hazo_auth 1.2.0 → 1.4.0

package/dist/components/ui/tabs.js

@@ -0,0 +1,33 @@
+"use client";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { jsx as _jsx } from "react/jsx-runtime";
+import * as React from "react";
+import * as TabsPrimitive from "@radix-ui/react-tabs";
+import { cn } from "hazo_auth/lib/utils";
+const Tabs = TabsPrimitive.Root;
+const TabsList = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.List, Object.assign({ ref: ref, className: cn("inline-flex h-9 items-center justify-center rounded-lg bg-muted p-1 text-muted-foreground", className) }, props)));
+});
+TabsList.displayName = TabsPrimitive.List.displayName;
+const TabsTrigger = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.Trigger, Object.assign({ ref: ref, className: cn("inline-flex items-center justify-center whitespace-nowrap rounded-md px-3 py-1 text-sm font-medium ring-offset-background transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:bg-background data-[state=active]:text-foreground data-[state=active]:shadow", className) }, props)));
+});
+TabsTrigger.displayName = TabsPrimitive.Trigger.displayName;
+const TabsContent = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.Content, Object.assign({ ref: ref, className: cn("mt-2 ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2", className) }, props)));
+});
+TabsContent.displayName = TabsPrimitive.Content.displayName;
+export { Tabs, TabsList, TabsTrigger, TabsContent };

package/dist/components/ui/tooltip.d.ts

@@ -0,0 +1,8 @@
+import * as React from "react";
+import * as TooltipPrimitive from "@radix-ui/react-tooltip";
+declare const TooltipProvider: React.FC<TooltipPrimitive.TooltipProviderProps>;
+declare const Tooltip: React.FC<TooltipPrimitive.TooltipProps>;
+declare const TooltipTrigger: React.ForwardRefExoticComponent<TooltipPrimitive.TooltipTriggerProps & React.RefAttributes<HTMLButtonElement>>;
+declare const TooltipContent: React.ForwardRefExoticComponent<Omit<TooltipPrimitive.TooltipContentProps & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };
+//# sourceMappingURL=tooltip.d.ts.map

package/dist/components/ui/tooltip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tooltip.d.ts","sourceRoot":"","sources":["../../../src/components/ui/tooltip.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,KAAK,gBAAgB,MAAM,yBAAyB,CAAA;AAI3D,QAAA,MAAM,eAAe,iDAA4B,CAAA;AAEjD,QAAA,MAAM,OAAO,yCAAwB,CAAA;AAErC,QAAA,MAAM,cAAc,gHAA2B,CAAA;AAE/C,QAAA,MAAM,cAAc,gKAelB,CAAA;AAGF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,CAAA"}

package/dist/components/ui/tooltip.js

@@ -0,0 +1,25 @@
+"use client";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { jsx as _jsx } from "react/jsx-runtime";
+import * as React from "react";
+import * as TooltipPrimitive from "@radix-ui/react-tooltip";
+import { cn } from "hazo_auth/lib/utils";
+const TooltipProvider = TooltipPrimitive.Provider;
+const Tooltip = TooltipPrimitive.Root;
+const TooltipTrigger = TooltipPrimitive.Trigger;
+const TooltipContent = React.forwardRef((_a, ref) => {
+    var { className, sideOffset = 4 } = _a, props = __rest(_a, ["className", "sideOffset"]);
+    return (_jsx(TooltipPrimitive.Portal, { children: _jsx(TooltipPrimitive.Content, Object.assign({ ref: ref, sideOffset: sideOffset, className: cn("z-50 overflow-hidden rounded-md bg-primary px-3 py-1.5 text-xs text-primary-foreground animate-in fade-in-0 zoom-in-95 data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2 origin-[--radix-tooltip-content-transform-origin]", className) }, props)) }));
+});
+TooltipContent.displayName = TooltipPrimitive.Content.displayName;
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };

package/dist/components/ui/vertical-tabs.d.ts

@@ -0,0 +1,8 @@
+import * as React from "react";
+import * as TabsPrimitive from "@radix-ui/react-tabs";
+declare const VerticalTabs: React.ForwardRefExoticComponent<TabsPrimitive.TabsProps & React.RefAttributes<HTMLDivElement>>;
+declare const VerticalTabsList: React.ForwardRefExoticComponent<Omit<TabsPrimitive.TabsListProps & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
+declare const VerticalTabsTrigger: React.ForwardRefExoticComponent<Omit<TabsPrimitive.TabsTriggerProps & React.RefAttributes<HTMLButtonElement>, "ref"> & React.RefAttributes<HTMLButtonElement>>;
+declare const VerticalTabsContent: React.ForwardRefExoticComponent<Omit<TabsPrimitive.TabsContentProps & React.RefAttributes<HTMLDivElement>, "ref"> & React.RefAttributes<HTMLDivElement>>;
+export { VerticalTabs, VerticalTabsList, VerticalTabsTrigger, VerticalTabsContent };
+//# sourceMappingURL=vertical-tabs.d.ts.map

package/dist/components/ui/vertical-tabs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertical-tabs.d.ts","sourceRoot":"","sources":["../../../src/components/ui/vertical-tabs.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAC;AAItD,QAAA,MAAM,YAAY,gGAAqB,CAAC;AAExC,QAAA,MAAM,gBAAgB,uJAYpB,CAAC;AAGH,QAAA,MAAM,mBAAmB,gKAYvB,CAAC;AAGH,QAAA,MAAM,mBAAmB,0JAYvB,CAAC;AAGH,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/components/ui/vertical-tabs.js

@@ -0,0 +1,37 @@
+// file_description: vertical tabs component for sidebar-style navigation
+// section: client_directive
+"use client";
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { jsx as _jsx } from "react/jsx-runtime";
+// section: imports
+import * as React from "react";
+import * as TabsPrimitive from "@radix-ui/react-tabs";
+import { cn } from "hazo_auth/lib/utils";
+// section: components
+const VerticalTabs = TabsPrimitive.Root;
+const VerticalTabsList = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.List, Object.assign({ ref: ref, className: cn("inline-flex flex-col items-start justify-start rounded-md bg-muted p-1 text-muted-foreground", className) }, props)));
+});
+VerticalTabsList.displayName = "VerticalTabsList";
+const VerticalTabsTrigger = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.Trigger, Object.assign({ ref: ref, className: cn("inline-flex items-center justify-start whitespace-nowrap rounded-sm px-3 py-1.5 text-sm font-medium ring-offset-background transition-all focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 data-[state=active]:bg-background data-[state=active]:text-foreground data-[state=active]:shadow", className) }, props)));
+});
+VerticalTabsTrigger.displayName = "VerticalTabsTrigger";
+const VerticalTabsContent = React.forwardRef((_a, ref) => {
+    var { className } = _a, props = __rest(_a, ["className"]);
+    return (_jsx(TabsPrimitive.Content, Object.assign({ ref: ref, className: cn("mt-0 ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2", className) }, props)));
+});
+VerticalTabsContent.displayName = "VerticalTabsContent";
+export { VerticalTabs, VerticalTabsList, VerticalTabsTrigger, VerticalTabsContent };

package/dist/hooks/use-mobile.d.ts

@@ -0,0 +1,2 @@
+export declare function useIsMobile(): boolean;
+//# sourceMappingURL=use-mobile.d.ts.map

package/dist/hooks/use-mobile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-mobile.d.ts","sourceRoot":"","sources":["../../src/hooks/use-mobile.tsx"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,YAc1B"}

package/dist/hooks/use-mobile.js

@@ -0,0 +1,15 @@
+import * as React from "react";
+const MOBILE_BREAKPOINT = 768;
+export function useIsMobile() {
+    const [isMobile, setIsMobile] = React.useState(undefined);
+    React.useEffect(() => {
+        const mql = window.matchMedia(`(max-width: ${MOBILE_BREAKPOINT - 1}px)`);
+        const onChange = () => {
+            setIsMobile(window.innerWidth < MOBILE_BREAKPOINT);
+        };
+        mql.addEventListener("change", onChange);
+        setIsMobile(window.innerWidth < MOBILE_BREAKPOINT);
+        return () => mql.removeEventListener("change", onChange);
+    }, []);
+    return !!isMobile;
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./components/index";
+export * from "./lib/index";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,oBAAoB,CAAC;AAGnC,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// file_description: main entry point for hazo_auth package - exports all public APIs
+// section: component_exports
+export * from "./components/index";
+// section: lib_exports
+export * from "./lib/index";

package/dist/lib/already_logged_in_config.server.d.ts

@@ -0,0 +1,14 @@
+export type AlreadyLoggedInConfig = {
+    message: string;
+    showLogoutButton: boolean;
+    showReturnHomeButton: boolean;
+    returnHomeButtonLabel: string;
+    returnHomePath: string;
+};
+/**
+ * Reads already logged in configuration from hazo_auth_config.ini file
+ * Falls back to defaults if hazo_auth_config.ini is not found or section is missing
+ * @returns Already logged in configuration options
+ */
+export declare function get_already_logged_in_config(): AlreadyLoggedInConfig;
+//# sourceMappingURL=already_logged_in_config.server.d.ts.map

package/dist/lib/already_logged_in_config.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"already_logged_in_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/already_logged_in_config.server.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,4BAA4B,IAAI,qBAAqB,CAyBpE"}

package/dist/lib/already_logged_in_config.server.js

@@ -0,0 +1,29 @@
+// file_description: server-only helper to read already logged in configuration from hazo_auth_config.ini
+// section: imports
+import { get_config_value, get_config_boolean } from "hazo_auth/lib/config/config_loader.server";
+// section: helpers
+/**
+ * Reads already logged in configuration from hazo_auth_config.ini file
+ * Falls back to defaults if hazo_auth_config.ini is not found or section is missing
+ * @returns Already logged in configuration options
+ */
+export function get_already_logged_in_config() {
+    const section = "hazo_auth__already_logged_in";
+    // Read message (defaults to "You're already logged in.")
+    const message = get_config_value(section, "message", "You're already logged in.");
+    // Read show logout button (defaults to true)
+    const showLogoutButton = get_config_boolean(section, "show_logout_button", true);
+    // Read show return home button (defaults to false)
+    const showReturnHomeButton = get_config_boolean(section, "show_return_home_button", false);
+    // Read return home button label (defaults to "Return home")
+    const returnHomeButtonLabel = get_config_value(section, "return_home_button_label", "Return home");
+    // Read return home path (defaults to "/")
+    const returnHomePath = get_config_value(section, "return_home_path", "/");
+    return {
+        message,
+        showLogoutButton,
+        showReturnHomeButton,
+        returnHomeButtonLabel,
+        returnHomePath,
+    };
+}

package/dist/lib/app_logger.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Creates a logger service instance for use in UI components
+ * This uses the main app logging service and can be extended with an external logger
+ * when provided as part of component setup
+ */
+export declare const create_app_logger: (external_logger?: {
+    info?: (message: string, data?: Record<string, unknown>) => void;
+    error?: (message: string, data?: Record<string, unknown>) => void;
+    warn?: (message: string, data?: Record<string, unknown>) => void;
+    debug?: (message: string, data?: Record<string, unknown>) => void;
+}) => import("../server/types/app_types").logger_service;
+//# sourceMappingURL=app_logger.d.ts.map

package/dist/lib/app_logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app_logger.d.ts","sourceRoot":"","sources":["../../src/lib/app_logger.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,kBAAkB;IAChB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAClE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACnE,uDAGF,CAAC"}

package/dist/lib/app_logger.js

@@ -0,0 +1,14 @@
+// file_description: client-accessible wrapper for the main app logging service
+// section: imports
+import { create_logger_service } from "hazo_auth/server/logging/logger_service";
+// section: constants
+const APP_NAMESPACE = "hazo_auth_ui";
+// section: logger_instance
+/**
+ * Creates a logger service instance for use in UI components
+ * This uses the main app logging service and can be extended with an external logger
+ * when provided as part of component setup
+ */
+export const create_app_logger = (external_logger) => {
+    return create_logger_service(APP_NAMESPACE, external_logger);
+};

package/dist/lib/auth/auth_cache.d.ts

@@ -0,0 +1,83 @@
+import type { HazoAuthUser } from "hazo_auth/lib/auth/auth_types";
+/**
+ * Cache entry structure
+ */
+type CacheEntry = {
+    user: HazoAuthUser;
+    permissions: string[];
+    role_ids: number[];
+    timestamp: number;
+    cache_version: number;
+};
+/**
+ * LRU cache implementation with TTL and size limits
+ * Uses Map to maintain insertion order for LRU eviction
+ */
+declare class AuthCache {
+    private cache;
+    private max_size;
+    private ttl_ms;
+    private max_age_ms;
+    private role_version_map;
+    constructor(max_size: number, ttl_minutes: number, max_age_minutes: number);
+    /**
+     * Gets a cache entry for a user
+     * Returns undefined if not found, expired, or too old
+     * @param user_id - User ID to look up
+     * @returns Cache entry or undefined
+     */
+    get(user_id: string): CacheEntry | undefined;
+    /**
+     * Sets a cache entry for a user
+     * Evicts least recently used entries if cache is full
+     * @param user_id - User ID
+     * @param user - User data
+     * @param permissions - User permissions
+     * @param role_ids - User role IDs
+     */
+    set(user_id: string, user: HazoAuthUser, permissions: string[], role_ids: number[]): void;
+    /**
+     * Invalidates cache for a specific user
+     * @param user_id - User ID to invalidate
+     */
+    invalidate_user(user_id: string): void;
+    /**
+     * Invalidates cache for all users with specific roles
+     * Uses cache version to determine if invalidation is needed
+     * @param role_ids - Array of role IDs to invalidate
+     */
+    invalidate_by_roles(role_ids: number[]): void;
+    /**
+     * Invalidates all cache entries
+     */
+    invalidate_all(): void;
+    /**
+     * Gets the maximum cache version for a set of roles
+     * Used to determine if cache entry is stale
+     * @param role_ids - Array of role IDs
+     * @returns Maximum version number
+     */
+    private get_max_role_version;
+    /**
+     * Gets cache statistics
+     * @returns Object with cache size, max size, and hit rate estimate
+     */
+    get_stats(): {
+        size: number;
+        max_size: number;
+    };
+}
+/**
+ * Gets or creates the global auth cache instance
+ * @param max_size - Maximum cache size (default: 10000)
+ * @param ttl_minutes - TTL in minutes (default: 15)
+ * @param max_age_minutes - Max age in minutes (default: 30)
+ * @returns Auth cache instance
+ */
+export declare function get_auth_cache(max_size?: number, ttl_minutes?: number, max_age_minutes?: number): AuthCache;
+/**
+ * Resets the global cache instance (useful for testing)
+ */
+export declare function reset_auth_cache(): void;
+export {};
+//# sourceMappingURL=auth_cache.d.ts.map

package/dist/lib/auth/auth_cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_cache.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAIlE;;GAEG;AACH,KAAK,UAAU,GAAG;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,cAAM,SAAS;IACb,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,gBAAgB,CAAsB;gBAG5C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM;IASzB;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IA+B5C;;;;;;;OAOG;IACH,GAAG,CACD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI;IAyBP;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAItC;;;;OAIG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI;IAqB7C;;OAEG;IACH,cAAc,IAAI,IAAI;IAItB;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAc5B;;;OAGG;IACH,SAAS,IAAI;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;KAClB;CAMF;AAMD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,GAAE,MAAc,EACxB,WAAW,GAAE,MAAW,EACxB,eAAe,GAAE,MAAW,GAC3B,SAAS,CAKX;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/lib/auth/auth_cache.js

@@ -0,0 +1,158 @@
+/**
+ * LRU cache implementation with TTL and size limits
+ * Uses Map to maintain insertion order for LRU eviction
+ */
+class AuthCache {
+    constructor(max_size, ttl_minutes, max_age_minutes) {
+        this.cache = new Map();
+        this.max_size = max_size;
+        this.ttl_ms = ttl_minutes * 60 * 1000;
+        this.max_age_ms = max_age_minutes * 60 * 1000;
+        this.role_version_map = new Map();
+    }
+    /**
+     * Gets a cache entry for a user
+     * Returns undefined if not found, expired, or too old
+     * @param user_id - User ID to look up
+     * @returns Cache entry or undefined
+     */
+    get(user_id) {
+        const entry = this.cache.get(user_id);
+        if (!entry) {
+            return undefined;
+        }
+        const now = Date.now();
+        const age = now - entry.timestamp;
+        // Check if entry is expired (TTL)
+        if (age > this.ttl_ms) {
+            this.cache.delete(user_id);
+            return undefined;
+        }
+        // Check if entry is too old (force refresh threshold)
+        if (age > this.max_age_ms) {
+            // Don't delete, but mark as stale so caller can refresh
+            // Return undefined to force refresh
+            this.cache.delete(user_id);
+            return undefined;
+        }
+        // Move to end (most recently used)
+        this.cache.delete(user_id);
+        this.cache.set(user_id, entry);
+        return entry;
+    }
+    /**
+     * Sets a cache entry for a user
+     * Evicts least recently used entries if cache is full
+     * @param user_id - User ID
+     * @param user - User data
+     * @param permissions - User permissions
+     * @param role_ids - User role IDs
+     */
+    set(user_id, user, permissions, role_ids) {
+        // Evict LRU entries if cache is full
+        while (this.cache.size >= this.max_size) {
+            const first_key = this.cache.keys().next().value;
+            if (first_key) {
+                this.cache.delete(first_key);
+            }
+            else {
+                break;
+            }
+        }
+        // Get current cache version for user's roles
+        const cache_version = this.get_max_role_version(role_ids);
+        const entry = {
+            user,
+            permissions,
+            role_ids,
+            timestamp: Date.now(),
+            cache_version,
+        };
+        this.cache.set(user_id, entry);
+    }
+    /**
+     * Invalidates cache for a specific user
+     * @param user_id - User ID to invalidate
+     */
+    invalidate_user(user_id) {
+        this.cache.delete(user_id);
+    }
+    /**
+     * Invalidates cache for all users with specific roles
+     * Uses cache version to determine if invalidation is needed
+     * @param role_ids - Array of role IDs to invalidate
+     */
+    invalidate_by_roles(role_ids) {
+        // Increment version for affected roles
+        for (const role_id of role_ids) {
+            const current_version = this.role_version_map.get(role_id) || 0;
+            this.role_version_map.set(role_id, current_version + 1);
+        }
+        // Remove entries where cache version is older than role version
+        const entries_to_remove = [];
+        for (const [user_id, entry] of this.cache.entries()) {
+            const max_role_version = this.get_max_role_version(entry.role_ids);
+            if (max_role_version > entry.cache_version) {
+                entries_to_remove.push(user_id);
+            }
+        }
+        for (const user_id of entries_to_remove) {
+            this.cache.delete(user_id);
+        }
+    }
+    /**
+     * Invalidates all cache entries
+     */
+    invalidate_all() {
+        this.cache.clear();
+    }
+    /**
+     * Gets the maximum cache version for a set of roles
+     * Used to determine if cache entry is stale
+     * @param role_ids - Array of role IDs
+     * @returns Maximum version number
+     */
+    get_max_role_version(role_ids) {
+        if (role_ids.length === 0) {
+            return 0;
+        }
+        let max_version = 0;
+        for (const role_id of role_ids) {
+            const version = this.role_version_map.get(role_id) || 0;
+            max_version = Math.max(max_version, version);
+        }
+        return max_version;
+    }
+    /**
+     * Gets cache statistics
+     * @returns Object with cache size, max size, and hit rate estimate
+     */
+    get_stats() {
+        return {
+            size: this.cache.size,
+            max_size: this.max_size,
+        };
+    }
+}
+// section: singleton
+// Global cache instance (initialized with defaults, will be configured on first use)
+let auth_cache_instance = null;
+/**
+ * Gets or creates the global auth cache instance
+ * @param max_size - Maximum cache size (default: 10000)
+ * @param ttl_minutes - TTL in minutes (default: 15)
+ * @param max_age_minutes - Max age in minutes (default: 30)
+ * @returns Auth cache instance
+ */
+export function get_auth_cache(max_size = 10000, ttl_minutes = 15, max_age_minutes = 30) {
+    if (!auth_cache_instance) {
+        auth_cache_instance = new AuthCache(max_size, ttl_minutes, max_age_minutes);
+    }
+    return auth_cache_instance;
+}
+/**
+ * Resets the global cache instance (useful for testing)
+ */
+export function reset_auth_cache() {
+    auth_cache_instance = null;
+}

package/dist/lib/auth/auth_rate_limiter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Simple in-memory rate limiter
+ * Tracks request counts per key within a time window
+ */
+declare class RateLimiter {
+    private limits;
+    private window_ms;
+    constructor();
+    /**
+     * Checks if a request should be allowed
+     * @param key - Rate limit key (e.g., "user:123" or "ip:192.168.1.1")
+     * @param max_requests - Maximum requests allowed per window
+     * @returns true if allowed, false if rate limited
+     */
+    check(key: string, max_requests: number): boolean;
+    /**
+     * Cleans up old entries (call periodically to prevent memory leak)
+     * Removes entries older than 2 windows
+     */
+    cleanup(): void;
+    /**
+     * Gets rate limit statistics
+     * @returns Object with current limit entries count
+     */
+    get_stats(): {
+        active_limits: number;
+    };
+}
+/**
+ * Gets or creates the global rate limiter instance
+ * @returns Rate limiter instance
+ */
+export declare function get_rate_limiter(): RateLimiter;
+/**
+ * Resets the global rate limiter instance (useful for testing)
+ */
+export declare function reset_rate_limiter(): void;
+export {};
+//# sourceMappingURL=auth_rate_limiter.d.ts.map

package/dist/lib/auth/auth_rate_limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth_rate_limiter.d.ts","sourceRoot":"","sources":["../../../src/lib/auth/auth_rate_limiter.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,cAAM,WAAW;IACf,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,SAAS,CAAS;;IAO1B;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IAiCjD;;;OAGG;IACH,OAAO,IAAI,IAAI;IAgBf;;;OAGG;IACH,SAAS,IAAI;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;CAKvC;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,WAAW,CAU9C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/lib/auth/auth_rate_limiter.js

@@ -0,0 +1,95 @@
+// file_description: Simple in-memory rate limiter for hazo_get_auth API endpoint
+// section: types
+/**
+ * Simple in-memory rate limiter
+ * Tracks request counts per key within a time window
+ */
+class RateLimiter {
+    constructor() {
+        this.limits = new Map();
+        this.window_ms = 60 * 1000; // 1 minute window
+    }
+    /**
+     * Checks if a request should be allowed
+     * @param key - Rate limit key (e.g., "user:123" or "ip:192.168.1.1")
+     * @param max_requests - Maximum requests allowed per window
+     * @returns true if allowed, false if rate limited
+     */
+    check(key, max_requests) {
+        const now = Date.now();
+        const entry = this.limits.get(key);
+        if (!entry) {
+            // First request for this key
+            this.limits.set(key, {
+                count: 1,
+                window_start: now,
+            });
+            return true;
+        }
+        // Check if window has expired
+        if (now - entry.window_start >= this.window_ms) {
+            // Reset window
+            this.limits.set(key, {
+                count: 1,
+                window_start: now,
+            });
+            return true;
+        }
+        // Check if limit exceeded
+        if (entry.count >= max_requests) {
+            return false;
+        }
+        // Increment count
+        entry.count++;
+        return true;
+    }
+    /**
+     * Cleans up old entries (call periodically to prevent memory leak)
+     * Removes entries older than 2 windows
+     */
+    cleanup() {
+        const now = Date.now();
+        const cutoff = now - 2 * this.window_ms;
+        const keys_to_delete = [];
+        for (const [key, entry] of this.limits.entries()) {
+            if (entry.window_start < cutoff) {
+                keys_to_delete.push(key);
+            }
+        }
+        for (const key of keys_to_delete) {
+            this.limits.delete(key);
+        }
+    }
+    /**
+     * Gets rate limit statistics
+     * @returns Object with current limit entries count
+     */
+    get_stats() {
+        return {
+            active_limits: this.limits.size,
+        };
+    }
+}
+// section: singleton
+// Global rate limiter instance
+let rate_limiter_instance = null;
+/**
+ * Gets or creates the global rate limiter instance
+ * @returns Rate limiter instance
+ */
+export function get_rate_limiter() {
+    if (!rate_limiter_instance) {
+        rate_limiter_instance = new RateLimiter();
+        // Cleanup old entries every 5 minutes
+        setInterval(() => {
+            rate_limiter_instance === null || rate_limiter_instance === void 0 ? void 0 : rate_limiter_instance.cleanup();
+        }, 5 * 60 * 1000);
+    }
+    return rate_limiter_instance;
+}
+/**
+ * Resets the global rate limiter instance (useful for testing)
+ */
+export function reset_rate_limiter() {
+    rate_limiter_instance = null;
+}