Identities and Authentication

import Raily from '@raily/sdk';

const raily = new Raily({
  apiKey: process.env.RAILY_API_KEY
});

// API key is automatically included in all requests
const access = await raily.access.check({
  contentId: "cnt_article_123",
  requesterId: "app_customer_portal"
});

// Configure OAuth for your application
await raily.auth.configureOAuth({
  clientId: process.env.OAUTH_CLIENT_ID,
  clientSecret: process.env.OAUTH_CLIENT_SECRET,
  redirectUri: "https://yourapp.com/auth/callback",
  scopes: ["content.read", "analytics.view"]
});

// Exchange authorization code for access token
const tokens = await raily.auth.exchangeCode({
  code: authCode,
  redirectUri: "https://yourapp.com/auth/callback"
});

// Use access token for authenticated requests
const railyWithToken = new Raily({
  accessToken: tokens.access_token
});

// Configure custom authentication provider
await raily.auth.configureWhiteLabel({
  provider: "custom",
  authEndpoint: "https://auth.yourcompany.com/verify",
  publicKey: process.env.JWT_PUBLIC_KEY
});

// Raily will verify tokens against your auth system
const access = await raily.access.check({
  contentId: "cnt_doc_456",
  customToken: userJWT
});

// Create an application identity
const appIdentity = await raily.identities.create({
  type: "application",
  name: "Customer Portal",
  metadata: {
    environment: "production",
    owner: "engineering@company.com"
  }
});

// Create an organization identity
const orgIdentity = await raily.identities.create({
  type: "organization",
  name: "Acme Corporation",
  metadata: {
    industry: "technology",
    size: "enterprise"
  }
});

// Add attributes to an identity
await raily.identities.addAttributes({
  identityId: appIdentity.id,
  attributes: {
    subscription_tier: "enterprise",
    features: ["api_access", "bulk_download"],
    region: "us-east-1"
  }
});

// Use attributes in access policies
const policy = await raily.policies.create({
  name: "Enterprise Access",
  rules: [{
    action: "allow",
    conditions: {
      "identity.attributes.subscription_tier": "enterprise"
    },
    permissions: ["full_access"]
  }]
});

// Generate short-lived access token
const token = await raily.auth.generateToken({
  identityId: appIdentity.id,
  scope: ["content.read"],
  expiresIn: 3600 // 1 hour
});

// Use token for requests
const response = await fetch(
  `https://api.raily.ai/content/${contentId}`,
  {
    headers: {
      Authorization: `Bearer ${token.access_token}`
    }
  }
);

// Request with refresh token capability
const tokens = await raily.auth.generateTokenPair({
  identityId: appIdentity.id,
  scope: ["content.read"],
  includeRefreshToken: true
});

// Later, refresh the access token
const newTokens = await raily.auth.refreshToken({
  refreshToken: tokens.refresh_token
});

// Enable MFA for an identity
await raily.identities.enableMFA({
  identityId: appIdentity.id,
  method: "totp", // Time-based one-time password
  backupCodes: true
});

// Verify MFA during authentication
const access = await raily.access.check({
  contentId: "cnt_sensitive_data",
  requesterId: appIdentity.id,
  mfaCode: userProvidedCode
});

// List active sessions for an identity
const sessions = await raily.identities.sessions({
  identityId: appIdentity.id,
  status: "active"
});

// Revoke a specific session
await raily.identities.revokeSession({
  sessionId: sessions[0].id,
  reason: "security_audit"
});

// Revoke all sessions (force re-authentication)
await raily.identities.revokeAllSessions({
  identityId: appIdentity.id
});

// Configure SAML integration
await raily.auth.configureSAML({
  entityId: "https://idp.company.com",
  ssoUrl: "https://idp.company.com/sso",
  certificate: samlCertificate,
  attributeMapping: {
    email: "emailAddress",
    name: "displayName",
    groups: "memberOf"
  }
});

// Configure OIDC (OpenID Connect)
await raily.auth.configureOIDC({
  issuer: "https://auth.company.com",
  clientId: process.env.OIDC_CLIENT_ID,
  clientSecret: process.env.OIDC_CLIENT_SECRET
});

// Query authentication logs
const logs = await raily.auth.auditLogs({
  identityId: appIdentity.id,
  eventTypes: ["login", "token_generated", "access_denied"],
  startDate: "2024-01-01",
  endDate: "2024-01-31"
});

// Example log entry
logs.forEach(log => {
  console.log(`${log.timestamp}: ${log.event_type}`);
  console.log(`  Identity: ${log.identity_id}`);
  console.log(`  IP: ${log.ip_address}`);
  console.log(`  Result: ${log.result}`);
});

// Example: Secure authentication pattern
async function secureAccess(contentId, userId) {
  try {
    // 1. Verify user session
    const session = await verifyUserSession(userId);

    // 2. Check access with Raily
    const access = await raily.access.check({
      contentId: contentId,
      requesterId: session.identityId,
      context: {
        ip: session.ipAddress,
        userAgent: session.userAgent,
        purpose: "user_access"
      }
    });

    // 3. Audit the access attempt
    await raily.audit.log({
      event: "content_access",
      identityId: session.identityId,
      contentId: contentId,
      result: access.allowed ? "granted" : "denied"
    });

    return access;
  } catch (error) {
    // Log security errors
    await raily.audit.logError({
      error: error.message,
      identityId: userId
    });
    throw error;
  }
}