qa360 2.2.1 → 2.2.13

package/core/src/auth/index.ts

@@ -1,342 +0,0 @@
-/**
- * QA360 Authentication Module
- *
- * Comprehensive authentication support for test adapters.
- * Supports JWT, OAuth2, API Keys, Bearer tokens, Basic auth, TOTP,
- * UI Login, and cloud provider credentials (GCP, AWS, Azure).
- */
-
-/**
- * Authentication result
- */
-export interface AuthResult {
-  success: boolean;
-  credentials?: AuthCredentials;
-  error?: string;
-  expiresAt?: number;  // Unix timestamp
-}
-
-/**
- * Authentication credentials to be used in requests
- */
-export interface AuthCredentials {
-  type: AuthType;
-  headers?: Record<string, string>;
-  queryParams?: Record<string, string>;
-  cookies?: Cookie[];
-  body?: Record<string, unknown>;
-}
-
-/**
- * Cookie for session management
- */
-export interface Cookie {
-  name: string;
-  value: string;
-  domain?: string;
-  path?: string;
-  expires?: Date;
-  httpOnly?: boolean;
-  secure?: boolean;
-}
-
-/**
- * Authentication types
- */
-export type AuthType =
-  | 'none'                    // No authentication
-  | 'jwt'                     // JWT bearer token
-  | 'oauth2'                  // OAuth2 client credentials
-  | 'api_key'                 // API key in header
-  | 'bearer'                  // Generic bearer token
-  | 'basic'                   // Basic auth
-  | 'totp'                    // TOTP-based auth
-  | 'ui_login'                // UI form-based login
-  | 'gcp_adc'                 // GCP Application Default Credentials
-  | 'aws_iam'                 // AWS IAM credentials
-  | 'azure_ad';               // Azure AD token
-
-/**
- * Base configuration for all auth providers
- */
-export interface BaseAuthConfig {
-  type: AuthType;
-  enabled?: boolean;
-  cache?: {
-    enabled?: boolean;
-    ttl?: number;  // Time to live in seconds
-  };
-}
-
-/**
- * JWT configuration
- */
-export interface JWTAuthConfig extends BaseAuthConfig {
-  type: 'jwt';
-  issuer?: string;
-  audience?: string;
-  subject?: string;
-  client_id?: string;
-  client_secret?: string;
-  token_endpoint?: string;
-  scopes?: string[];
-  auto_refresh?: boolean;
-  token?: string;  // Pre-existing token
-}
-
-/**
- * OAuth2 configuration
- */
-export interface OAuth2AuthConfig extends BaseAuthConfig {
-  type: 'oauth2';
-  token_url: string;
-  client_id: string;
-  client_secret?: string;
-  scopes?: string[];
-  grant_type?: 'client_credentials' | 'authorization_code' | 'password';
-  username?: string;
-  password?: string;
-}
-
-/**
- * API Key configuration
- */
-export interface APIKeyAuthConfig extends BaseAuthConfig {
-  type: 'api_key';
-  key: string;
-  header_name?: string;  // Default: X-API-Key
-  prefix?: string;       // e.g., "Bearer "
-  location?: 'header' | 'query';
-}
-
-/**
- * Bearer token configuration
- */
-export interface BearerAuthConfig extends BaseAuthConfig {
-  type: 'bearer';
-  token: string;
-}
-
-/**
- * Basic auth configuration
- */
-export interface BasicAuthConfig extends BaseAuthConfig {
-  type: 'basic';
-  username: string;
-  password: string;
-}
-
-/**
- * TOTP configuration
- */
-export interface TOTPAuthConfig extends BaseAuthConfig {
-  type: 'totp';
-  secret: string;
-  digits?: number;        // Default: 6
-  period?: number;        // Default: 30
-  algorithm?: 'sha1' | 'sha256' | 'sha512';
-}
-
-/**
- * UI Login configuration
- */
-export interface UILoginAuthConfig extends BaseAuthConfig {
-  type: 'ui_login';
-  url: string;
-  username?: string;
-  password?: string;
-  username_selector?: string;
-  password_selector?: string;
-  submit_selector?: string;
-  totp_secret?: string;
-  totp_selector?: string;
-  session_file?: string;   // Path to save session cookies
-}
-
-/**
- * GCP ADC configuration
- */
-export interface GCPADCConfig extends BaseAuthConfig {
-  type: 'gcp_adc';
-  project_id?: string;
-  scopes?: string[];
-}
-
-/**
- * AWS IAM configuration
- */
-export interface AWSIamConfig extends BaseAuthConfig {
-  type: 'aws_iam';
-  region?: string;
-  access_key_id?: string;
-  secret_access_key?: string;
-  session_token?: string;
-  role_arn?: string;
-  profile?: string;
-}
-
-/**
- * Azure AD configuration
- */
-export interface AzureADConfig extends BaseAuthConfig {
-  type: 'azure_ad';
-  tenant_id: string;
-  client_id: string;
-  client_secret?: string;
-  scope?: string;
-  token_endpoint?: string;
-}
-
-/**
- * No-auth configuration (for unauthenticated requests)
- */
-export interface NoneAuthConfig extends BaseAuthConfig {
-  type: 'none';
-}
-
-/**
- * Union type for all auth configurations
- */
-export type AuthConfig =
-  | JWTAuthConfig
-  | OAuth2AuthConfig
-  | APIKeyAuthConfig
-  | BearerAuthConfig
-  | BasicAuthConfig
-  | TOTPAuthConfig
-  | UILoginAuthConfig
-  | GCPADCConfig
-  | AWSIamConfig
-  | AzureADConfig
-  | NoneAuthConfig;
-
-/**
- * Base interface for all auth providers
- */
-export interface AuthProvider<T extends AuthConfig = AuthConfig> {
-  /**
-   * Provider type identifier
-   */
-  readonly type: AuthType;
-
-  /**
-   * Authenticate and retrieve credentials
-   */
-  authenticate(config: T): Promise<AuthResult>;
-
-  /**
-   * Refresh credentials if applicable
-   */
-  refresh?(config: T): Promise<AuthResult>;
-
-  /**
-   * Clear cached credentials
-   */
-  clear?(config: T): Promise<void>;
-
-  /**
-   * Validate current credentials
-   */
-  validate?(config: T): Promise<boolean>;
-}
-
-/**
- * Authentication cache entry
- */
-interface CacheEntry {
-  credentials: AuthCredentials;
-  expiresAt: number;
-}
-
-/**
- * Simple in-memory cache for auth credentials
- */
-export class AuthCache {
-  private cache = new Map<string, CacheEntry>();
-  private defaultTTL = 3600; // 1 hour
-
-  set(key: string, credentials: AuthCredentials, ttl?: number): void {
-    const expiresAt = Date.now() + (ttl || this.defaultTTL) * 1000;
-    this.cache.set(key, { credentials, expiresAt });
-  }
-
-  get(key: string): AuthCredentials | null {
-    const entry = this.cache.get(key);
-    if (!entry) return null;
-
-    if (Date.now() > entry.expiresAt) {
-      this.cache.delete(key);
-      return null;
-    }
-
-    return entry.credentials;
-  }
-
-  clear(key?: string): void {
-    if (key) {
-      this.cache.delete(key);
-    } else {
-      this.cache.clear();
-    }
-  }
-
-  has(key: string): boolean {
-    return this.get(key) !== null;
-  }
-}
-
-/**
- * Global auth cache instance
- */
-export const authCache = new AuthCache();
-
-/**
- * Create cache key from config
- */
-export function createCacheKey(type: AuthType, identifier: string): string {
-  return `${type}:${identifier}`;
-}
-
-/**
- * Check if credentials are expired
- */
-export function isExpired(expiresAt?: number): boolean {
-  if (!expiresAt) return false;
-  return Date.now() >= expiresAt;
-}
-
-/**
- * Parse token from string (extracts token without "Bearer " prefix)
- */
-export function parseToken(token: string): string {
-  return token.replace(/^Bearer\s+/i, '').trim();
-}
-
-/**
- * Encode basic auth header
- */
-export function encodeBasicAuth(username: string, password: string): string {
-  const encoded = Buffer.from(`${username}:${password}`).toString('base64');
-  return `Basic ${encoded}`;
-}
-
-// Re-export all providers
-export { JWTProvider } from './jwt-provider.js';
-export { OAuth2Provider } from './oauth2-provider.js';
-export { APIKeyProvider } from './api-key-provider.js';
-export { BearerProvider, BasicAuthProvider } from './basic-auth-provider.js';
-export { TOTPProvider } from './totp-provider.js';
-export { UILoginProvider } from './ui-login-provider.js';
-export { GCPADCProvider } from './gcp-adc-provider.js';
-export { AWSIamProvider } from './aws-iam-provider.js';
-export { AzureADProvider } from './azure-ad-provider.js';
-
-// Re-export manager and factory functions
-export {
-  AuthManager,
-  authManager,
-  authenticate,
-  createAuthHeaders,
-  applyAuthToRequest,
-  AuthError
-} from './manager.js';

package/core/src/auth/jwt-provider.ts

@@ -1,193 +0,0 @@
-/**
- * JWT Authentication Provider
- *
- * Handles JWT bearer token authentication with support for:
- * - Pre-existing tokens
- * - OAuth2 token endpoint (client credentials flow)
- * - Automatic token refresh
- */
-
-import { AuthProvider, AuthResult, AuthCredentials, JWTAuthConfig, authCache, createCacheKey, parseToken } from './index.js';
-
-export class JWTProvider implements AuthProvider<JWTAuthConfig> {
-  readonly type = 'jwt' as const;
-
-  async authenticate(config: JWTAuthConfig): Promise<AuthResult> {
-    // If we have a pre-existing token, use it directly
-    if (config.token) {
-      return this.createTokenResult(config.token, config);
-    }
-
-    // If token_endpoint is provided, fetch token via OAuth2
-    if (config.token_endpoint) {
-      return await this.fetchToken(config);
-    }
-
-    return {
-      success: false,
-      error: 'JWT token or token_endpoint must be provided'
-    };
-  }
-
-  async refresh(config: JWTAuthConfig): Promise<AuthResult> {
-    if (!config.token_endpoint) {
-      return {
-        success: false,
-        error: 'Cannot refresh: no token_endpoint configured'
-      };
-    }
-
-    return await this.fetchToken(config);
-  }
-
-  clear(config: JWTAuthConfig): Promise<void> {
-    const key = this.getCacheKey(config);
-    authCache.clear(key);
-    return Promise.resolve();
-  }
-
-  async validate(config: JWTAuthConfig): Promise<boolean> {
-    if (!config.token) return false;
-
-    try {
-      const parts = config.token.split('.');
-      if (parts.length !== 3) return false;
-
-      // Decode payload (no verification, just check structure)
-      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-
-      // Check expiration if present
-      if (payload.exp) {
-        const now = Math.floor(Date.now() / 1000);
-        return payload.exp > now;
-      }
-
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  private async fetchToken(config: JWTAuthConfig): Promise<AuthResult> {
-    const cacheKey = this.getCacheKey(config);
-
-    // Check cache first
-    if (config.cache?.enabled !== false) {
-      const cached = authCache.get(cacheKey);
-      if (cached) {
-        return { success: true, credentials: cached };
-      }
-    }
-
-    // Prepare token request
-    const body: Record<string, unknown> = {
-      grant_type: 'client_credentials',
-      client_id: config.client_id,
-      client_secret: config.client_secret,
-    };
-
-    if (config.scopes && config.scopes.length > 0) {
-      body.scope = config.scopes.join(' ');
-    }
-    if (config.audience) body.audience = config.audience;
-
-    try {
-      const endpoint = config.token_endpoint;
-      if (!endpoint) {
-        return { success: false, error: 'Token endpoint is required' };
-      }
-
-      const response = await fetch(endpoint, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
-
-      if (!response.ok) {
-        const error = await response.text().catch(() => 'Unknown error');
-        return {
-          success: false,
-          error: `Token request failed: ${response.status} ${error}`
-        };
-      }
-
-      const data = await response.json() as TokenResponse;
-      const token = data.access_token;
-
-      if (!token) {
-        return {
-          success: false,
-          error: 'No access_token in response'
-        };
-      }
-
-      return this.createTokenResult(token, config, data.expires_in);
-    } catch (error) {
-      return {
-        success: false,
-        error: `Token fetch failed: ${(error as Error).message}`
-      };
-    }
-  }
-
-  private createTokenResult(
-    token: string,
-    config: JWTAuthConfig,
-    expiresIn?: number
-  ): AuthResult {
-    const cleanToken = parseToken(token);
-    const credentials: AuthCredentials = {
-      type: 'jwt',
-      headers: {
-        'Authorization': `Bearer ${cleanToken}`
-      }
-    };
-
-    // Calculate expiration
-    let expiresAt: number | undefined;
-    if (expiresIn) {
-      expiresAt = Date.now() + expiresIn * 1000;
-    } else {
-      // Try to decode JWT and get exp claim
-      try {
-        const parts = cleanToken.split('.');
-        if (parts.length === 3) {
-          const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
-          if (payload.exp) {
-            expiresAt = payload.exp * 1000;
-          }
-        }
-      } catch {
-        // Ignore decode errors
-      }
-    }
-
-    // Cache if enabled
-    if (config.cache?.enabled !== false && expiresAt) {
-      const ttl = config.cache?.ttl || Math.floor((expiresAt - Date.now()) / 1000);
-      const key = this.getCacheKey(config);
-      authCache.set(key, credentials, ttl);
-    }
-
-    return {
-      success: true,
-      credentials,
-      expiresAt
-    };
-  }
-
-  private getCacheKey(config: JWTAuthConfig): string {
-    const identifier = config.client_id || config.issuer || 'default';
-    return createCacheKey('jwt', identifier);
-  }
-}
-
-interface TokenResponse {
-  access_token: string;
-  token_type?: string;
-  expires_in?: number;
-  refresh_token?: string;
-  scope?: string;
-}