trellis
Version:
Agentic State Engine — event-sourced causal graph with branching, decision traces, and realtime sync for AI-native applications
72 lines • 2.59 kB
TypeScript
/**
* Trellis Server — Auth
*
* Produces an `AuthContext` from a request using one of:
* - Bearer JWT (signed with jwtSecret)
* - API key (compared against configured key)
* - Unauthenticated (public access)
*
* OAuth provider flows (Google, GitHub) are handled separately and ultimately
* issue a JWT, so this module just needs to verify tokens.
*
* @module trellis/server
*/
export interface AuthContext {
/** User entity ID (null = unauthenticated). */
userId: string | null;
/** Tenant ID (null = default tenant). */
tenantId: string | null;
/** Roles assigned to this user. */
roles: string[];
/** Raw JWT claims (if authenticated via JWT). */
claims: Record<string, unknown>;
/** Whether this request passed authentication. */
authenticated: boolean;
}
export declare const ANONYMOUS: AuthContext;
/**
* Sign a JWT payload with HS256.
*/
export declare function signJwt(payload: Record<string, unknown>, secret: string, expiresInSeconds?: number): Promise<string>;
/**
* Verify and decode a JWT. Returns null if invalid or expired.
*/
export declare function verifyJwt(token: string, secret: string): Promise<Record<string, unknown> | null>;
export interface AuthConfig {
/** Secret for JWT verification. Required for JWT auth. */
jwtSecret?: string;
/** Static API key. If set, `Authorization: Bearer <key>` is also accepted. */
apiKey?: string;
/** Allow unauthenticated (public) access. Default: true. */
allowPublic?: boolean;
}
/**
* Resolve an `AuthContext` from an HTTP request's Authorization header.
*/
export declare function resolveAuth(authHeader: string | null | undefined, config: AuthConfig): Promise<AuthContext>;
export interface OAuthProvider {
name: string;
clientId: string;
clientSecret: string;
authUrl: string;
tokenUrl: string;
userInfoUrl: string;
scopes: string[];
}
export declare const GOOGLE_PROVIDER: Omit<OAuthProvider, 'clientId' | 'clientSecret'>;
export declare const GITHUB_PROVIDER: Omit<OAuthProvider, 'clientId' | 'clientSecret'>;
/**
* Build an OAuth authorization redirect URL.
*/
export declare function buildOAuthUrl(provider: OAuthProvider, redirectUri: string, state: string): string;
/**
* Exchange an OAuth code for an access token + user info.
* Returns normalized user profile.
*/
export declare function exchangeOAuthCode(provider: OAuthProvider, code: string, redirectUri: string): Promise<{
id: string;
email: string;
name: string;
avatarUrl?: string;
}>;
//# sourceMappingURL=auth.d.ts.map