release: @marketplaces/auth 0.1.0 (built from main)

dist/ed25519/models/auth-api.model.d.ts

@@ -0,0 +1,36 @@
+import { AdminRole } from './permission.model';
+/** Wire contracts for the Ed25519 challenge/response admin auth flow. */
+export interface AuthChallenge {
+    nonce: string;
+    /** ISO 8601 issue time of the challenge. */
+    issuedAt: string;
+    /** ISO 8601 - challenge must be used before this or the backend rejects it. */
+    expiresAt: string;
+}
+export interface VerifySignatureRequest {
+    publicKey: string;
+    signature: string;
+    nonce: string;
+}
+export interface AuthTokenPair {
+    token: string;
+    refreshToken: string;
+}
+export interface RefreshTokenRequest {
+    refreshToken: string;
+}
+/**
+ * Claims expected in the JWT `token`. Decoded client-side for display/UX
+ * only (role-gating UI, expiry countdown) - the frontend never treats this
+ * as proof of authorization; every admin request is still re-checked
+ * server-side.
+ */
+export interface JwtClaims {
+    sub: string;
+    role: AdminRole;
+    /** Issued-at, seconds since epoch (standard `iat` claim). */
+    iat: number;
+    /** Expiry, seconds since epoch (standard `exp` claim). */
+    exp: number;
+    publicKey: string;
+}

dist/ed25519/models/auth-api.model.js

@@ -0,0 +1 @@
+export {};

dist/ed25519/models/auth-error.model.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Error codes the Ed25519 admin auth flow can surface to the UI. Each maps to
+ * a dedicated screen rather than a generic toast, because the recovery
+ * action differs per code (re-login vs. retry vs. wait).
+ */
+export type AuthErrorCode = 'session-expired' | 'invalid-signature' | 'unauthorized' | 'forbidden' | 'backend-unavailable';
+export interface AuthError {
+    code: AuthErrorCode;
+    message: string;
+    /** HTTP status that produced this error, when known (absent for client-side errors, e.g. no Ed25519 support). */
+    status?: number;
+}
+export declare function authErrorCodeFromBackendCode(code: unknown): AuthErrorCode | undefined;
+/** Maps a backend HTTP status to the AuthErrorCode screen it should route to. */
+export declare function authErrorCodeFromStatus(status: number): AuthErrorCode;

dist/ed25519/models/auth-error.model.js

@@ -0,0 +1,24 @@
+/** Maps a backend error envelope's `error.code` to the client's AuthErrorCode screens. Only codes with a dedicated screen are mapped; anything else falls back to the HTTP-status-derived code via authErrorCodeFromStatus. */
+const BACKEND_ERROR_CODE_MAP = {
+    TOKEN_EXPIRED: 'session-expired',
+    INVALID_SIGNATURE: 'invalid-signature',
+    UNAUTHENTICATED: 'unauthorized',
+    FORBIDDEN: 'forbidden',
+    SERVICE_UNAVAILABLE: 'backend-unavailable',
+};
+export function authErrorCodeFromBackendCode(code) {
+    return typeof code === 'string' ? BACKEND_ERROR_CODE_MAP[code] : undefined;
+}
+/** Maps a backend HTTP status to the AuthErrorCode screen it should route to. */
+export function authErrorCodeFromStatus(status) {
+    switch (status) {
+        case 401:
+            return 'unauthorized';
+        case 403:
+            return 'forbidden';
+        case 0:
+            return 'backend-unavailable';
+        default:
+            return status >= 500 ? 'backend-unavailable' : 'unauthorized';
+    }
+}

dist/ed25519/models/permission.model.d.ts

@@ -0,0 +1,10 @@
+/** Roles the Ed25519 JWT `role` claim is expected to carry. Ordered highest-to-lowest privilege; PermissionService does not rely on the order, it is documentation only. */
+export type AdminRole = 'Owner' | 'Administrator' | 'Editor' | 'Support' | 'ReadOnly';
+/**
+ * Coarse-grained permission keys. Intentionally small and domain-agnostic -
+ * fine-grained, per-domain permissions stay server-side; the frontend only
+ * needs enough to hide/disable UI, never to be the source of truth for
+ * authorization.
+ */
+export type Permission = 'backoffice.read' | 'backoffice.write' | 'builder.read' | 'builder.write' | 'users.manage' | 'settings.manage';
+export declare const ROLE_PERMISSIONS: Readonly<Record<AdminRole, readonly Permission[]>>;

dist/ed25519/models/permission.model.js

@@ -0,0 +1,7 @@
+export const ROLE_PERMISSIONS = {
+    Owner: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write', 'users.manage', 'settings.manage'],
+    Administrator: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write', 'users.manage'],
+    Editor: ['backoffice.read', 'backoffice.write', 'builder.read', 'builder.write'],
+    Support: ['backoffice.read'],
+    ReadOnly: ['backoffice.read', 'builder.read']
+};