# Strapi Plugin OBO Auth

This plugin provides a secure On-Behalf-Of (OBO) token exchange endpoint for Strapi v5. It is designed for microservice architectures where a middle-tier service needs to perform actions on a downstream Strapi API on behalf of an authenticated user without exposing the user's original JWT.

## Features

- ✅ **Strapi v5 Compatible** - Built specifically for Strapi v5
- ✅ **Admin Panel Interface** - Full admin panel integration with settings and testing
- ✅ **API Endpoint** - RESTful API for token exchange
- ✅ **Secure Token Validation** - Validates incoming JWTs using Strapi's JWT secret
- ✅ **User Verification** - Ensures user exists and is not blocked
- ✅ **Settings Management** - Configurable settings through admin panel

# How it Works

1. A client authenticates with your primary Strapi instance (or any IdP) and receives a JWT.
2. The client sends this JWT to a trusted middle-tier service.
3. The middle-tier service calls the `/api/obo-auth/exchange-token` endpoint provided by this plugin.
4. The plugin validates the initial JWT and issues a new, short-lived JWT.
5. The middle-tier service uses this new JWT to securely communicate with the downstream Strapi API.

# Installation

```bash
# Using npm
npm install strapi-plugin-obo-auth

# Using yarn
yarn add strapi-plugin-obo-auth

# Using pnpm
pnpm add strapi-plugin-obo-auth
```

# Configuration

Ensure your Strapi application has a `JWT_SECRET` configured in your `.env` file, as this is used to validate the incoming token.

File: `.env`
```
JWT_SECRET=your-super-secret-jwt-secret
```

Then, enable the plugin by creating or editing the `./config/plugins.js` file:
```javascript
module.exports = {
  'strapi-plugin-obo-auth': {
    enabled: true,
  },
};
```

## Admin Panel

After installation, you'll find the OBO Auth plugin in your Strapi admin panel:

1. **Main Interface**: Navigate to the "OBO Auth" section in the left sidebar
2. **Token Testing**: Use the built-in interface to test token exchange
3. **Settings**: Configure plugin settings in Settings → OBO Auth Settings

### Admin Panel Features

- **Token Exchange Interface**: Test the token exchange functionality directly from the admin panel
- **Settings Management**: Configure plugin behavior and token expiration
- **API Documentation**: Built-in API documentation and examples
- **Real-time Testing**: Test tokens without leaving the admin interface

# API Endpoint

- Method: `POST`
- Path: `/api/obo-auth/exchange-token`
- Body:
```
{
  "token": "<initial_strapi_jwt>"
}
```
- Success Response:
```json
{
  "jwt": "<new_strapi_jwt>",
  "user": { ... }
}
```

# Development

## Version Management

This plugin includes a Makefile for easy version management and publishing:

```bash
# Show current version
make version

# Increment versions
make patch    # 1.0.0 -> 1.0.1
make minor    # 1.0.0 -> 1.1.0
make major    # 1.0.0 -> 2.0.0

# Publish to npm
make publish

# Increment and publish in one command
make publish-patch
make publish-minor
make publish-major

# Full release workflow (version + publish + git tag)
make full-release-patch
make full-release-minor
make full-release-major

# Other useful commands
make clean           # Clean build artifacts
make validate        # Validate package.json
make dry-publish     # Test what would be published
make check-published # Check if package exists in npm
```

## Requirements

- Node.js >= 18.0.0
- Strapi v5.0.0 or higher
- npm >= 6.0.0

## License

MIT