@ai-digital-factory/identity-manager 1.0.0

package/dist/chunk-7WCGUJ3C.js

@@ -0,0 +1,40 @@
+// src/constants.ts
+var IDENTITY_PATH = "/api/identity/me";
+
+// src/config.ts
+function isPlaceholder(value) {
+  return value.includes("replace_me");
+}
+function normalizeHttpOrigin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function getClientIdentityConfig(env) {
+  const publishableKey = env.VITE_IDENTITY_PUBLISHABLE_KEY?.trim();
+  if (!publishableKey || isPlaceholder(publishableKey)) {
+    return null;
+  }
+  return { publishableKey };
+}
+function getServerIdentityConfig(env) {
+  const secretKey = env.IDENTITY_SECRET_KEY?.trim();
+  const clientOriginValue = env.CLIENT_ORIGIN?.trim();
+  const clientOrigin = clientOriginValue ? normalizeHttpOrigin(clientOriginValue) : null;
+  if (!secretKey || isPlaceholder(secretKey) || !clientOriginValue || isPlaceholder(clientOriginValue) || !clientOrigin) {
+    return null;
+  }
+  return { secretKey, clientOrigin };
+}
+
+export {
+  IDENTITY_PATH,
+  getClientIdentityConfig,
+  getServerIdentityConfig
+};

package/dist/core-DSv5-9oR.d.ts

@@ -0,0 +1,23 @@
+type IdentityStatus = "LOADING" | "SIGNED_OUT" | "SIGNED_IN";
+type IdentityUser = {
+    id: string;
+    userName: string;
+};
+type SignInCredentials = {
+    username: string;
+    password: string;
+};
+type IdentityResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+type IdentityState = {
+    status: IdentityStatus;
+    user: IdentityUser | null;
+    error: string | null;
+    signIn: (credentials: SignInCredentials) => Promise<IdentityResult>;
+};
+
+export type { IdentityUser as I, SignInCredentials as S, IdentityState as a, IdentityResult as b, IdentityStatus as c };

package/dist/express.cjs

@@ -0,0 +1,164 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/express.ts
+var express_exports = {};
+__export(express_exports, {
+  identityMiddleware: () => identityMiddleware,
+  requireIdentity: () => requireIdentity
+});
+module.exports = __toCommonJS(express_exports);
+var import_express = require("@clerk/express");
+var import_cors = __toESM(require("cors"), 1);
+
+// src/constants.ts
+var IDENTITY_PATH = "/api/identity/me";
+
+// src/config.ts
+function isPlaceholder(value) {
+  return value.includes("replace_me");
+}
+function normalizeHttpOrigin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function getServerIdentityConfig(env) {
+  const secretKey = env.IDENTITY_SECRET_KEY?.trim();
+  const clientOriginValue = env.CLIENT_ORIGIN?.trim();
+  const clientOrigin = clientOriginValue ? normalizeHttpOrigin(clientOriginValue) : null;
+  if (!secretKey || isPlaceholder(secretKey) || !clientOriginValue || isPlaceholder(clientOriginValue) || !clientOrigin) {
+    return null;
+  }
+  return { secretKey, clientOrigin };
+}
+
+// src/to-identity-user.ts
+function toIdentityUser(user) {
+  const userName = user.username?.trim() || user.primaryEmailAddress?.emailAddress.trim() || user.id;
+  return {
+    id: user.id,
+    userName
+  };
+}
+
+// src/express.ts
+var middlewareStack = null;
+function getMiddlewareStack() {
+  if (middlewareStack) {
+    return middlewareStack;
+  }
+  const config = getServerIdentityConfig({
+    IDENTITY_SECRET_KEY: process.env.IDENTITY_SECRET_KEY,
+    CLIENT_ORIGIN: process.env.CLIENT_ORIGIN
+  });
+  if (!config) {
+    throw new Error(
+      "Identity configuration required. Set IDENTITY_SECRET_KEY and CLIENT_ORIGIN."
+    );
+  }
+  const clerkClient = (0, import_express.createClerkClient)({ secretKey: config.secretKey });
+  const attachSession = async (req, res, next) => {
+    try {
+      const user = await resolveIdentityUser(req, clerkClient);
+      if (req.method === "GET" && req.path === IDENTITY_PATH) {
+        res.set("Cache-Control", "private, no-store");
+        if (!user) {
+          return res.status(401).json({ error: "Authentication required." });
+        }
+        return res.json({ user });
+      }
+      req.user = user;
+      return next();
+    } catch (error) {
+      return next(error);
+    }
+  };
+  middlewareStack = [
+    (0, import_cors.default)({
+      origin: config.clientOrigin,
+      credentials: true
+    }),
+    (0, import_express.clerkMiddleware)({
+      secretKey: config.secretKey,
+      authorizedParties: [config.clientOrigin]
+    }),
+    attachSession
+  ];
+  return middlewareStack;
+}
+async function resolveIdentityUser(req, clerkClient) {
+  const { userId } = (0, import_express.getAuth)(req);
+  if (!userId) {
+    return null;
+  }
+  const user = await clerkClient.users.getUser(userId);
+  return toIdentityUser({
+    id: user.id,
+    username: user.username,
+    primaryEmailAddress: user.primaryEmailAddress
+  });
+}
+function runMiddlewareStack(stack, req, res, next) {
+  let index = 0;
+  const dispatch = (error) => {
+    if (error) {
+      next(error);
+      return;
+    }
+    const middleware = stack[index];
+    if (!middleware) {
+      next();
+      return;
+    }
+    index += 1;
+    middleware(req, res, dispatch);
+  };
+  dispatch();
+}
+var identityMiddleware = (req, res, next) => {
+  runMiddlewareStack(getMiddlewareStack(), req, res, next);
+};
+var requireIdentity = (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({ error: "Authentication required." });
+  }
+  return next();
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  identityMiddleware,
+  requireIdentity
+});

package/dist/express.d.ts

@@ -0,0 +1,7 @@
+import { RequestHandler } from 'express';
+export { I as IdentityUser } from './core-DSv5-9oR.js';
+
+declare const identityMiddleware: RequestHandler;
+declare const requireIdentity: RequestHandler;
+
+export { identityMiddleware, requireIdentity };

package/dist/express.js

@@ -0,0 +1,105 @@
+import {
+  IDENTITY_PATH,
+  getServerIdentityConfig
+} from "./chunk-7WCGUJ3C.js";
+
+// src/express.ts
+import { createClerkClient, clerkMiddleware, getAuth } from "@clerk/express";
+import cors from "cors";
+
+// src/to-identity-user.ts
+function toIdentityUser(user) {
+  const userName = user.username?.trim() || user.primaryEmailAddress?.emailAddress.trim() || user.id;
+  return {
+    id: user.id,
+    userName
+  };
+}
+
+// src/express.ts
+var middlewareStack = null;
+function getMiddlewareStack() {
+  if (middlewareStack) {
+    return middlewareStack;
+  }
+  const config = getServerIdentityConfig({
+    IDENTITY_SECRET_KEY: process.env.IDENTITY_SECRET_KEY,
+    CLIENT_ORIGIN: process.env.CLIENT_ORIGIN
+  });
+  if (!config) {
+    throw new Error(
+      "Identity configuration required. Set IDENTITY_SECRET_KEY and CLIENT_ORIGIN."
+    );
+  }
+  const clerkClient = createClerkClient({ secretKey: config.secretKey });
+  const attachSession = async (req, res, next) => {
+    try {
+      const user = await resolveIdentityUser(req, clerkClient);
+      if (req.method === "GET" && req.path === IDENTITY_PATH) {
+        res.set("Cache-Control", "private, no-store");
+        if (!user) {
+          return res.status(401).json({ error: "Authentication required." });
+        }
+        return res.json({ user });
+      }
+      req.user = user;
+      return next();
+    } catch (error) {
+      return next(error);
+    }
+  };
+  middlewareStack = [
+    cors({
+      origin: config.clientOrigin,
+      credentials: true
+    }),
+    clerkMiddleware({
+      secretKey: config.secretKey,
+      authorizedParties: [config.clientOrigin]
+    }),
+    attachSession
+  ];
+  return middlewareStack;
+}
+async function resolveIdentityUser(req, clerkClient) {
+  const { userId } = getAuth(req);
+  if (!userId) {
+    return null;
+  }
+  const user = await clerkClient.users.getUser(userId);
+  return toIdentityUser({
+    id: user.id,
+    username: user.username,
+    primaryEmailAddress: user.primaryEmailAddress
+  });
+}
+function runMiddlewareStack(stack, req, res, next) {
+  let index = 0;
+  const dispatch = (error) => {
+    if (error) {
+      next(error);
+      return;
+    }
+    const middleware = stack[index];
+    if (!middleware) {
+      next();
+      return;
+    }
+    index += 1;
+    middleware(req, res, dispatch);
+  };
+  dispatch();
+}
+var identityMiddleware = (req, res, next) => {
+  runMiddlewareStack(getMiddlewareStack(), req, res, next);
+};
+var requireIdentity = (req, res, next) => {
+  if (!req.user) {
+    return res.status(401).json({ error: "Authentication required." });
+  }
+  return next();
+};
+export {
+  identityMiddleware,
+  requireIdentity
+};

package/dist/react.d.ts

@@ -0,0 +1,13 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import { a as IdentityState } from './core-DSv5-9oR.js';
+export { b as IdentityResult, c as IdentityStatus, I as IdentityUser, S as SignInCredentials } from './core-DSv5-9oR.js';
+
+declare function IdentityProvider({ apiBaseUrl, children, }: {
+    apiBaseUrl: string;
+    children: ReactNode;
+}): react.JSX.Element;
+
+declare function useIdentity(): IdentityState;
+
+export { IdentityProvider, IdentityState, useIdentity };

package/dist/react.js

@@ -0,0 +1,171 @@
+"use client";
+import {
+  IDENTITY_PATH,
+  getClientIdentityConfig
+} from "./chunk-7WCGUJ3C.js";
+
+// src/clerk-react.tsx
+import {
+  ClerkProvider,
+  useAuth as useClerkAuth,
+  useClerk,
+  useSignIn
+} from "@clerk/clerk-react";
+import { useCallback, useEffect, useState } from "react";
+
+// src/fetch-identity-user.ts
+async function fetchIdentityUser(apiBaseUrl, getSessionToken) {
+  const token = await getSessionToken();
+  const headers = new Headers();
+  if (token) {
+    headers.set("Authorization", `Bearer ${token}`);
+  }
+  const response = await fetch(
+    `${apiBaseUrl.replace(/\/$/, "")}${IDENTITY_PATH}`,
+    {
+      credentials: "include",
+      headers
+    }
+  );
+  if (response.status === 401) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new Error("Failed to resolve authenticated user.");
+  }
+  const payload = await response.json();
+  return payload.user;
+}
+
+// src/react-context.tsx
+import { createContext, useContext } from "react";
+import { jsx } from "react/jsx-runtime";
+var IdentityContext = createContext(null);
+function IdentityContextProvider({
+  value,
+  children
+}) {
+  return /* @__PURE__ */ jsx(IdentityContext.Provider, { value, children });
+}
+function useIdentity() {
+  const context = useContext(IdentityContext);
+  if (!context) {
+    throw new Error("useIdentity must be used within an IdentityProvider.");
+  }
+  return context;
+}
+
+// src/clerk-react.tsx
+import { jsx as jsx2 } from "react/jsx-runtime";
+function useClerkIdentityState(apiBaseUrl) {
+  const { isLoaded: authLoaded, isSignedIn, getToken } = useClerkAuth();
+  const { isLoaded: signInLoaded, signIn } = useSignIn();
+  const { setActive } = useClerk();
+  const [user, setUser] = useState(null);
+  const [error, setError] = useState(null);
+  const [isResolvingUser, setIsResolvingUser] = useState(false);
+  const refreshUser = useCallback(async () => {
+    if (!isSignedIn) {
+      setUser(null);
+      return;
+    }
+    setIsResolvingUser(true);
+    setError(null);
+    try {
+      const resolvedUser = await fetchIdentityUser(
+        apiBaseUrl,
+        () => getToken()
+      );
+      setUser(resolvedUser);
+    } catch {
+      setUser(null);
+      setError("Failed to resolve authenticated user.");
+    } finally {
+      setIsResolvingUser(false);
+    }
+  }, [apiBaseUrl, getToken, isSignedIn]);
+  useEffect(() => {
+    if (!authLoaded) {
+      return;
+    }
+    void refreshUser();
+  }, [authLoaded, refreshUser]);
+  const status = !authLoaded || !signInLoaded || isResolvingUser ? "LOADING" : isSignedIn && user ? "SIGNED_IN" : "SIGNED_OUT";
+  return {
+    status,
+    user,
+    error,
+    signIn: async (credentials) => {
+      if (!signInLoaded) {
+        return {
+          ok: false,
+          error: "Authentication is still loading. Try again shortly."
+        };
+      }
+      try {
+        const result = await signIn.create({
+          identifier: credentials.username,
+          password: credentials.password
+        });
+        if (result.status !== "complete" || !result.createdSessionId) {
+          return {
+            ok: false,
+            error: "Additional sign-in verification is required."
+          };
+        }
+        await setActive({ session: result.createdSessionId });
+        await refreshUser();
+        return { ok: true };
+      } catch {
+        return { ok: false, error: "Invalid username or password." };
+      }
+    }
+  };
+}
+function ClerkIdentityProvider({
+  apiBaseUrl,
+  publishableKey,
+  children
+}) {
+  return /* @__PURE__ */ jsx2(ClerkProvider, { publishableKey, children: /* @__PURE__ */ jsx2(ClerkIdentityContextProvider, { apiBaseUrl, children }) });
+}
+function ClerkIdentityContextProvider({
+  apiBaseUrl,
+  children
+}) {
+  const value = useClerkIdentityState(apiBaseUrl);
+  return /* @__PURE__ */ jsx2(IdentityContextProvider, { value, children });
+}
+
+// src/provider.tsx
+import { jsx as jsx3, jsxs } from "react/jsx-runtime";
+function IdentityProvider({
+  apiBaseUrl,
+  children
+}) {
+  const config = getClientIdentityConfig({
+    VITE_IDENTITY_PUBLISHABLE_KEY: import.meta.env.VITE_IDENTITY_PUBLISHABLE_KEY
+  });
+  if (!config) {
+    return /* @__PURE__ */ jsx3("main", { children: /* @__PURE__ */ jsxs("section", { children: [
+      /* @__PURE__ */ jsx3("p", { children: "Identity configuration required." }),
+      /* @__PURE__ */ jsxs("p", { children: [
+        "Set ",
+        /* @__PURE__ */ jsx3("code", { children: "VITE_IDENTITY_PUBLISHABLE_KEY" }),
+        " before starting the app."
+      ] })
+    ] }) });
+  }
+  return /* @__PURE__ */ jsx3(
+    ClerkIdentityProvider,
+    {
+      apiBaseUrl,
+      publishableKey: config.publishableKey,
+      children
+    }
+  );
+}
+export {
+  IdentityProvider,
+  useIdentity
+};

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@ai-digital-factory/identity-manager",
+  "version": "1.0.0",
+  "description": "Provider-neutral identity for Vite SPAs and Express API backends.",
+  "type": "module",
+  "exports": {
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
+    "./express": {
+      "types": "./dist/express.d.ts",
+      "import": "./dist/express.js",
+      "require": "./dist/express.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@clerk/clerk-react": "^5.61.6",
+    "@clerk/express": "^1.7.0",
+    "cors": "^2.8.5"
+  },
+  "peerDependencies": {
+    "express": "^4.21.0 || ^5.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@clerk/clerk-react": "^5.61.6",
+    "@clerk/express": "^1.7.0",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.3",
+    "@types/react": "^19.2.2",
+    "@types/react-dom": "^19.2.2",
+    "express": "^5.1.0",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "tsup": "^8.5.0",
+    "vite": "^7.1.5"
+  },
+  "scripts": {
+    "build": "tsup src/react.tsx src/express.ts --format esm --dts --clean --out-dir dist && tsup src/express.ts --format cjs --out-dir dist",
+    "check-types": "tsc --noEmit",
+    "lint": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}