qa360 2.1.7 → 2.2.0

package/core/src/auth/azure-ad-provider.ts

@@ -0,0 +1,126 @@
+/**
+ * Azure AD Authentication Provider
+ *
+ * Handles Azure Active Directory authentication.
+ * Supports OAuth2 client credentials flow with Azure AD.
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, AzureADConfig, authCache, createCacheKey } from './index.js';
+
+export class AzureADProvider implements AuthProvider<AzureADConfig> {
+  readonly type = 'azure_ad' as const;
+
+  async authenticate(config: AzureADConfig): Promise<AuthResult> {
+    const { tenant_id, client_id, client_secret, scope = 'https://management.azure.com/.default' } = config;
+
+    if (!tenant_id || !client_id) {
+      return {
+        success: false,
+        error: 'Azure AD requires tenant_id and client_id'
+      };
+    }
+
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (config.cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    // Default token endpoint for Azure AD
+    const tokenEndpoint = config.token_endpoint ||
+      `https://login.microsoftonline.com/${tenant_id}/oauth2/v2.0/token`;
+
+    try {
+      const body = new URLSearchParams({
+        grant_type: 'client_credentials',
+        client_id,
+        client_secret: client_secret || '',
+        scope
+      });
+
+      const response = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded'
+        },
+        body: body.toString()
+      });
+
+      if (!response.ok) {
+        const error = await response.text().catch(() => 'Unknown error');
+        return {
+          success: false,
+          error: `Azure AD token request failed: ${response.status} ${error}`
+        };
+      }
+
+      const data = await response.json() as AzureTokenResponse;
+      const token = data.access_token;
+
+      if (!token) {
+        return {
+          success: false,
+          error: 'No access_token in Azure AD response'
+        };
+      }
+
+      const credentials: AuthCredentials = {
+        type: 'azure_ad',
+        headers: {
+          'Authorization': `Bearer ${token}`
+        }
+      };
+
+      // Cache with calculated expiration
+      if (config.cache?.enabled !== false) {
+        const expiresIn = data.expires_in || 3600;
+        const ttl = config.cache?.ttl || expiresIn;
+        authCache.set(cacheKey, credentials, ttl);
+      }
+
+      return {
+        success: true,
+        credentials,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined
+      };
+
+    } catch (error) {
+      return {
+        success: false,
+        error: `Azure AD authentication failed: ${(error as Error).message}`
+      };
+    }
+  }
+
+  async refresh(config: AzureADConfig): Promise<AuthResult> {
+    authCache.clear(this.getCacheKey(config));
+    return this.authenticate(config);
+  }
+
+  clear(config: AzureADConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+    return Promise.resolve();
+  }
+
+  async validate(config: AzureADConfig): Promise<boolean> {
+    const key = this.getCacheKey(config);
+    return authCache.has(key);
+  }
+
+  private getCacheKey(config: AzureADConfig): string {
+    return createCacheKey('azure_ad', config.client_id);
+  }
+}
+
+interface AzureTokenResponse {
+  token_type: string;
+  expires_in: number;
+  access_token: string;
+  refresh_token?: string;
+  scope?: string;
+}

package/core/src/auth/basic-auth-provider.ts

@@ -0,0 +1,133 @@
+/**
+ * Bearer Token and Basic Authentication Providers
+ *
+ * Handles generic bearer token and HTTP Basic Authentication.
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, BearerAuthConfig, BasicAuthConfig, parseToken, encodeBasicAuth, authCache, createCacheKey } from './index.js';
+
+/**
+ * Bearer Token Authentication Provider
+ */
+export class BearerProvider implements AuthProvider<BearerAuthConfig> {
+  readonly type = 'bearer' as const;
+
+  async authenticate(config: BearerAuthConfig): Promise<AuthResult> {
+    const { token, cache } = config;
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    const cleanToken = parseToken(token);
+
+    const credentials: AuthCredentials = {
+      type: 'bearer',
+      headers: {
+        'Authorization': `Bearer ${cleanToken}`
+      }
+    };
+
+    // Cache if enabled
+    if (cache?.enabled !== false) {
+      const ttl = cache?.ttl || 3600;
+      authCache.set(cacheKey, credentials, ttl);
+    }
+
+    return {
+      success: true,
+      credentials
+    };
+  }
+
+  async clear(config: BearerAuthConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+  }
+
+  async validate(config: BearerAuthConfig): Promise<boolean> {
+    const cacheKey = this.getCacheKey(config);
+    // Check cache first, then validate token
+    if (authCache.has(cacheKey)) {
+      return true;
+    }
+    return !!config.token && config.token.length > 0;
+  }
+
+  private getCacheKey(config: BearerAuthConfig): string {
+    // Use token hash as identifier
+    const crypto = require('node:crypto');
+    const hash = crypto.createHash('sha256').update(config.token || '').digest('hex').substring(0, 16);
+    return createCacheKey('bearer', hash);
+  }
+}
+
+/**
+ * Basic Authentication Provider
+ */
+export class BasicAuthProvider implements AuthProvider<BasicAuthConfig> {
+  readonly type = 'basic' as const;
+
+  async authenticate(config: BasicAuthConfig): Promise<AuthResult> {
+    const { username, password, cache } = config;
+
+    if (!username || !password) {
+      return {
+        success: false,
+        error: 'Username and password are required for Basic auth'
+      };
+    }
+
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    const credentials: AuthCredentials = {
+      type: 'basic',
+      headers: {
+        'Authorization': encodeBasicAuth(username, password)
+      }
+    };
+
+    // Cache if enabled
+    if (cache?.enabled !== false) {
+      const ttl = cache?.ttl || 3600;
+      authCache.set(cacheKey, credentials, ttl);
+    }
+
+    return {
+      success: true,
+      credentials
+    };
+  }
+
+  async clear(config: BasicAuthConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+  }
+
+  async validate(config: BasicAuthConfig): Promise<boolean> {
+    const cacheKey = this.getCacheKey(config);
+    // Check cache first, then validate credentials
+    if (authCache.has(cacheKey)) {
+      return true;
+    }
+    return !!config.username && !!config.password;
+  }
+
+  private getCacheKey(config: BasicAuthConfig): string {
+    // Use username as identifier
+    return createCacheKey('basic', config.username || 'default');
+  }
+}

package/core/src/auth/gcp-adc-provider.ts

@@ -0,0 +1,146 @@
+/**
+ * GCP Application Default Credentials Provider
+ *
+ * Handles GCP authentication using Application Default Credentials.
+ * Supports service account credentials and ADC resolution.
+ */
+
+import { AuthProvider, AuthResult, AuthCredentials, GCPADCConfig, authCache, createCacheKey } from './index.js';
+
+export class GCPADCProvider implements AuthProvider<GCPADCConfig> {
+  readonly type = 'gcp_adc' as const;
+
+  async authenticate(config: GCPADCConfig): Promise<AuthResult> {
+    const cacheKey = this.getCacheKey(config);
+
+    // Check cache first
+    if (config.cache?.enabled !== false) {
+      const cached = authCache.get(cacheKey);
+      if (cached) {
+        return { success: true, credentials: cached };
+      }
+    }
+
+    // Try to get GCP access token
+    try {
+      const token = await this.getAccessToken(config);
+
+      if (!token) {
+        return {
+          success: false,
+          error: 'Failed to obtain GCP access token. Ensure you are authenticated with gcloud auth application-default login or have a service account key.'
+        };
+      }
+
+      const credentials: AuthCredentials = {
+        type: 'gcp_adc',
+        headers: {
+          'Authorization': `Bearer ${token}`
+        }
+      };
+
+      // GCP tokens typically expire in 1 hour
+      if (config.cache?.enabled !== false) {
+        const ttl = config.cache?.ttl || 3600;
+        authCache.set(cacheKey, credentials, ttl);
+      }
+
+      return {
+        success: true,
+        credentials,
+        expiresAt: Date.now() + 3600 * 1000
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: `GCP ADC authentication failed: ${(error as Error).message}`
+      };
+    }
+  }
+
+  async refresh(config: GCPADCConfig): Promise<AuthResult> {
+    // Clear cache and re-authenticate
+    authCache.clear(this.getCacheKey(config));
+    return this.authenticate(config);
+  }
+
+  clear(config: GCPADCConfig): Promise<void> {
+    const key = this.getCacheKey(config);
+    authCache.clear(key);
+    return Promise.resolve();
+  }
+
+  async validate(config: GCPADCConfig): Promise<boolean> {
+    const key = this.getCacheKey(config);
+    return authCache.has(key);
+  }
+
+  /**
+   * Get GCP access token from various sources
+   */
+  private async getAccessToken(config: GCPADCConfig): Promise<string | null> {
+    // Method 1: Try environment variable (GOOGLE_TOKEN)
+    if (process.env.GOOGLE_TOKEN) {
+      return process.env.GOOGLE_TOKEN;
+    }
+
+    // Method 2: Try gcloud auth print-access-token
+    const token = await this.getTokenFromGcloud();
+    if (token) return token;
+
+    // Method 3: Try metadata server (for GCE/GKE)
+    const metadataToken = await this.getTokenFromMetadataServer();
+    if (metadataToken) return metadataToken;
+
+    return null;
+  }
+
+  /**
+   * Get token from gcloud CLI
+   */
+  private async getTokenFromGcloud(): Promise<string | null> {
+    try {
+      const { execSync } = require('node:child_process');
+      const token = execSync('gcloud auth print-access-token', {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe']
+      }).trim();
+
+      return token || null;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Get token from GCP metadata server
+   */
+  private async getTokenFromMetadataServer(): Promise<string | null> {
+    try {
+      const response = await fetch(
+        'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token',
+        {
+          headers: {
+            'Metadata-Flavor': 'Google'
+          },
+          // Timeout for metadata server
+          signal: AbortSignal.timeout(2000)
+        }
+      );
+
+      if (!response.ok) {
+        return null;
+      }
+
+      const data = await response.json() as { access_token: string; expires_in: number };
+      return data.access_token;
+    } catch {
+      return null;
+    }
+  }
+
+  private getCacheKey(config: GCPADCConfig): string {
+    const identifier = config.project_id || 'default';
+    return createCacheKey('gcp_adc', identifier);
+  }
+}