dominus-sdk-nodejs 1.1.7 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,237 @@
1
+ /**
2
+ * Internal cache with automatic encryption and circuit breaker.
3
+ *
4
+ * NOT exposed to SDK users - internal use only.
5
+ */
6
+ import crypto from 'crypto';
7
+ /**
8
+ * Circuit breaker states.
9
+ */
10
+ var CircuitState;
11
+ (function (CircuitState) {
12
+ CircuitState["CLOSED"] = "closed";
13
+ CircuitState["OPEN"] = "open";
14
+ CircuitState["HALF_OPEN"] = "half_open";
15
+ })(CircuitState || (CircuitState = {}));
16
+ /**
17
+ * Simple circuit breaker to prevent runaway retries.
18
+ *
19
+ * States:
20
+ * - CLOSED: Normal operation, requests pass through
21
+ * - OPEN: Too many failures, requests blocked
22
+ * - HALF_OPEN: Testing if service recovered
23
+ *
24
+ * Prevents CPU/quota exhaustion from retry storms.
25
+ */
26
+ export class CircuitBreaker {
27
+ failureThreshold;
28
+ recoveryTimeout;
29
+ halfOpenMaxCalls;
30
+ failureCount = 0;
31
+ state = CircuitState.CLOSED;
32
+ lastFailureTime = 0;
33
+ halfOpenCalls = 0;
34
+ constructor(failureThreshold = 5, recoveryTimeout = 30000, // 30 seconds in ms
35
+ halfOpenMaxCalls = 1) {
36
+ this.failureThreshold = failureThreshold;
37
+ this.recoveryTimeout = recoveryTimeout;
38
+ this.halfOpenMaxCalls = halfOpenMaxCalls;
39
+ }
40
+ /**
41
+ * Get current state, transitioning OPEN→HALF_OPEN if timeout elapsed.
42
+ */
43
+ getState() {
44
+ if (this.state === CircuitState.OPEN) {
45
+ if (Date.now() - this.lastFailureTime >= this.recoveryTimeout) {
46
+ this.state = CircuitState.HALF_OPEN;
47
+ this.halfOpenCalls = 0;
48
+ }
49
+ }
50
+ return this.state;
51
+ }
52
+ /**
53
+ * Check if a request can be executed.
54
+ */
55
+ canExecute() {
56
+ const state = this.getState();
57
+ if (state === CircuitState.CLOSED) {
58
+ return true;
59
+ }
60
+ if (state === CircuitState.HALF_OPEN) {
61
+ return this.halfOpenCalls < this.halfOpenMaxCalls;
62
+ }
63
+ return false; // OPEN
64
+ }
65
+ /**
66
+ * Record a successful call.
67
+ */
68
+ recordSuccess() {
69
+ if (this.state === CircuitState.HALF_OPEN) {
70
+ this.state = CircuitState.CLOSED;
71
+ }
72
+ this.failureCount = 0;
73
+ this.halfOpenCalls = 0;
74
+ }
75
+ /**
76
+ * Record a failed call.
77
+ */
78
+ recordFailure() {
79
+ this.failureCount++;
80
+ this.lastFailureTime = Date.now();
81
+ if (this.state === CircuitState.HALF_OPEN) {
82
+ // Failed during recovery test, go back to OPEN
83
+ this.state = CircuitState.OPEN;
84
+ }
85
+ else if (this.failureCount >= this.failureThreshold) {
86
+ this.state = CircuitState.OPEN;
87
+ }
88
+ }
89
+ /**
90
+ * Record a call attempt in HALF_OPEN state.
91
+ */
92
+ recordHalfOpenCall() {
93
+ this.halfOpenCalls++;
94
+ }
95
+ /**
96
+ * Reset the circuit breaker.
97
+ */
98
+ reset() {
99
+ this.failureCount = 0;
100
+ this.state = CircuitState.CLOSED;
101
+ this.lastFailureTime = 0;
102
+ this.halfOpenCalls = 0;
103
+ }
104
+ }
105
+ /**
106
+ * Calculate backoff delay with jitter to prevent thundering herd.
107
+ *
108
+ * @param attempt - Zero-based attempt number
109
+ * @param baseDelay - Base delay in milliseconds
110
+ * @param maxDelay - Maximum delay cap
111
+ * @param jitter - Jitter factor (0-1), adds randomness
112
+ * @returns Delay in milliseconds
113
+ */
114
+ export function exponentialBackoffWithJitter(attempt, baseDelay = 1000, maxDelay = 30000, jitter = 0.5) {
115
+ const delay = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
116
+ const jitterRange = delay * jitter;
117
+ return delay + (Math.random() * 2 - 1) * jitterRange;
118
+ }
119
+ /**
120
+ * Internal process-local cache with auto-encryption.
121
+ *
122
+ * Used by dominus services only:
123
+ * - Validation state
124
+ * - Service URLs
125
+ * - API responses
126
+ *
127
+ * NOT accessible by SDK users.
128
+ */
129
+ export class DominusCache {
130
+ defaultTtl;
131
+ store = new Map();
132
+ cipher = null;
133
+ constructor(defaultTtl = 300000) {
134
+ this.defaultTtl = defaultTtl;
135
+ } // 5 minutes in ms
136
+ /**
137
+ * Initialize encryption using auth token.
138
+ */
139
+ setEncryptionKey(token) {
140
+ if (!token)
141
+ return;
142
+ const key = crypto.createHash('sha256').update(token).digest();
143
+ this.cipher = { key, algorithm: 'aes-256-gcm' };
144
+ }
145
+ /**
146
+ * Get and decrypt, refresh TTL.
147
+ */
148
+ get(key) {
149
+ const entry = this.store.get(key);
150
+ if (!entry)
151
+ return null;
152
+ // Check expiry
153
+ if (Date.now() >= entry.expiresAt) {
154
+ this.store.delete(key);
155
+ return null;
156
+ }
157
+ try {
158
+ let value;
159
+ if (this.cipher) {
160
+ // Decrypt
161
+ const iv = entry.encryptedValue.subarray(0, 16);
162
+ const authTag = entry.encryptedValue.subarray(16, 32);
163
+ const encrypted = entry.encryptedValue.subarray(32);
164
+ const decipher = crypto.createDecipheriv(this.cipher.algorithm, this.cipher.key, iv);
165
+ decipher.setAuthTag(authTag);
166
+ const decrypted = Buffer.concat([
167
+ decipher.update(encrypted),
168
+ decipher.final(),
169
+ ]);
170
+ value = JSON.parse(decrypted.toString('utf8'));
171
+ }
172
+ else {
173
+ value = JSON.parse(entry.encryptedValue.toString('utf8'));
174
+ }
175
+ // Touch TTL
176
+ entry.expiresAt = Date.now() + this.defaultTtl;
177
+ return value;
178
+ }
179
+ catch {
180
+ this.store.delete(key);
181
+ return null;
182
+ }
183
+ }
184
+ /**
185
+ * Encrypt and store.
186
+ */
187
+ set(key, value, ttl) {
188
+ const duration = ttl ?? this.defaultTtl;
189
+ const plaintext = JSON.stringify(value);
190
+ let encryptedValue;
191
+ if (this.cipher) {
192
+ const iv = crypto.randomBytes(16);
193
+ const cipher = crypto.createCipheriv(this.cipher.algorithm, this.cipher.key, iv);
194
+ const encrypted = Buffer.concat([
195
+ cipher.update(plaintext, 'utf8'),
196
+ cipher.final(),
197
+ ]);
198
+ const authTag = cipher.getAuthTag();
199
+ encryptedValue = Buffer.concat([iv, authTag, encrypted]);
200
+ }
201
+ else {
202
+ encryptedValue = Buffer.from(plaintext, 'utf8');
203
+ }
204
+ this.store.set(key, {
205
+ encryptedValue,
206
+ expiresAt: Date.now() + duration,
207
+ });
208
+ }
209
+ /**
210
+ * Delete key.
211
+ */
212
+ delete(key) {
213
+ return this.store.delete(key);
214
+ }
215
+ /**
216
+ * Clear all.
217
+ */
218
+ clear() {
219
+ const count = this.store.size;
220
+ this.store.clear();
221
+ return count;
222
+ }
223
+ /**
224
+ * Get cache size.
225
+ */
226
+ size() {
227
+ return this.store.size;
228
+ }
229
+ }
230
+ // Internal singletons - NOT exported to users
231
+ export const dominusCache = new DominusCache(300000); // 5 minutes
232
+ // Circuit breakers for different services (prevents retry storms)
233
+ export const orchestratorCircuitBreaker = new CircuitBreaker(5, // Open after 5 consecutive failures
234
+ 30000, // Try again after 30 seconds
235
+ 1 // Allow 1 test call in half-open state
236
+ );
237
+ //# sourceMappingURL=cache.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/lib/cache.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;GAEG;AACH,IAAK,YAIJ;AAJD,WAAK,YAAY;IACf,iCAAiB,CAAA;IACjB,6BAAa,CAAA;IACb,uCAAuB,CAAA;AACzB,CAAC,EAJI,YAAY,KAAZ,YAAY,QAIhB;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IAOf;IACA;IACA;IARF,YAAY,GAAG,CAAC,CAAC;IACjB,KAAK,GAAiB,YAAY,CAAC,MAAM,CAAC;IAC1C,eAAe,GAAG,CAAC,CAAC;IACpB,aAAa,GAAG,CAAC,CAAC;IAE1B,YACU,mBAAmB,CAAC,EACpB,kBAAkB,KAAK,EAAE,mBAAmB;IAC5C,mBAAmB,CAAC;QAFpB,qBAAgB,GAAhB,gBAAgB,CAAI;QACpB,oBAAe,GAAf,eAAe,CAAQ;QACvB,qBAAgB,GAAhB,gBAAgB,CAAI;IAC3B,CAAC;IAEJ;;OAEG;IACH,QAAQ;QACN,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC;gBACpC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,OAAO;IACvB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAElC,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1C,+CAA+C;YAC/C,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC;QACjC,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC;QACjC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,SAAS,GAAG,IAAI,EAChB,QAAQ,GAAG,KAAK,EAChB,MAAM,GAAG,GAAG;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC;AACvD,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,OAAO,YAAY;IAIH;IAHZ,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,MAAM,GAA8C,IAAI,CAAC;IAEjE,YAAoB,aAAa,MAAM;QAAnB,eAAU,GAAV,UAAU,CAAS;IAAG,CAAC,CAAC,kBAAkB;IAE9D;;OAEG;IACH,gBAAgB,CAAC,KAAa;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,GAAG,CAAc,GAAW;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,eAAe;QACf,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,IAAI,KAAQ,CAAC;YAEb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,UAAU;gBACV,MAAM,EAAE,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtD,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAEpD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,EAAE,CACmB,CAAC;gBACxB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;oBAC9B,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;oBAC1B,QAAQ,CAAC,KAAK,EAAE;iBACjB,CAAC,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,YAAY;YACZ,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,GAAG,CAAc,GAAW,EAAE,KAAQ,EAAE,GAAY;QAClD,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAExC,IAAI,cAAsB,CAAC;QAE3B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAClC,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,MAAM,CAAC,GAAG,EACf,EAAE,CACiB,CAAC;YAEtB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAEpC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;YAClB,cAAc;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;AAElE,kEAAkE;AAClE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,cAAc,CAC1D,CAAC,EAAM,oCAAoC;AAC3C,KAAK,EAAE,6BAA6B;AACpC,CAAC,CAAM,uCAAuC;CAC/C,CAAC"}
@@ -0,0 +1,70 @@
1
+ /**
2
+ * Cryptographic helpers for password and PSK hashing.
3
+ *
4
+ * All hashing is done client-side (in SDK) before sending to Orchestrator.
5
+ * This ensures passwords/PSKs are never transmitted in plaintext.
6
+ */
7
+ /**
8
+ * Hash a password using bcrypt.
9
+ *
10
+ * @param password - Raw password string
11
+ * @returns Bcrypt hash string (includes salt)
12
+ */
13
+ export declare function hashPassword(password: string): string;
14
+ /**
15
+ * Verify a password against a bcrypt hash locally.
16
+ *
17
+ * This is primarily for testing. In production, verification
18
+ * happens via the orchestrator's verify endpoints.
19
+ *
20
+ * @param password - Raw password to verify
21
+ * @param passwordHash - Bcrypt hash to compare against
22
+ * @returns True if password matches hash
23
+ */
24
+ export declare function verifyPasswordLocal(password: string, passwordHash: string): boolean;
25
+ /**
26
+ * Hash a PSK (Pre-Shared Key) using bcrypt.
27
+ *
28
+ * @param psk - Raw PSK string
29
+ * @returns Bcrypt hash string (includes salt)
30
+ */
31
+ export declare function hashPsk(psk: string): string;
32
+ /**
33
+ * Verify a PSK against a bcrypt hash locally.
34
+ *
35
+ * This is primarily for testing. In production, verification
36
+ * happens via the orchestrator's verify endpoints.
37
+ *
38
+ * @param psk - Raw PSK to verify
39
+ * @param pskHash - Bcrypt hash to compare against
40
+ * @returns True if PSK matches hash
41
+ */
42
+ export declare function verifyPskLocal(psk: string, pskHash: string): boolean;
43
+ /**
44
+ * Generate a random PSK locally.
45
+ *
46
+ * Note: In production, prefer using the orchestrator's PSK generation
47
+ * for centralized PSK management. This is a fallback.
48
+ *
49
+ * @param length - Length of PSK to generate (default: 32)
50
+ * @returns Random PSK string
51
+ */
52
+ export declare function generatePskLocal(length?: number): string;
53
+ /**
54
+ * Hash a token using SHA-256.
55
+ *
56
+ * Used for refresh tokens where we need fast comparison
57
+ * and don't need the security properties of bcrypt.
58
+ *
59
+ * @param token - Raw token string
60
+ * @returns SHA-256 hex digest
61
+ */
62
+ export declare function hashToken(token: string): string;
63
+ /**
64
+ * Generate a random token string.
65
+ *
66
+ * @param length - Length of token to generate (default: 64)
67
+ * @returns Random URL-safe token string
68
+ */
69
+ export declare function generateToken(length?: number): string;
70
+ //# sourceMappingURL=crypto.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAEnF;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,SAAK,GAAG,MAAM,CAQpD;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,SAAK,GAAG,MAAM,CAEjD"}
@@ -0,0 +1,95 @@
1
+ /**
2
+ * Cryptographic helpers for password and PSK hashing.
3
+ *
4
+ * All hashing is done client-side (in SDK) before sending to Orchestrator.
5
+ * This ensures passwords/PSKs are never transmitted in plaintext.
6
+ */
7
+ import bcrypt from 'bcryptjs';
8
+ import crypto from 'crypto';
9
+ const BCRYPT_ROUNDS = 12;
10
+ /**
11
+ * Hash a password using bcrypt.
12
+ *
13
+ * @param password - Raw password string
14
+ * @returns Bcrypt hash string (includes salt)
15
+ */
16
+ export function hashPassword(password) {
17
+ const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS);
18
+ return bcrypt.hashSync(password, salt);
19
+ }
20
+ /**
21
+ * Verify a password against a bcrypt hash locally.
22
+ *
23
+ * This is primarily for testing. In production, verification
24
+ * happens via the orchestrator's verify endpoints.
25
+ *
26
+ * @param password - Raw password to verify
27
+ * @param passwordHash - Bcrypt hash to compare against
28
+ * @returns True if password matches hash
29
+ */
30
+ export function verifyPasswordLocal(password, passwordHash) {
31
+ return bcrypt.compareSync(password, passwordHash);
32
+ }
33
+ /**
34
+ * Hash a PSK (Pre-Shared Key) using bcrypt.
35
+ *
36
+ * @param psk - Raw PSK string
37
+ * @returns Bcrypt hash string (includes salt)
38
+ */
39
+ export function hashPsk(psk) {
40
+ const salt = bcrypt.genSaltSync(BCRYPT_ROUNDS);
41
+ return bcrypt.hashSync(psk, salt);
42
+ }
43
+ /**
44
+ * Verify a PSK against a bcrypt hash locally.
45
+ *
46
+ * This is primarily for testing. In production, verification
47
+ * happens via the orchestrator's verify endpoints.
48
+ *
49
+ * @param psk - Raw PSK to verify
50
+ * @param pskHash - Bcrypt hash to compare against
51
+ * @returns True if PSK matches hash
52
+ */
53
+ export function verifyPskLocal(psk, pskHash) {
54
+ return bcrypt.compareSync(psk, pskHash);
55
+ }
56
+ /**
57
+ * Generate a random PSK locally.
58
+ *
59
+ * Note: In production, prefer using the orchestrator's PSK generation
60
+ * for centralized PSK management. This is a fallback.
61
+ *
62
+ * @param length - Length of PSK to generate (default: 32)
63
+ * @returns Random PSK string
64
+ */
65
+ export function generatePskLocal(length = 32) {
66
+ const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*';
67
+ let result = '';
68
+ const randomBytes = crypto.randomBytes(length);
69
+ for (let i = 0; i < length; i++) {
70
+ result += alphabet[randomBytes[i] % alphabet.length];
71
+ }
72
+ return result;
73
+ }
74
+ /**
75
+ * Hash a token using SHA-256.
76
+ *
77
+ * Used for refresh tokens where we need fast comparison
78
+ * and don't need the security properties of bcrypt.
79
+ *
80
+ * @param token - Raw token string
81
+ * @returns SHA-256 hex digest
82
+ */
83
+ export function hashToken(token) {
84
+ return crypto.createHash('sha256').update(token).digest('hex');
85
+ }
86
+ /**
87
+ * Generate a random token string.
88
+ *
89
+ * @param length - Length of token to generate (default: 64)
90
+ * @returns Random URL-safe token string
91
+ */
92
+ export function generateToken(length = 64) {
93
+ return crypto.randomBytes(length).toString('base64url');
94
+ }
95
+ //# sourceMappingURL=crypto.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,YAAoB;IACxE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,OAAe;IACzD,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAM,GAAG,EAAE;IAC1C,MAAM,QAAQ,GAAG,wEAAwE,CAAC;IAC1F,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAM,GAAG,EAAE;IACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC"}
@@ -6,60 +6,204 @@
6
6
  import type { DominusClient } from '../lib/client.js';
7
7
  export declare class AuthNamespace {
8
8
  private client;
9
+ private _publicKeyCache;
9
10
  constructor(client: DominusClient);
10
- getUser(userId: string): Promise<Record<string, unknown>>;
11
- listUsers(): Promise<Array<Record<string, unknown>>>;
12
- addUser(params: {
11
+ createUser(params: {
13
12
  username: string;
13
+ email: string;
14
14
  password: string;
15
+ status?: string;
16
+ }): Promise<Record<string, unknown>>;
17
+ getUser(userId: string): Promise<Record<string, unknown>>;
18
+ listUsers(params?: {
19
+ status?: string;
20
+ limit?: number;
21
+ offset?: number;
22
+ orderBy?: string;
23
+ orderDesc?: boolean;
24
+ }): Promise<Record<string, unknown>>;
25
+ updateUser(userId: string, data: {
26
+ username?: string;
15
27
  email?: string;
16
- roleId?: string;
28
+ status?: string;
17
29
  }): Promise<Record<string, unknown>>;
18
- updateUser(userId: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
19
30
  deleteUser(userId: string): Promise<Record<string, unknown>>;
20
- getRole(roleId: string): Promise<Record<string, unknown>>;
21
- listRoles(): Promise<Array<Record<string, unknown>>>;
22
- addRole(params: {
31
+ updatePassword(userId: string, password: string): Promise<Record<string, unknown>>;
32
+ verifyPassword(userId: string, password: string): Promise<Record<string, unknown>>;
33
+ getUserRoles(userId: string): Promise<Array<Record<string, unknown>>>;
34
+ addUserRoles(userId: string, roleIds: string[]): Promise<Record<string, unknown>>;
35
+ removeUserRoles(userId: string, roleIds: string[]): Promise<Record<string, unknown>>;
36
+ getUserScopes(userId: string): Promise<Array<Record<string, unknown>>>;
37
+ addUserScopes(userId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
38
+ removeUserScopes(userId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
39
+ getUserTenants(userId: string): Promise<Array<Record<string, unknown>>>;
40
+ addUserTenants(userId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
41
+ removeUserTenants(userId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
42
+ getUserSubtypes(userId: string): Promise<Array<Record<string, unknown>>>;
43
+ addUserSubtypes(userId: string, subtypeIds: string[]): Promise<Record<string, unknown>>;
44
+ removeUserSubtypes(userId: string, subtypeIds: string[]): Promise<Record<string, unknown>>;
45
+ createRole(params: {
23
46
  name: string;
24
- scopeSlugs?: string[];
25
47
  description?: string;
26
48
  }): Promise<Record<string, unknown>>;
27
- updateRole(roleId: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
49
+ getRole(roleId: string): Promise<Record<string, unknown>>;
50
+ listRoles(params?: {
51
+ limit?: number;
52
+ offset?: number;
53
+ }): Promise<Record<string, unknown>>;
54
+ updateRole(roleId: string, data: {
55
+ name?: string;
56
+ description?: string;
57
+ }): Promise<Record<string, unknown>>;
28
58
  deleteRole(roleId: string): Promise<Record<string, unknown>>;
29
- getScope(scopeId: string): Promise<Record<string, unknown>>;
30
- listScopes(): Promise<Array<Record<string, unknown>>>;
31
- addScope(params: {
59
+ getRoleScopes(roleId: string): Promise<Array<Record<string, unknown>>>;
60
+ addRoleScopes(roleId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
61
+ removeRoleScopes(roleId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
62
+ createScope(params: {
32
63
  slug: string;
33
64
  displayName: string;
34
65
  description?: string;
35
66
  }): Promise<Record<string, unknown>>;
36
- updateScope(scopeId: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
67
+ getScope(scopeId: string): Promise<Record<string, unknown>>;
68
+ listScopes(params?: {
69
+ limit?: number;
70
+ offset?: number;
71
+ }): Promise<Record<string, unknown>>;
72
+ updateScope(scopeId: string, data: {
73
+ slug?: string;
74
+ displayName?: string;
75
+ description?: string;
76
+ }): Promise<Record<string, unknown>>;
37
77
  deleteScope(scopeId: string): Promise<Record<string, unknown>>;
38
- getClient(clientId: string): Promise<Record<string, unknown>>;
39
- listClients(): Promise<Array<Record<string, unknown>>>;
40
- addClient(params: {
78
+ createClient(params: {
41
79
  label: string;
42
- roleId?: string;
80
+ description?: string;
81
+ }): Promise<Record<string, unknown>>;
82
+ getClient(clientId: string): Promise<Record<string, unknown>>;
83
+ listClients(params?: {
84
+ limit?: number;
85
+ offset?: number;
86
+ }): Promise<Record<string, unknown>>;
87
+ updateClient(clientId: string, data: {
88
+ label?: string;
89
+ description?: string;
90
+ status?: string;
43
91
  }): Promise<Record<string, unknown>>;
44
92
  deleteClient(clientId: string): Promise<Record<string, unknown>>;
45
- getTenant(tenantId: string): Promise<Record<string, unknown>>;
46
- listTenants(): Promise<Array<Record<string, unknown>>>;
47
- addTenant(params: {
93
+ regeneratePsk(clientId: string): Promise<Record<string, unknown>>;
94
+ verifyPsk(clientId: string, psk: string): Promise<Record<string, unknown>>;
95
+ getClientTenants(clientId: string): Promise<Array<Record<string, unknown>>>;
96
+ addClientTenants(clientId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
97
+ removeClientTenants(clientId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
98
+ createTenant(params: {
48
99
  name: string;
49
100
  slug: string;
50
101
  categoryId?: string;
102
+ displayName?: string;
103
+ description?: string;
104
+ }): Promise<Record<string, unknown>>;
105
+ getTenant(tenantId: string): Promise<Record<string, unknown>>;
106
+ listTenants(params?: {
107
+ status?: string;
108
+ categoryId?: string;
109
+ limit?: number;
110
+ offset?: number;
111
+ }): Promise<Record<string, unknown>>;
112
+ updateTenant(tenantId: string, data: {
113
+ name?: string;
114
+ displayName?: string;
115
+ status?: string;
51
116
  }): Promise<Record<string, unknown>>;
52
- updateTenant(tenantId: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
53
117
  deleteTenant(tenantId: string): Promise<Record<string, unknown>>;
118
+ createTenantCategory(params: {
119
+ name: string;
120
+ slug: string;
121
+ description?: string;
122
+ color?: string;
123
+ }): Promise<Record<string, unknown>>;
54
124
  getTenantCategory(categoryId: string): Promise<Record<string, unknown>>;
55
- listTenantCategories(): Promise<Array<Record<string, unknown>>>;
56
- listPages(): Promise<Array<Record<string, unknown>>>;
57
- listNavigation(): Promise<Array<Record<string, unknown>>>;
58
- listSecureTables(): Promise<Array<Record<string, unknown>>>;
59
- addSecureTable(params: {
60
- schema: string;
125
+ listTenantCategories(params?: {
126
+ limit?: number;
127
+ offset?: number;
128
+ }): Promise<Record<string, unknown>>;
129
+ updateTenantCategory(categoryId: string, data: {
130
+ name?: string;
131
+ description?: string;
132
+ color?: string;
133
+ }): Promise<Record<string, unknown>>;
134
+ deleteTenantCategory(categoryId: string): Promise<Record<string, unknown>>;
135
+ createSubtype(params: {
136
+ name: string;
137
+ slug: string;
138
+ description?: string;
139
+ }): Promise<Record<string, unknown>>;
140
+ getSubtype(subtypeId: string): Promise<Record<string, unknown>>;
141
+ listSubtypes(params?: {
142
+ limit?: number;
143
+ offset?: number;
144
+ }): Promise<Record<string, unknown>>;
145
+ updateSubtype(subtypeId: string, data: {
146
+ name?: string;
147
+ description?: string;
148
+ }): Promise<Record<string, unknown>>;
149
+ deleteSubtype(subtypeId: string): Promise<Record<string, unknown>>;
150
+ createPage(params: {
151
+ path: string;
152
+ name: string;
153
+ description?: string;
154
+ isActive?: boolean;
155
+ }): Promise<Record<string, unknown>>;
156
+ getPage(pageId: string): Promise<Record<string, unknown>>;
157
+ listPages(params?: {
158
+ isActive?: boolean;
159
+ limit?: number;
160
+ offset?: number;
161
+ }): Promise<Record<string, unknown>>;
162
+ updatePage(pageId: string, data: {
163
+ path?: string;
164
+ name?: string;
165
+ description?: string;
166
+ isActive?: boolean;
167
+ }): Promise<Record<string, unknown>>;
168
+ deletePage(pageId: string): Promise<Record<string, unknown>>;
169
+ getPageTenants(pageId: string): Promise<Array<Record<string, unknown>>>;
170
+ addPageTenants(pageId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
171
+ removePageTenants(pageId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
172
+ createNavItem(params: {
173
+ title: string;
174
+ icon?: string;
175
+ pageId?: string;
176
+ parentId?: string;
177
+ sortOrder?: number;
178
+ }): Promise<Record<string, unknown>>;
179
+ getNavItem(navId: string): Promise<Record<string, unknown>>;
180
+ listNavItems(params?: {
181
+ limit?: number;
182
+ offset?: number;
183
+ }): Promise<Record<string, unknown>>;
184
+ updateNavItem(navId: string, data: {
185
+ title?: string;
186
+ icon?: string;
187
+ sortOrder?: number;
188
+ }): Promise<Record<string, unknown>>;
189
+ deleteNavItem(navId: string): Promise<Record<string, unknown>>;
190
+ getNavTenants(navId: string): Promise<Array<Record<string, unknown>>>;
191
+ addNavTenants(navId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
192
+ removeNavTenants(navId: string, tenantIds: string[]): Promise<Record<string, unknown>>;
193
+ createSecureTable(params: {
61
194
  tableName: string;
195
+ schemaName?: string;
196
+ }): Promise<Record<string, unknown>>;
197
+ getSecureTable(secureTableId: string): Promise<Record<string, unknown>>;
198
+ listSecureTables(params?: {
199
+ limit?: number;
200
+ offset?: number;
62
201
  }): Promise<Record<string, unknown>>;
63
- deleteSecureTable(tableId: string): Promise<Record<string, unknown>>;
202
+ deleteSecureTable(secureTableId: string): Promise<Record<string, unknown>>;
203
+ getSecureTableScopes(secureTableId: string): Promise<Array<Record<string, unknown>>>;
204
+ addSecureTableScopes(secureTableId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
205
+ removeSecureTableScopes(secureTableId: string, scopeIds: string[]): Promise<Record<string, unknown>>;
206
+ getJwks(): Promise<Record<string, unknown>>;
207
+ validateJwt(token: string): Promise<Record<string, unknown>>;
64
208
  }
65
209
  //# sourceMappingURL=auth.d.ts.map