+export { NoAuthProvider } from './no_auth_provider.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA"}