recker 1.0.20 → 1.0.21-next.ab2d00f

package/dist/plugins/auth/aws-sigv4.js

@@ -0,0 +1,88 @@
+import { createHash, createHmac } from 'node:crypto';
+function sha256(str) {
+    return createHash('sha256').update(str).digest('hex');
+}
+export function awsSignatureV4(options) {
+    return async (req, next) => {
+        const url = new URL(req.url);
+        const host = url.host;
+        const pathname = url.pathname;
+        const queryString = url.search.slice(1);
+        const now = new Date();
+        const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+        const dateStamp = amzDate.slice(0, 8);
+        const method = req.method;
+        const canonicalUri = pathname || '/';
+        const canonicalQueryString = queryString
+            .split('&')
+            .filter(Boolean)
+            .sort()
+            .join('&');
+        let payload = '';
+        if (req.body) {
+            if (typeof req.body === 'string') {
+                payload = req.body;
+            }
+            else if (req.body instanceof ArrayBuffer) {
+                payload = Buffer.from(req.body).toString();
+            }
+        }
+        const payloadHash = sha256(payload);
+        const headers = {
+            host,
+            'x-amz-date': amzDate,
+            'x-amz-content-sha256': payloadHash,
+        };
+        if (options.sessionToken) {
+            headers['x-amz-security-token'] = options.sessionToken;
+        }
+        req.headers.forEach((value, key) => {
+            headers[key.toLowerCase()] = value;
+        });
+        const signedHeaders = Object.keys(headers).sort().join(';');
+        const canonicalHeaders = Object.keys(headers)
+            .sort()
+            .map(key => `${key}:${headers[key].trim()}\n`)
+            .join('');
+        const canonicalRequest = [
+            method,
+            canonicalUri,
+            canonicalQueryString,
+            canonicalHeaders,
+            signedHeaders,
+            payloadHash,
+        ].join('\n');
+        const algorithm = 'AWS4-HMAC-SHA256';
+        const credentialScope = `${dateStamp}/${options.region}/${options.service}/aws4_request`;
+        const stringToSign = [
+            algorithm,
+            amzDate,
+            credentialScope,
+            sha256(canonicalRequest),
+        ].join('\n');
+        const getSignatureKey = (key, dateStamp, regionName, serviceName) => {
+            const kDate = createHmac('sha256', `AWS4${key}`).update(dateStamp).digest();
+            const kRegion = createHmac('sha256', kDate).update(regionName).digest();
+            const kService = createHmac('sha256', kRegion).update(serviceName).digest();
+            const kSigning = createHmac('sha256', kService).update('aws4_request').digest();
+            return kSigning;
+        };
+        const signingKey = getSignatureKey(options.secretAccessKey, dateStamp, options.region, options.service);
+        const signature = createHmac('sha256', signingKey)
+            .update(stringToSign)
+            .digest('hex');
+        const authorizationHeader = `${algorithm} Credential=${options.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+        let newReq = req.withHeader('Authorization', authorizationHeader);
+        newReq = newReq.withHeader('x-amz-date', amzDate);
+        newReq = newReq.withHeader('x-amz-content-sha256', payloadHash);
+        if (options.sessionToken) {
+            newReq = newReq.withHeader('x-amz-security-token', options.sessionToken);
+        }
+        return next(newReq);
+    };
+}
+export function awsSignatureV4Plugin(options) {
+    return (client) => {
+        client.use(awsSignatureV4(options));
+    };
+}

package/dist/plugins/auth/azure-ad.d.ts

@@ -0,0 +1,48 @@
+import { Middleware, Plugin } from '../../types/index.js';
+import { OIDCTokens } from './oidc.js';
+export interface AzureADOptions {
+    tenantId: string;
+    clientId: string;
+    clientSecret?: string;
+    clientCertificate?: {
+        thumbprint: string;
+        privateKey: string;
+    };
+    scopes?: string[];
+    accessToken?: string | (() => string | Promise<string>);
+    refreshToken?: string;
+    tokenStorage?: {
+        get: () => Promise<OIDCTokens | null>;
+        set: (tokens: OIDCTokens) => Promise<void>;
+    };
+    cloudInstance?: string;
+    b2c?: {
+        tenantName: string;
+        policy: string;
+    };
+}
+export declare function generateAzureADAuthUrl(options: AzureADOptions & {
+    redirectUri: string;
+    state?: string;
+    nonce?: string;
+    usePKCE?: boolean;
+    prompt?: 'login' | 'none' | 'consent' | 'select_account';
+    loginHint?: string;
+    domainHint?: string;
+}): Promise<{
+    url: string;
+    codeVerifier?: string;
+}>;
+export declare function exchangeAzureADCode(options: AzureADOptions & {
+    code: string;
+    redirectUri: string;
+    codeVerifier?: string;
+}): Promise<OIDCTokens>;
+export declare function azureADOnBehalfOf(options: AzureADOptions & {
+    assertion: string;
+    scope: string;
+}): Promise<OIDCTokens>;
+export declare function getAzureADUserInfo(accessToken: string): Promise<Record<string, unknown>>;
+export declare function azureAD(options: AzureADOptions): Middleware;
+export declare function azureADPlugin(options: AzureADOptions): Plugin;
+export { azureAD as entraId, azureADPlugin as entraIdPlugin };

package/dist/plugins/auth/azure-ad.js

@@ -0,0 +1,152 @@
+import { oidc, generatePKCE } from './oidc.js';
+function getAzureADIssuer(options) {
+    if (options.b2c) {
+        return `https://${options.b2c.tenantName}.b2clogin.com/${options.b2c.tenantName}.onmicrosoft.com/${options.b2c.policy}/v2.0`;
+    }
+    const cloudInstance = options.cloudInstance || 'https://login.microsoftonline.com';
+    return `${cloudInstance}/${options.tenantId}/v2.0`;
+}
+function getAzureADTokenEndpoint(options) {
+    if (options.b2c) {
+        return `https://${options.b2c.tenantName}.b2clogin.com/${options.b2c.tenantName}.onmicrosoft.com/${options.b2c.policy}/oauth2/v2.0/token`;
+    }
+    const cloudInstance = options.cloudInstance || 'https://login.microsoftonline.com';
+    return `${cloudInstance}/${options.tenantId}/oauth2/v2.0/token`;
+}
+export async function generateAzureADAuthUrl(options) {
+    const pkce = options.usePKCE ? generatePKCE() : undefined;
+    let authorizeUrl;
+    if (options.b2c) {
+        authorizeUrl = `https://${options.b2c.tenantName}.b2clogin.com/${options.b2c.tenantName}.onmicrosoft.com/${options.b2c.policy}/oauth2/v2.0/authorize`;
+    }
+    else {
+        const cloudInstance = options.cloudInstance || 'https://login.microsoftonline.com';
+        authorizeUrl = `${cloudInstance}/${options.tenantId}/oauth2/v2.0/authorize`;
+    }
+    const params = new URLSearchParams({
+        response_type: 'code',
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),
+        response_mode: 'query',
+    });
+    if (options.state) {
+        params.set('state', options.state);
+    }
+    if (options.nonce) {
+        params.set('nonce', options.nonce);
+    }
+    if (pkce) {
+        params.set('code_challenge', pkce.codeChallenge);
+        params.set('code_challenge_method', 'S256');
+    }
+    if (options.prompt) {
+        params.set('prompt', options.prompt);
+    }
+    if (options.loginHint) {
+        params.set('login_hint', options.loginHint);
+    }
+    if (options.domainHint) {
+        params.set('domain_hint', options.domainHint);
+    }
+    return {
+        url: `${authorizeUrl}?${params.toString()}`,
+        codeVerifier: pkce?.codeVerifier,
+    };
+}
+export async function exchangeAzureADCode(options) {
+    const tokenUrl = getAzureADTokenEndpoint(options);
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: options.clientId,
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    if (options.codeVerifier) {
+        params.set('code_verifier', options.codeVerifier);
+    }
+    const response = await fetch(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.json();
+        throw new Error(`Azure AD token exchange failed: ${error.error_description || error.error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        idToken: data.id_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+export async function azureADOnBehalfOf(options) {
+    const tokenUrl = getAzureADTokenEndpoint(options);
+    const params = new URLSearchParams({
+        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+        client_id: options.clientId,
+        assertion: options.assertion,
+        scope: options.scope,
+        requested_token_use: 'on_behalf_of',
+    });
+    if (options.clientSecret) {
+        params.set('client_secret', options.clientSecret);
+    }
+    const response = await fetch(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+    });
+    if (!response.ok) {
+        const error = await response.json();
+        throw new Error(`Azure AD OBO flow failed: ${error.error_description || error.error}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresAt: data.expires_in ? Date.now() + data.expires_in * 1000 : undefined,
+        tokenType: data.token_type || 'Bearer',
+    };
+}
+export async function getAzureADUserInfo(accessToken) {
+    const response = await fetch('https://graph.microsoft.com/v1.0/me', {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to get user info: ${response.status}`);
+    }
+    return response.json();
+}
+export function azureAD(options) {
+    const issuer = getAzureADIssuer(options);
+    const scopes = options.scopes || ['openid', 'profile', 'email', 'offline_access'];
+    return oidc({
+        issuer,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        scopes,
+        accessToken: options.accessToken,
+        refreshToken: options.refreshToken,
+        tokenStorage: options.tokenStorage,
+    });
+}
+export function azureADPlugin(options) {
+    return (client) => {
+        client.use(azureAD(options));
+    };
+}
+export { azureAD as entraId, azureADPlugin as entraIdPlugin };

package/dist/plugins/auth/basic.d.ts

@@ -0,0 +1,7 @@
+import { Middleware, Plugin } from '../../types/index.js';
+export interface BasicAuthOptions {
+    username: string;
+    password: string;
+}
+export declare function basicAuth(options: BasicAuthOptions): Middleware;
+export declare function basicAuthPlugin(options: BasicAuthOptions): Plugin;

package/dist/plugins/auth/basic.js

@@ -0,0 +1,13 @@
+export function basicAuth(options) {
+    const credentials = Buffer.from(`${options.username}:${options.password}`).toString('base64');
+    const authHeader = `Basic ${credentials}`;
+    return async (req, next) => {
+        const newReq = req.withHeader('Authorization', authHeader);
+        return next(newReq);
+    };
+}
+export function basicAuthPlugin(options) {
+    return (client) => {
+        client.use(basicAuth(options));
+    };
+}

package/dist/plugins/auth/bearer.d.ts

@@ -0,0 +1,8 @@
+import { Middleware, Plugin } from '../../types/index.js';
+export interface BearerAuthOptions {
+    token: string | (() => string | Promise<string>);
+    type?: string;
+    headerName?: string;
+}
+export declare function bearerAuth(options: BearerAuthOptions): Middleware;
+export declare function bearerAuthPlugin(options: BearerAuthOptions): Plugin;

package/dist/plugins/auth/bearer.js

@@ -0,0 +1,17 @@
+export function bearerAuth(options) {
+    const type = options.type ?? 'Bearer';
+    const headerName = options.headerName ?? 'Authorization';
+    return async (req, next) => {
+        const token = typeof options.token === 'function'
+            ? await options.token()
+            : options.token;
+        const authHeader = `${type} ${token}`;
+        const newReq = req.withHeader(headerName, authHeader);
+        return next(newReq);
+    };
+}
+export function bearerAuthPlugin(options) {
+    return (client) => {
+        client.use(bearerAuth(options));
+    };
+}

package/dist/plugins/auth/cognito.d.ts

@@ -0,0 +1,45 @@
+import { Middleware, Plugin } from '../../types/index.js';
+export interface CognitoOptions {
+    region: string;
+    userPoolId: string;
+    clientId: string;
+    clientSecret?: string;
+    accessToken?: string | (() => string | Promise<string>);
+    idToken?: string;
+    refreshToken?: string;
+    username?: string;
+    password?: string;
+    useSRP?: boolean;
+    tokenStorage?: {
+        get: () => Promise<CognitoTokens | null>;
+        set: (tokens: CognitoTokens) => Promise<void>;
+    };
+    identityPoolId?: string;
+}
+export interface CognitoTokens {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    tokenType?: string;
+}
+export interface CognitoAWSCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiresAt: number;
+}
+export declare function getCognitoIdentityCredentials(options: {
+    region: string;
+    identityPoolId: string;
+    idToken: string;
+    userPoolId: string;
+}): Promise<CognitoAWSCredentials>;
+export declare function getCognitoHostedUIUrl(options: CognitoOptions & {
+    redirectUri: string;
+    responseType?: 'code' | 'token';
+    scopes?: string[];
+    state?: string;
+}): string;
+export declare function cognito(options: CognitoOptions): Middleware;
+export declare function cognitoPlugin(options: CognitoOptions): Plugin;

package/dist/plugins/auth/cognito.js

@@ -0,0 +1,208 @@
+import { createHmac } from 'node:crypto';
+function generateSecretHash(username, clientId, clientSecret) {
+    return createHmac('sha256', clientSecret)
+        .update(username + clientId)
+        .digest('base64');
+}
+async function authenticateUserPassword(options) {
+    if (!options.username || !options.password) {
+        throw new Error('Username and password are required for USER_PASSWORD_AUTH');
+    }
+    const endpoint = `https://cognito-idp.${options.region}.amazonaws.com/`;
+    const authParameters = {
+        USERNAME: options.username,
+        PASSWORD: options.password,
+    };
+    if (options.clientSecret) {
+        authParameters.SECRET_HASH = generateSecretHash(options.username, options.clientId, options.clientSecret);
+    }
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-amz-json-1.1',
+            'X-Amz-Target': 'AWSCognitoIdentityProviderService.InitiateAuth',
+        },
+        body: JSON.stringify({
+            AuthFlow: 'USER_PASSWORD_AUTH',
+            ClientId: options.clientId,
+            AuthParameters: authParameters,
+        }),
+    });
+    if (!response.ok) {
+        const error = await response.json();
+        throw new Error(`Cognito authentication failed: ${error.message || error.__type}`);
+    }
+    const data = await response.json();
+    if (data.ChallengeName) {
+        throw new Error(`Cognito challenge required: ${data.ChallengeName}`);
+    }
+    if (!data.AuthenticationResult) {
+        throw new Error('Cognito authentication failed: No result');
+    }
+    return {
+        accessToken: data.AuthenticationResult.AccessToken,
+        idToken: data.AuthenticationResult.IdToken,
+        refreshToken: data.AuthenticationResult.RefreshToken,
+        expiresAt: Date.now() + data.AuthenticationResult.ExpiresIn * 1000,
+        tokenType: data.AuthenticationResult.TokenType,
+    };
+}
+async function refreshCognitoTokens(options, refreshToken) {
+    const endpoint = `https://cognito-idp.${options.region}.amazonaws.com/`;
+    const authParameters = {
+        REFRESH_TOKEN: refreshToken,
+    };
+    if (options.clientSecret && options.username) {
+        authParameters.SECRET_HASH = generateSecretHash(options.username, options.clientId, options.clientSecret);
+    }
+    const response = await fetch(endpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-amz-json-1.1',
+            'X-Amz-Target': 'AWSCognitoIdentityProviderService.InitiateAuth',
+        },
+        body: JSON.stringify({
+            AuthFlow: 'REFRESH_TOKEN_AUTH',
+            ClientId: options.clientId,
+            AuthParameters: authParameters,
+        }),
+    });
+    if (!response.ok) {
+        const error = await response.json();
+        throw new Error(`Cognito token refresh failed: ${error.message || error.__type}`);
+    }
+    const data = await response.json();
+    return {
+        accessToken: data.AuthenticationResult.AccessToken,
+        idToken: data.AuthenticationResult.IdToken,
+        refreshToken: refreshToken,
+        expiresAt: Date.now() + data.AuthenticationResult.ExpiresIn * 1000,
+        tokenType: data.AuthenticationResult.TokenType,
+    };
+}
+export async function getCognitoIdentityCredentials(options) {
+    const identityEndpoint = `https://cognito-identity.${options.region}.amazonaws.com/`;
+    const logins = {
+        [`cognito-idp.${options.region}.amazonaws.com/${options.userPoolId}`]: options.idToken,
+    };
+    const getIdResponse = await fetch(identityEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-amz-json-1.1',
+            'X-Amz-Target': 'AWSCognitoIdentityService.GetId',
+        },
+        body: JSON.stringify({
+            IdentityPoolId: options.identityPoolId,
+            Logins: logins,
+        }),
+    });
+    if (!getIdResponse.ok) {
+        const error = await getIdResponse.json();
+        throw new Error(`Failed to get identity ID: ${error.message || error.__type}`);
+    }
+    const { IdentityId } = await getIdResponse.json();
+    const getCredentialsResponse = await fetch(identityEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-amz-json-1.1',
+            'X-Amz-Target': 'AWSCognitoIdentityService.GetCredentialsForIdentity',
+        },
+        body: JSON.stringify({
+            IdentityId,
+            Logins: logins,
+        }),
+    });
+    if (!getCredentialsResponse.ok) {
+        const error = await getCredentialsResponse.json();
+        throw new Error(`Failed to get credentials: ${error.message || error.__type}`);
+    }
+    const data = await getCredentialsResponse.json();
+    return {
+        accessKeyId: data.Credentials.AccessKeyId,
+        secretAccessKey: data.Credentials.SecretKey,
+        sessionToken: data.Credentials.SessionToken,
+        expiresAt: data.Credentials.Expiration * 1000,
+    };
+}
+export function getCognitoHostedUIUrl(options) {
+    const domain = `https://${options.userPoolId.split('_')[1].toLowerCase()}.auth.${options.region}.amazoncognito.com`;
+    const params = new URLSearchParams({
+        response_type: options.responseType || 'code',
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        scope: (options.scopes || ['openid', 'profile', 'email']).join(' '),
+    });
+    if (options.state) {
+        params.set('state', options.state);
+    }
+    return `${domain}/login?${params.toString()}`;
+}
+export function cognito(options) {
+    let cachedTokens = null;
+    const getTokens = async () => {
+        if (options.tokenStorage) {
+            const stored = await options.tokenStorage.get();
+            if (stored) {
+                cachedTokens = stored;
+            }
+        }
+        if (cachedTokens && cachedTokens.expiresAt && cachedTokens.expiresAt > Date.now() + 60000) {
+            return cachedTokens;
+        }
+        if (cachedTokens?.refreshToken || options.refreshToken) {
+            const refreshToken = cachedTokens?.refreshToken || options.refreshToken;
+            try {
+                cachedTokens = await refreshCognitoTokens(options, refreshToken);
+                if (options.tokenStorage) {
+                    await options.tokenStorage.set(cachedTokens);
+                }
+                return cachedTokens;
+            }
+            catch {
+            }
+        }
+        if (options.accessToken) {
+            const token = typeof options.accessToken === 'function'
+                ? await options.accessToken()
+                : options.accessToken;
+            return {
+                accessToken: token,
+                idToken: options.idToken,
+                tokenType: 'Bearer',
+            };
+        }
+        if (options.username && options.password) {
+            cachedTokens = await authenticateUserPassword(options);
+            if (options.tokenStorage) {
+                await options.tokenStorage.set(cachedTokens);
+            }
+            return cachedTokens;
+        }
+        throw new Error('No valid authentication method. Provide accessToken, refreshToken, or username/password.');
+    };
+    return async (req, next) => {
+        const tokens = await getTokens();
+        const authReq = req.withHeader('Authorization', `Bearer ${tokens.accessToken}`);
+        const response = await next(authReq);
+        if (response.status === 401 && (cachedTokens?.refreshToken || options.refreshToken)) {
+            try {
+                const refreshToken = cachedTokens?.refreshToken || options.refreshToken;
+                cachedTokens = await refreshCognitoTokens(options, refreshToken);
+                if (options.tokenStorage) {
+                    await options.tokenStorage.set(cachedTokens);
+                }
+                const retryReq = req.withHeader('Authorization', `Bearer ${cachedTokens.accessToken}`);
+                return next(retryReq);
+            }
+            catch {
+                return response;
+            }
+        }
+        return response;
+    };
+}
+export function cognitoPlugin(options) {
+    return (client) => {
+        client.use(cognito(options));
+    };
+}

package/dist/plugins/auth/digest.d.ts

@@ -0,0 +1,8 @@
+import { Middleware, Plugin } from '../../types/index.js';
+export interface DigestAuthOptions {
+    username: string;
+    password: string;
+    preemptive?: boolean;
+}
+export declare function digestAuth(options: DigestAuthOptions): Middleware;
+export declare function digestAuthPlugin(options: DigestAuthOptions): Plugin;