@baseworks/auth 0.2.1 → 0.2.3

package/dist/{chunk-NBKMWUCN.js → chunk-5W4TEXCT.js}

@@ -1,3 +1,6 @@
+import {
+  parseJwtPayload
+} from "./chunk-OD5XLL3O.js";
 import {
   generatePkce
 } from "./chunk-34E5PYNA.js";
@@ -69,10 +72,6 @@ async function discoverOidc() {
   if (!response.ok) throw new Error(`Failed to load OIDC discovery document from ${issuer}.`);
   return await response.json();
 }
-function parseJwtPayload(token) {
-  const part = token.split(".")[1] ?? "";
-  return JSON.parse(base64urlDecodeString(part));
-}
 function encodeSessionCookie(session) {
   return base64urlEncode(new TextEncoder().encode(JSON.stringify(session)));
 }
@@ -187,7 +186,7 @@ function sessionFromPayload(payload) {
 }
 function applyTokenCookies(response, request, tokens) {
   const options = getCookieOptions(request);
-  const payload = parseJwtPayload(tokens.id_token);
+  const payload = parseJwtPayload(tokens.id_token) ?? {};
   const expiresAt = payload.exp ?? (tokens.expires_in ? Math.floor(Date.now() / 1e3) + tokens.expires_in : void 0);
   if (!expiresAt) throw new Error("The OIDC ID token did not include an expiry.");
   response.cookies.set(oidcCookies.idToken, tokens.id_token, {
@@ -268,7 +267,7 @@ async function handleAuthorizationCallback(request) {
       redirectUri: getRedirectUri(request),
       tokenEndpoint: discovery.token_endpoint
     });
-    const payload = parseJwtPayload(tokens.id_token);
+    const payload = parseJwtPayload(tokens.id_token) ?? {};
     if (savedNonce && payload.nonce && payload.nonce !== savedNonce) {
       throw new Error("OIDC nonce mismatch.");
     }
@@ -289,7 +288,7 @@ async function getSessionFromCookies() {
   const idToken = cookieStore.get(oidcCookies.idToken)?.value;
   if (idToken) {
     try {
-      return sessionFromPayload(parseJwtPayload(idToken));
+      return sessionFromPayload(parseJwtPayload(idToken) ?? {});
     } catch {
     }
   }
@@ -336,7 +335,7 @@ async function buildSessionResponse(_request) {
       status: 401
     });
   }
-  return NextResponse.json(sessionFromPayload({ ...parseJwtPayload(idToken), exp: expiresAt }));
+  return NextResponse.json(sessionFromPayload({ ...parseJwtPayload(idToken) ?? {}, exp: expiresAt }));
 }
 async function buildTokenResponse(request) {
   const cookieStore = await cookies();

package/dist/{chunk-TXDBQMTY.js → chunk-OD5XLL3O.js}

@@ -1,5 +1,22 @@
 // src/jwt.ts
 import { createHmac, timingSafeEqual } from "crypto";
+import { base64urlDecodeString } from "@baseworks/core";
+function parseJwtPayload(token) {
+  try {
+    const part = token.split(".")[1];
+    if (!part) return null;
+    return JSON.parse(base64urlDecodeString(part));
+  } catch {
+    return null;
+  }
+}
+function signHs256Jwt(claims, secret, expiresInSeconds = 86400) {
+  const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const now = Math.floor(Date.now() / 1e3);
+  const payload = Buffer.from(JSON.stringify({ iat: now, exp: now + expiresInSeconds, ...claims })).toString("base64url");
+  const sig = createHmac("sha256", secret).update(`${header}.${payload}`).digest("base64url");
+  return `${header}.${payload}.${sig}`;
+}
 function verifyHs256Jwt(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3) return null;
@@ -19,5 +36,7 @@ function verifyHs256Jwt(token, secret) {
 }
 
 export {
+  parseJwtPayload,
+  signHs256Jwt,
   verifyHs256Jwt
 };

package/dist/edge.js

@@ -1,6 +1,9 @@
 import {
   getSessionFromCookies
-} from "./chunk-NBKMWUCN.js";
+} from "./chunk-5W4TEXCT.js";
+import {
+  parseJwtPayload
+} from "./chunk-OD5XLL3O.js";
 import "./chunk-34E5PYNA.js";
 import {
   buildPublicUrl,
@@ -10,20 +13,6 @@ import {
 // src/edge.ts
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
-
-// src/_internal.ts
-import { base64urlDecodeString } from "@baseworks/core";
-function parseJwtPayload(token) {
-  try {
-    const part = token.split(".")[1];
-    if (!part) return null;
-    return JSON.parse(base64urlDecodeString(part));
-  } catch {
-    return null;
-  }
-}
-
-// src/edge.ts
 function firstHeader(headerStore, names) {
   for (const name of names) {
     const value = headerStore.get(name);

package/dist/hono.js

@@ -1,6 +1,6 @@
 import {
   verifyHs256Jwt
-} from "./chunk-TXDBQMTY.js";
+} from "./chunk-OD5XLL3O.js";
 
 // src/hono.ts
 async function requireAuth(c, next) {

package/dist/index.js

@@ -1,6 +1,3 @@
-import {
-  verifyHs256Jwt
-} from "./chunk-TXDBQMTY.js";
 import {
   createOidcHumanResolver
 } from "./chunk-6TUNNS2B.js";
@@ -16,6 +13,9 @@ import {
   looksLikeJwt,
   stripBearer
 } from "./chunk-VBIQJKUU.js";
+import {
+  verifyHs256Jwt
+} from "./chunk-OD5XLL3O.js";
 import {
   buildOidcAuthUrl,
   generatePkce

package/dist/jwt.d.ts

@@ -1,3 +1,5 @@
+/** Decode a JWT payload without signature verification. Returns null on malformed input. */
+declare function parseJwtPayload(token: string): Record<string, unknown> | null;
 interface JwtClaims {
     sub?: string;
     exp?: number;
@@ -7,6 +9,8 @@ interface JwtClaims {
     type?: string;
     [key: string]: unknown;
 }
+/** Sign an HS256 JWT. Runtime: Node.js only. */
+declare function signHs256Jwt(claims: JwtClaims, secret: string, expiresInSeconds?: number): string;
 /**
  * Verify an HS256 JWT using Node.js crypto.
  * Returns decoded claims on success, null on any failure.
@@ -14,4 +18,4 @@ interface JwtClaims {
  */
 declare function verifyHs256Jwt(token: string, secret: string): JwtClaims | null;
 
-export { type JwtClaims, verifyHs256Jwt };
+export { type JwtClaims, parseJwtPayload, signHs256Jwt, verifyHs256Jwt };

package/dist/jwt.js

@@ -1,6 +1,10 @@
 import {
+  parseJwtPayload,
+  signHs256Jwt,
   verifyHs256Jwt
-} from "./chunk-TXDBQMTY.js";
+} from "./chunk-OD5XLL3O.js";
 export {
+  parseJwtPayload,
+  signHs256Jwt,
   verifyHs256Jwt
 };

package/dist/session.js

@@ -9,7 +9,8 @@ import {
   handleAuthorizationCallback,
   hasServerOidcSession,
   oidcCookies
-} from "./chunk-NBKMWUCN.js";
+} from "./chunk-5W4TEXCT.js";
+import "./chunk-OD5XLL3O.js";
 import "./chunk-34E5PYNA.js";
 import "./chunk-3NJASEF4.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/auth",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -24,7 +24,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@baseworks/core": "workspace:*",
+    "@baseworks/core": "^0.2.1",
     "jose": "^6.2.3"
   },
   "peerDependencies": {

package/src/edge.ts

@@ -5,7 +5,7 @@ import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { getSessionFromCookies, type OidcSession } from "./session";
 import { buildPublicUrl, normalizeUrlLike } from "./url-helpers";
-import { parseJwtPayload } from "./_internal.js";
+import { parseJwtPayload } from "./jwt.js";
 
 export type EdgeAuthProvider = "anonymous" | "cookie" | "pomerium";
 

package/src/jwt.ts

@@ -1,4 +1,16 @@
 import { createHmac, timingSafeEqual } from 'crypto'
+import { base64urlDecodeString } from '@baseworks/core'
+
+/** Decode a JWT payload without signature verification. Returns null on malformed input. */
+export function parseJwtPayload(token: string): Record<string, unknown> | null {
+  try {
+    const part = token.split('.')[1]
+    if (!part) return null
+    return JSON.parse(base64urlDecodeString(part)) as Record<string, unknown>
+  } catch {
+    return null
+  }
+}
 
 export interface JwtClaims {
   sub?:    string
@@ -10,6 +22,15 @@ export interface JwtClaims {
   [key: string]: unknown
 }
 
+/** Sign an HS256 JWT. Runtime: Node.js only. */
+export function signHs256Jwt(claims: JwtClaims, secret: string, expiresInSeconds = 86400): string {
+  const header  = Buffer.from(JSON.stringify({ alg: 'HS256', typ: 'JWT' })).toString('base64url')
+  const now     = Math.floor(Date.now() / 1000)
+  const payload = Buffer.from(JSON.stringify({ iat: now, exp: now + expiresInSeconds, ...claims })).toString('base64url')
+  const sig     = createHmac('sha256', secret).update(`${header}.${payload}`).digest('base64url')
+  return `${header}.${payload}.${sig}`
+}
+
 /**
  * Verify an HS256 JWT using Node.js crypto.
  * Returns decoded claims on success, null on any failure.

package/src/session.ts

@@ -7,6 +7,7 @@ import { NextResponse } from "next/server";
 import { base64urlEncode, base64urlDecodeString } from "@baseworks/core";
 import { getAuthPublicUrl, normalizeUrlLike } from "./url-helpers";
 import { generatePkce } from "./pkce.js";
+import { parseJwtPayload } from "./jwt.js";
 
 type DiscoveryDocument = {
   authorization_endpoint: string;
@@ -130,10 +131,6 @@ async function discoverOidc() {
   return (await response.json()) as DiscoveryDocument;
 }
 
-function parseJwtPayload(token: string): JwtPayload {
-  const part = token.split(".")[1] ?? "";
-  return JSON.parse(base64urlDecodeString(part)) as JwtPayload;
-}
 
 function encodeSessionCookie(session: OidcSession) {
   return base64urlEncode(new TextEncoder().encode(JSON.stringify(session)));
@@ -285,7 +282,7 @@ function sessionFromPayload(payload: JwtPayload): OidcSession {
 
 function applyTokenCookies(response: NextResponse, request: NextRequest, tokens: TokenResponse) {
   const options = getCookieOptions(request);
-  const payload = parseJwtPayload(tokens.id_token!);
+  const payload = (parseJwtPayload(tokens.id_token!) ?? {}) as JwtPayload;
   const expiresAt =
     payload.exp ??
     (tokens.expires_in ? Math.floor(Date.now() / 1_000) + tokens.expires_in : undefined);
@@ -388,7 +385,7 @@ export async function handleAuthorizationCallback(request: NextRequest) {
       redirectUri: getRedirectUri(request),
       tokenEndpoint: discovery.token_endpoint,
     });
-    const payload = parseJwtPayload(tokens.id_token!);
+    const payload = (parseJwtPayload(tokens.id_token!) ?? {}) as JwtPayload;
     if (savedNonce && payload.nonce && payload.nonce !== savedNonce) {
       throw new Error("OIDC nonce mismatch.");
     }
@@ -410,7 +407,7 @@ export async function getSessionFromCookies(): Promise<OidcSession> {
   const idToken = cookieStore.get(oidcCookies.idToken)?.value;
   if (idToken) {
     try {
-      return sessionFromPayload(parseJwtPayload(idToken));
+      return sessionFromPayload((parseJwtPayload(idToken) ?? {}) as JwtPayload);
     } catch {
       // fall through to compact session cookie
     }
@@ -467,7 +464,7 @@ export async function buildSessionResponse(_request?: NextRequest) {
       status: 401,
     });
   }
-  return NextResponse.json(sessionFromPayload({ ...parseJwtPayload(idToken), exp: expiresAt }));
+  return NextResponse.json(sessionFromPayload({ ...(parseJwtPayload(idToken) ?? {}), exp: expiresAt } as JwtPayload));
 }
 
 export async function buildTokenResponse(request: NextRequest) {

package/src/_internal.ts

@@ -1,14 +0,0 @@
-/**
- * Shared internal utilities — not exported from package public API.
- */
-import { base64urlDecodeString } from '@baseworks/core'
-
-export function parseJwtPayload(token: string): Record<string, unknown> | null {
-  try {
-    const part = token.split('.')[1]
-    if (!part) return null
-    return JSON.parse(base64urlDecodeString(part)) as Record<string, unknown>
-  } catch {
-    return null
-  }
-}