@authhero/proxy 0.7.4 → 0.8.0

package/dist/proxy.d.ts

@@ -316,6 +316,46 @@ interface HttpProxyAdapterOptions {
  */
 declare function createHttpProxyAdapter(options: HttpProxyAdapterOptions): ProxyDataAdapter;
 
+/**
+ * Minimal structural view of a Cloudflare KV namespace's read surface. Declared
+ * locally so `@authhero/proxy` stays free of a hard `@cloudflare/workers-types`
+ * dependency — a real `KVNamespace` binding is structurally assignable to this.
+ */
+interface KvNamespaceReader {
+    get<T = unknown>(key: string, type: "json"): Promise<T | null>;
+}
+/**
+ * Minimal structural view of a Cloudflare KV namespace's write surface, consumed
+ * by the control-plane publisher. A real `KVNamespace` is assignable to this.
+ */
+interface KvNamespaceWriter {
+    put(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+declare const DEFAULT_KV_HOST_KEY_PREFIX = "authhero-proxy-host:";
+/**
+ * Build the KV key for a host. Shared by the proxy reader
+ * (`createKvProxyAdapter`) and the control-plane publisher so both agree on the
+ * exact key format. Hosts are lowercased for case-insensitive lookups.
+ */
+declare function buildKvHostKey(keyPrefix: string, host: string): string;
+interface KvProxyAdapterOptions {
+    kv: KvNamespaceReader;
+    keyPrefix?: string;
+    timeoutMs?: number;
+}
+/**
+ * Build a `ProxyDataAdapter` that resolves hosts from a Cloudflare KV namespace.
+ * The control plane publishes the full `ResolvedHost` blob per host into KV; the
+ * proxy reads it with a single, unauthenticated, edge-local `KV.get` — faster
+ * and more reliable on cold reads than the two-hop HTTP control-plane adapter.
+ *
+ * Intended to sit in the `upstream` seam of `createCacheAdapterHostCache` as the
+ * durable-edge layer. A null from KV means "not found"; callers can keep the
+ * HTTP adapter as a miss / `stale-if-error` fallback during cutover.
+ */
+declare function createKvProxyAdapter(options: KvProxyAdapterOptions): ProxyDataAdapter;
+
 /**
  * Scope a control-plane bearer token must carry to call
  * `GET /api/v2/proxy/control-plane/hosts/:host` or `POST /sync`. The data
@@ -324,5 +364,5 @@ declare function createHttpProxyAdapter(options: HttpProxyAdapterOptions): Proxy
  */
 declare const PROXY_RESOLVE_HOST_SCOPE = "proxy:resolve_host";
 
-export { HandlerRegistry, PROXY_RESOLVE_HOST_SCOPE, basicAuthHandler, buildCacheAdapterKey, buildCacheApiKey, buildMatchFilter, cacheHandler, compileHostApp, corsHandler, createCacheAdapterHostCache, createCacheApiHostCache, createHttpProxyAdapter, createInMemoryHostCache, createProxyApp, createProxyDataPlaneHandler, createProxyDataPlaneRouter, createStaticProxyAdapter, defineHandler, dispatchNamespaceHandler, forwardedHeadersHandler, headersHandler, httpHandler, httpRoute, matchesAnyHost, matchesHost, redirectHandler, registerBuiltinHandlers, rewriteCookiesHandler, rewriteLocationHandler, serviceBindingHandler, sortRoutes, staticHandler };
-export type { CacheAdapterHostCacheOptions, CacheApiHostCacheOptions, HandlerBuildContext, HandlerDefinition, HostCacheOptions, HostResolverCache, HttpProxyAdapterOptions, ProxyAppOptions, ProxyDataAdapter, ProxyDataPlaneOptions, ProxyRouteHandlerSpec, ResolvedHost, StaticHostConfig, StaticProxyAdapterOptions, StaticRouteInput };
+export { DEFAULT_KV_HOST_KEY_PREFIX, HandlerRegistry, PROXY_RESOLVE_HOST_SCOPE, basicAuthHandler, buildCacheAdapterKey, buildCacheApiKey, buildKvHostKey, buildMatchFilter, cacheHandler, compileHostApp, corsHandler, createCacheAdapterHostCache, createCacheApiHostCache, createHttpProxyAdapter, createInMemoryHostCache, createKvProxyAdapter, createProxyApp, createProxyDataPlaneHandler, createProxyDataPlaneRouter, createStaticProxyAdapter, defineHandler, dispatchNamespaceHandler, forwardedHeadersHandler, headersHandler, httpHandler, httpRoute, matchesAnyHost, matchesHost, redirectHandler, registerBuiltinHandlers, rewriteCookiesHandler, rewriteLocationHandler, serviceBindingHandler, sortRoutes, staticHandler };
+export type { CacheAdapterHostCacheOptions, CacheApiHostCacheOptions, HandlerBuildContext, HandlerDefinition, HostCacheOptions, HostResolverCache, HttpProxyAdapterOptions, KvNamespaceReader, KvNamespaceWriter, KvProxyAdapterOptions, ProxyAppOptions, ProxyDataAdapter, ProxyDataPlaneOptions, ProxyRouteHandlerSpec, ResolvedHost, StaticHostConfig, StaticProxyAdapterOptions, StaticRouteInput };

package/dist/proxy.mjs

@@ -2376,7 +2376,12 @@ e.array(Pn), e.object({
 	"logins",
 	"signups",
 	"refresh-tokens",
-	"sessions"
+	"sessions",
+	"logouts",
+	"password-changes",
+	"mfa",
+	"email-verifications",
+	"codes-sent"
 ]), e.enum([
 	"hour",
 	"day",
@@ -3330,4 +3335,42 @@ function Yr(e) {
 	};
 }
 //#endregion
-export { F as HandlerRegistry, qr as PROXY_RESOLVE_HOST_SCOPE, Xn as basicAuthHandler, Ur as buildCacheAdapterKey, zr as buildCacheApiKey, Dr as buildMatchFilter, Qn as cacheHandler, Z as compileHostApp, qn as corsHandler, Hr as createCacheAdapterHostCache, Rr as createCacheApiHostCache, Yr as createHttpProxyAdapter, P as createInMemoryHostCache, Nr as createProxyApp, Q as createProxyDataPlaneHandler, Mr as createProxyDataPlaneRouter, Gr as createStaticProxyAdapter, I as defineHandler, xr as dispatchNamespaceHandler, $n as forwardedHeadersHandler, yn as handlerConfigSchema, Zn as headersHandler, fr as httpHandler, Kr as httpRoute, vn as matchSchema, Er as matchesAnyHost, Tr as matchesHost, j as proxyRouteInsertSchema, bn as proxyRouteSchema, xn as proxyRouteUpdateSchema, Sr as redirectHandler, wr as registerBuiltinHandlers, rr as rewriteCookiesHandler, ir as rewriteLocationHandler, gr as serviceBindingHandler, X as sortRoutes, Cr as staticHandler };
+//#region src/kv-adapter/index.ts
+var Xr = "authhero-proxy-host:";
+function Zr(e, t) {
+	return `${e}${t.toLowerCase()}`;
+}
+function Qr() {
+	let e = () => {
+		throw Error("KV proxy adapter does not expose write access to proxy_routes; mutate via the control-plane management API");
+	};
+	return {
+		async create() {
+			return e();
+		},
+		async update() {
+			return e();
+		},
+		async remove() {
+			return e();
+		},
+		async get() {
+			throw Error("KV proxy adapter does not expose per-route reads; use resolveHost");
+		},
+		async list() {
+			throw Error("KV proxy adapter does not expose per-route reads; use resolveHost");
+		}
+	};
+}
+function $r(e) {
+	let { kv: t, keyPrefix: n = Xr, timeoutMs: r } = e;
+	return {
+		proxyRoutes: Qr(),
+		async resolveHost(e) {
+			let i = Zr(n, e), a = t.get(i, "json");
+			return (r && r > 0 ? await J(a, r, "kv.get") : await a) ?? null;
+		}
+	};
+}
+//#endregion
+export { Xr as DEFAULT_KV_HOST_KEY_PREFIX, F as HandlerRegistry, qr as PROXY_RESOLVE_HOST_SCOPE, Xn as basicAuthHandler, Ur as buildCacheAdapterKey, zr as buildCacheApiKey, Zr as buildKvHostKey, Dr as buildMatchFilter, Qn as cacheHandler, Z as compileHostApp, qn as corsHandler, Hr as createCacheAdapterHostCache, Rr as createCacheApiHostCache, Yr as createHttpProxyAdapter, P as createInMemoryHostCache, $r as createKvProxyAdapter, Nr as createProxyApp, Q as createProxyDataPlaneHandler, Mr as createProxyDataPlaneRouter, Gr as createStaticProxyAdapter, I as defineHandler, xr as dispatchNamespaceHandler, $n as forwardedHeadersHandler, yn as handlerConfigSchema, Zn as headersHandler, fr as httpHandler, Kr as httpRoute, vn as matchSchema, Er as matchesAnyHost, Tr as matchesHost, j as proxyRouteInsertSchema, bn as proxyRouteSchema, xn as proxyRouteUpdateSchema, Sr as redirectHandler, wr as registerBuiltinHandlers, rr as rewriteCookiesHandler, ir as rewriteLocationHandler, gr as serviceBindingHandler, X as sortRoutes, Cr as staticHandler };