@baseworks/auth 0.2.5 → 1.0.2

package/src/cli.ts

@@ -1,8 +1,8 @@
 /**
- * Importable `login` / `logout` commands for any CLI that authenticates through
- * an auth-service (OIDC/PKCE device flow). Mirrors the `@baseworks/org/cli` and
- * `@baseworks/iam/cli` pattern — the commands live in auth's own package; the
- * app composes them:
+ * Importable `login` / `logout` / `auth status` commands for any CLI that
+ * authenticates through an auth-service (OIDC/PKCE device flow). Mirrors the
+ * `@baseworks/org/cli` and `@baseworks/iam/cli` pattern — the commands live in
+ * auth's own package; the app composes them:
  *
  *   import { addAuthCommands } from '@baseworks/auth/cli'
  *   addAuthCommands(program, { authBase, cliName: 'dtab', onToken, onLogout })
@@ -12,10 +12,15 @@
  * HS256) that org-service and iam-service verify with the shared realm secret —
  * so ONE login token works across the whole plane. Org context is not in the
  * token; the app resolves it via org-service (`use` / `ls`).
+ *
+ * Storage stays with the app: this module never touches the filesystem. Pass
+ * `onToken` / `onLogout` to persist, and `getToken` to enable `auth status`.
  */
 import { spawn } from 'node:child_process'
 import { Command } from 'commander'
 import { clr, kv, success, warn, fatal } from '@baseworks/cli/display'
+import { fmtRelative } from '@baseworks/cli/fmt'
+import { parseJwtPayload } from './jwt.js'
 import { startCliAuth, pollCliAuth } from './cli-auth.js'
 
 export interface AuthCliDeps {
@@ -28,6 +33,18 @@ export interface AuthCliDeps {
   onLogout?: () => void | Promise<void>
   /** Open the browser automatically (default true). */
   openBrowser?: boolean
+  /**
+   * Read the saved identity token. Providing it registers `<cli> auth status`,
+   * and lets `logout` warn when a token is still reachable afterwards — an
+   * environment variable that outranks the config file, typically.
+   */
+  getToken?: () => string | undefined
+  /** Where the token came from, for display: a config path, or an env var name. */
+  tokenOrigin?: () => string | undefined
+  /** Extra rows for `auth status`, e.g. the API base URL the app will call. */
+  statusRows?: () => [string, string][]
+  /** One-line hint printed after a successful login. */
+  nextSteps?: string
 }
 
 function resolveBase(b: AuthCliDeps['authBase']): string {
@@ -42,14 +59,60 @@ function openInBrowser(url: string): void {
   try { spawn(cmd, args, { stdio: 'ignore', detached: true }).unref() } catch { /* print fallback below */ }
 }
 
-/** Decode a JWT payload without verifying (display only). */
-function jwtSub(token: string): string | undefined {
-  try {
-    const seg = token.split('.')[1]
-    if (!seg) return undefined
-    const json = Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
-    return (JSON.parse(json) as { sub?: string }).sub
-  } catch { return undefined }
+interface IdentityClaims {
+  sub?: string
+  exp?: number
+  iss?: string
+  type?: string
+}
+
+/**
+ * Read the token's claims WITHOUT verifying the signature — display only.
+ * Verification is the server's job; a CLI holds no key and needs none.
+ */
+function claimsOf(token: string): IdentityClaims {
+  return (parseJwtPayload(token) ?? {}) as IdentityClaims
+}
+
+function expiryLine(claims: IdentityClaims): string {
+  if (!claims.exp) return 'unknown'
+  const at = new Date(claims.exp * 1000).toISOString().replace('T', ' ').slice(0, 16)
+  return `${at} UTC (${fmtRelative(claims.exp)})`
+}
+
+/** `<cli> auth` and `<cli> auth status` — what the saved token says, no network. */
+export function buildAuthCommand(deps: AuthCliDeps): Command {
+  const cli = deps.cliName ?? 'cli'
+
+  const status = (): void => {
+    const token = deps.getToken?.()
+    if (!token) fatal(`not signed in — run \`${cli} login\``)
+
+    const claims = claimsOf(token)
+    const rows: [string, string][] = [...(deps.statusRows?.() ?? [])]
+    rows.push(['user', claims.sub ?? 'unknown'])
+    rows.push(['token type', claims.type ?? 'unknown'])
+    // `iss` is absent from tokens minted before the realm started claiming one;
+    // an empty row would be noise, so show it only when it is there.
+    if (claims.iss) rows.push(['issuer', claims.iss])
+    rows.push(['expires', expiryLine(claims)])
+    const origin = deps.tokenOrigin?.()
+    if (origin) rows.push(['token from', origin])
+    kv(rows)
+
+    if (claims.exp && claims.exp * 1000 <= Date.now()) {
+      console.log('')
+      fatal(`the token has expired — run \`${cli} login\``)
+    }
+    console.log('')
+  }
+
+  const cmd = new Command('auth')
+    .description('Show the current sign-in (alias: auth status)')
+    .action(status)
+
+  cmd.addCommand(new Command('status').description('Show the current sign-in').action(status))
+  return cmd
 }
 
 export function addAuthCommands(program: Command, deps: AuthCliDeps): void {
@@ -67,13 +130,23 @@ export function addAuthCommands(program: Command, deps: AuthCliDeps): void {
         console.log(`  ${clr.dim}If it does not open, visit:${clr.reset}\n  ${clr.cyan}${start.url}${clr.reset}\n`)
         if (deps.openBrowser !== false && opts.open !== false) openInBrowser(start.url)
 
-        const { token } = await pollCliAuth(base, start.state).catch((e: Error) => fatal(e.message))
+        // Without this the command sits silent for minutes and looks hung.
+        const minutes = Math.max(1, Math.round(start.expiresIn / 60))
+        console.log(`  ${clr.dim}Waiting for approval — the link is valid for ${minutes}m…${clr.reset}`)
+
+        // Stop exactly when the server drops the state, not before: a shorter
+        // client timeout would report failure while the link still works.
+        const { token } = await pollCliAuth(base, start.state, { timeoutMs: start.expiresIn * 1000 })
+          .catch((e: Error) => fatal(e.message))
         await deps.onToken(token)
 
-        const sub = jwtSub(token)
+        const claims = claimsOf(token)
         success('Logged in.')
-        if (sub) kv([['user id', sub]])
-        console.log(`  ${clr.dim}Next: ${cli} use  ·  ${cli} orgs${clr.reset}\n`)
+        const rows: [string, string][] = []
+        if (claims.sub) rows.push(['user', claims.sub])
+        if (claims.exp) rows.push(['expires', expiryLine(claims)])
+        if (rows.length) kv(rows)
+        console.log(`  ${clr.dim}Next: ${deps.nextSteps ?? `${cli} use  ·  ${cli} orgs`}${clr.reset}\n`)
       }),
   )
 
@@ -84,6 +157,20 @@ export function addAuthCommands(program: Command, deps: AuthCliDeps): void {
         if (deps.onLogout) await deps.onLogout()
         else warn('No logout handler configured.')
         success('Logged out.')
+
+        // A token in the environment outranks the config file, so clearing the
+        // file alone can leave the user still signed in without knowing it.
+        const leftover = deps.getToken?.()
+        if (leftover) {
+          const origin = deps.tokenOrigin?.()
+          warn(`A token is still in effect${origin ? ` (${origin})` : ''} and takes precedence.`)
+        }
+        console.log(
+          `  ${clr.dim}The token stays valid on the server until it expires; there is no server-side revocation.${clr.reset}\n`,
+        )
       }),
   )
+
+  // `auth status` only makes sense when the app can hand back what it stored.
+  if (deps.getToken) program.addCommand(buildAuthCommand(deps))
 }

package/src/hono.ts

@@ -1,11 +1,12 @@
 import type { Context, Next } from 'hono'
-import { verifyHs256Jwt } from './jwt.js'
+import { verifier, type IdentityClaims, type Verifier } from './identity.js'
 
 export interface ServiceAuthUser {
   userId:    string
   orgId?:    string
   role?:     string
-  tokenType: 'user' | 'service'
+  email?:    string
+  tokenType: 'user' | 'service' | 'assistant'
 }
 
 declare module 'hono' {
@@ -15,26 +16,79 @@ declare module 'hono' {
 }
 
 /**
- * Hono middleware — verifies HS256 JWT from Authorization: Bearer header.
- * Reads JWT_SECRET from process.env.
- * Sets c.var.auth on success.
+ * Where the realm's public keys are, and what to expect in a token.
+ *
+ * Read from the environment so a service picks this up with no code of its own:
+ *
+ *   AUTH_JWKS_URI   e.g. https://auth.example.com/.well-known/jwks.json
+ *   AUTH_ISSUER     expected `iss`; unset means "do not check"
+ *   AUTH_AUDIENCE   expected `aud`; unset means "do not check"
+ *   JWT_SECRET      legacy HS256 secret, accepted alongside ES256 while set
+ *
+ * With only JWT_SECRET set, behaviour is exactly what it was before JWKS
+ * existed, so a service can be upgraded before the realm has keys.
+ */
+function fromEnv(env: NodeJS.ProcessEnv): Verifier | { error: string } {
+  const jwksUri = env['AUTH_JWKS_URI']
+  const legacy = env['JWT_SECRET']
+  if (!jwksUri && !legacy) {
+    return { error: 'neither AUTH_JWKS_URI nor JWT_SECRET is configured' }
+  }
+  return verifier({
+    ...(jwksUri ? { jwksUri } : {}),
+    ...(env['AUTH_ISSUER'] ? { issuer: env['AUTH_ISSUER'] } : {}),
+    ...(env['AUTH_AUDIENCE'] ? { audience: env['AUTH_AUDIENCE'] } : {}),
+    ...(legacy ? { legacyHs256Secret: legacy } : {}),
+  })
+}
+
+// Built once: the verifier owns a JWKS cache, and rebuilding it per request
+// would refetch the key set on every call.
+let cachedVerifier: Verifier | { error: string } | undefined
+
+/** Tests change the environment between cases. */
+export function resetAuthVerifier(): void {
+  cachedVerifier = undefined
+}
+
+function claimsToUser(claims: IdentityClaims): ServiceAuthUser {
+  const type = claims.type
+  return {
+    userId:    String(claims.sub ?? ''),
+    orgId:     claims['org_id'] as string | undefined,
+    role:      claims['role'] as string | undefined,
+    email:     claims['email'] as string | undefined,
+    // Anything unrecognised is treated as a user token: `service` and
+    // `assistant` open doors a plain user token must not, so they are named
+    // explicitly and everything else falls to the least privileged reading.
+    tokenType: type === 'service' ? 'service' : type === 'assistant' ? 'assistant' : 'user',
+  }
+}
+
+/**
+ * Hono middleware — verifies the realm's identity token from
+ * `Authorization: Bearer` and sets `c.var.auth`.
+ *
+ * ES256 verified against the realm's published JWKS, plus HS256 while a legacy
+ * secret is configured. The shared secret is a migration door: any service
+ * holding it can also MINT tokens, including one claiming to be another user,
+ * so it should be removed once the realm issues ES256 everywhere.
  */
 export async function requireAuth(c: Context, next: Next) {
   const header = c.req.header('Authorization')
   if (!header?.startsWith('Bearer ')) return c.json({ error: 'Unauthorized' }, 401)
 
-  const token  = header.slice(7)
-  const secret = process.env['JWT_SECRET']
-  if (!secret) return c.json({ error: 'JWT_SECRET not configured' }, 500)
+  cachedVerifier ??= fromEnv(process.env)
+  if (typeof cachedVerifier !== 'function') {
+    // A misconfigured service must not look like a rejected caller: 500 tells
+    // the operator it is their problem, 401 would send the user in circles.
+    console.error(`[auth] ${cachedVerifier.error}`)
+    return c.json({ error: 'auth is not configured' }, 500)
+  }
 
-  const claims = verifyHs256Jwt(token, secret)
+  const claims = await cachedVerifier(header.slice(7))
   if (!claims) return c.json({ error: 'Unauthorized' }, 401)
 
-  c.set('auth', {
-    userId:    String(claims['sub'] ?? ''),
-    orgId:     claims['org_id'] as string | undefined,
-    role:      claims['role'] as string | undefined,
-    tokenType: claims['type'] === 'service' ? 'service' : 'user',
-  })
+  c.set('auth', claimsToUser(claims))
   return next()
 }

package/src/identity.ts

@@ -0,0 +1,224 @@
+/**
+ * Realm identity tokens: minting, publication and verification.
+ *
+ * One realm has one issuer — its auth-service — and one signing key pair. Every
+ * other service in the realm (org, iam, billing, pay, and each product API)
+ * verifies with the PUBLIC key it fetches from `/.well-known/jwks.json`, and
+ * therefore cannot mint anything.
+ *
+ * That asymmetry is the whole point. With a shared HMAC secret, every service
+ * holding it can also *issue* tokens — including one that claims to be another
+ * user. This is not theoretical: a product API was found minting
+ * `{ sub: <some other user>, type: 'user' }` to write a membership on that
+ * user's behalf. Under ES256 that is impossible by construction: the private
+ * key never leaves auth-service.
+ *
+ * Claims: `iss`, `aud`, `sub`, `iat`, `exp`, `jti`, `type`. Org and role are
+ * deliberately absent — membership changes while a token lives, so a token that
+ * carries a role goes stale and lies. Consumers ask the org service instead.
+ *
+ * HS256 stays available during migration; see `verifier()` below.
+ */
+
+import {
+  SignJWT,
+  jwtVerify,
+  exportJWK,
+  importPKCS8,
+  importSPKI,
+  calculateJwkThumbprint,
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  type JSONWebKeySet,
+  type JWK,
+} from 'jose'
+
+export const IDENTITY_ALG = 'ES256'
+
+/** `human` signs in; `service` is a service acting as itself; `assistant` is a narrowed token. */
+export type IdentityType = 'human' | 'service' | 'assistant'
+
+export interface IdentityClaims {
+  sub: string
+  type: IdentityType
+  iss?: string
+  aud?: string
+  exp?: number
+  iat?: number
+  jti?: string
+  /** Narrowed tokens carry the org they are scoped to; identity tokens do not. */
+  org_id?: string
+  scope?: string
+  [key: string]: unknown
+}
+
+export interface SigningKey {
+  privateKey: CryptoKey
+  /** Published in the JWKS and in every token header, so verifiers pick the right key. */
+  kid: string
+  publicJwk: JWK
+}
+
+// ─── Key material ────────────────────────────────────────────────────────────
+
+/**
+ * Accept a PEM as-is, or base64 of a PEM.
+ *
+ * Environment variables and PEM disagree about newlines: a key pasted into a
+ * shell, a Kubernetes Secret or a CI variable loses them often enough that
+ * requiring raw PEM guarantees confusing failures. Base64 survives every one of
+ * those paths, so both forms are accepted.
+ */
+function toPem(raw: string, label: 'PRIVATE' | 'PUBLIC'): string {
+  const value = raw.trim()
+  if (value.includes('-----BEGIN')) return value.replace(/\\n/g, '\n')
+  const decoded = Buffer.from(value, 'base64').toString('utf8')
+  if (decoded.includes('-----BEGIN')) return decoded.trim()
+  throw new Error(`not a ${label} key: expected PEM, or base64 of PEM`)
+}
+
+async function jwkOf(key: CryptoKey, kid?: string): Promise<JWK> {
+  const jwk = await exportJWK(key)
+  jwk.alg = IDENTITY_ALG
+  jwk.use = 'sig'
+  // A thumbprint (RFC 7638) is derived from the key itself, so the same key
+  // always gets the same id and two different keys can never collide. Deriving
+  // beats configuring: one less value to keep in step across services.
+  jwk.kid = kid ?? (await calculateJwkThumbprint(jwk))
+  return jwk
+}
+
+/** Load the signing key pair from a PKCS#8 private key. */
+export async function loadSigningKey(privateKeyPem: string, kid?: string): Promise<SigningKey> {
+  const pem = toPem(privateKeyPem, 'PRIVATE')
+  const privateKey = await importPKCS8(pem, IDENTITY_ALG, { extractable: true })
+  const publicJwk = await jwkOf(privateKey, kid)
+  // The private half must never reach the JWKS; exportJWK on a private key
+  // returns `d`, and publishing it would hand the realm away.
+  delete publicJwk.d
+  return { privateKey, kid: publicJwk.kid as string, publicJwk }
+}
+
+/** Load a public key (SPKI PEM) for publication only — a retired key during rotation. */
+export async function loadPublicKey(publicKeyPem: string, kid?: string): Promise<JWK> {
+  const key = await importSPKI(toPem(publicKeyPem, 'PUBLIC'), IDENTITY_ALG, { extractable: true })
+  return jwkOf(key, kid)
+}
+
+/**
+ * The document served at `/.well-known/jwks.json`.
+ *
+ * Rotation works by publishing both keys for longer than a token lives: add the
+ * new key, sign with it, keep the old one listed until every token signed by it
+ * has expired, then drop it.
+ */
+export function jwks(signing: SigningKey, retired: JWK[] = []): JSONWebKeySet {
+  return { keys: [signing.publicJwk, ...retired] }
+}
+
+// ─── Minting ─────────────────────────────────────────────────────────────────
+
+export interface MintOptions {
+  issuer: string
+  audience: string
+  expiresInSeconds: number
+}
+
+export async function mint(
+  key: SigningKey,
+  claims: IdentityClaims,
+  opts: MintOptions,
+): Promise<string> {
+  const { sub, type, ...rest } = claims
+  return new SignJWT({ type, ...rest })
+    .setProtectedHeader({ alg: IDENTITY_ALG, kid: key.kid })
+    .setSubject(sub)
+    .setIssuer(opts.issuer)
+    .setAudience(opts.audience)
+    .setIssuedAt()
+    // A unique id per token is what makes a future revocation list possible;
+    // without it a leaked token cannot be named, only waited out.
+    .setJti(crypto.randomUUID())
+    .setExpirationTime(`${opts.expiresInSeconds}s`)
+    .sign(key.privateKey)
+}
+
+// ─── Verification ────────────────────────────────────────────────────────────
+
+export interface VerifierOptions {
+  /** Where to fetch the realm's public keys. jose caches and refetches on an unknown `kid`. */
+  jwksUri?: string
+  /** A fixed key set instead of a URL — for tests, or a service that ships with the realm. */
+  jwks?: JSONWebKeySet
+  issuer?: string
+  audience?: string
+  /**
+   * Accept HS256 tokens signed with this shared secret, in addition to ES256.
+   *
+   * Migration only. While it is set, any holder of the secret can still mint
+   * tokens for this realm — including tokens impersonating a user — so it must
+   * be removed once every issuer has moved to ES256.
+   */
+  legacyHs256Secret?: string
+}
+
+export interface Verifier {
+  (token: string): Promise<IdentityClaims | null>
+}
+
+/**
+ * Build a verifier for the realm.
+ *
+ * Returns `null` rather than throwing on every rejection: a caller answering an
+ * HTTP request wants one 401 path, not a taxonomy of crypto errors. Reasons
+ * worth acting on (an unreachable JWKS, say) surface through `onError`.
+ */
+export function verifier(opts: VerifierOptions & { onError?: (err: unknown) => void }): Verifier {
+  if (!opts.jwksUri && !opts.jwks && !opts.legacyHs256Secret) {
+    throw new Error('verifier needs jwksUri, jwks, or legacyHs256Secret')
+  }
+
+  const keys = opts.jwks
+    ? createLocalJWKSet(opts.jwks)
+    : opts.jwksUri
+      ? createRemoteJWKSet(new URL(opts.jwksUri))
+      : undefined
+
+  const legacy = opts.legacyHs256Secret
+    ? new TextEncoder().encode(opts.legacyHs256Secret)
+    : undefined
+
+  const expectations = {
+    ...(opts.issuer ? { issuer: opts.issuer } : {}),
+    ...(opts.audience ? { audience: opts.audience } : {}),
+  }
+
+  return async (token: string): Promise<IdentityClaims | null> => {
+    if (keys) {
+      try {
+        const { payload } = await jwtVerify(token, keys, {
+          ...expectations,
+          algorithms: [IDENTITY_ALG],
+        })
+        return payload as unknown as IdentityClaims
+      } catch (err) {
+        // Fall through to the legacy secret when one is configured: during
+        // migration both kinds of token are in circulation at once.
+        if (!legacy) {
+          opts.onError?.(err)
+          return null
+        }
+      }
+    }
+
+    if (!legacy) return null
+    try {
+      // Legacy tokens predate iss/aud, so those are not required of them.
+      const { payload } = await jwtVerify(token, legacy, { algorithms: ['HS256'] })
+      return payload as unknown as IdentityClaims
+    } catch (err) {
+      opts.onError?.(err)
+      return null
+    }
+  }
+}

package/src/index.ts

@@ -21,20 +21,6 @@ export { hashToken, looksLikeJwt, stripBearer } from './token';
 export { signHs256Jwt, verifyHs256Jwt } from './jwt';
 export type { JwtClaims } from './jwt';
 
-// URL helpers (auth/account public URLs, login/logout URL builders)
-export {
-  normalizeUrlLike,
-  getAuthPublicUrl,
-  getAccountPublicUrl,
-  getAppBasePath,
-  getPublicSiteUrl,
-  buildPublicUrl,
-  buildAuthLoginUrl,
-  buildAuthLogoutUrl,
-  buildAccountProfileUrl,
-} from './url-helpers';
-
-// Next.js session + edge exports are intentionally NOT re-exported here.
-// Use subpath imports: @baseworks/auth/session, @baseworks/auth/edge
-// This keeps the main index Worker-safe (no next/server dependency).
-
+// Browser sessions are not here. Signing a person in, and keeping them signed
+// in, is auth-service's job: this package is what a consumer shares, not a
+// second place to run a login.

package/src/jwt.ts

@@ -18,6 +18,7 @@ export interface JwtClaims {
   iat?:    number
   org_id?: string
   role?:   string
+  email?:  string
   type?:   string
   [key: string]: unknown
 }

package/dist/chunk-3NJASEF4.js

@@ -1,69 +0,0 @@
-// src/url-helpers.ts
-function normalizeUrlLike(value) {
-  if (value === "/") return "";
-  return value.replace(/\/+$/, "");
-}
-function joinPublicUrl(base, path = "") {
-  const normalizedBase = normalizeUrlLike(base);
-  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-  if (!normalizedBase) return normalizedPath;
-  if (/^https?:\/\//.test(normalizedBase)) {
-    return new URL(normalizedPath, `${normalizedBase}/`).toString();
-  }
-  return `${normalizedBase}${normalizedPath}`;
-}
-function getAuthPublicUrl() {
-  return normalizeUrlLike(process.env.NEXT_PUBLIC_AUTH_URL ?? "/auth");
-}
-function getAccountPublicUrl() {
-  return normalizeUrlLike(process.env.NEXT_PUBLIC_ACCOUNT_URL ?? "/account");
-}
-function getAppBasePath(defaultPath = "") {
-  return normalizeUrlLike(
-    process.env.NEXT_PUBLIC_APP_BASE_PATH ?? process.env.APP_BASE_PATH ?? defaultPath
-  );
-}
-function getPublicSiteUrl() {
-  return normalizeUrlLike(process.env.APP_PUBLIC_URL ?? process.env.NEXT_PUBLIC_SITE_URL ?? "");
-}
-function buildPublicUrl(pathOrUrl, fallbackOrigin) {
-  if (/^https?:\/\//.test(pathOrUrl)) return pathOrUrl;
-  const origin = getPublicSiteUrl() || fallbackOrigin;
-  if (!origin) return pathOrUrl;
-  return new URL(pathOrUrl, `${normalizeUrlLike(origin)}/`).toString();
-}
-function buildAuthUrl(path, redirectTo, origin) {
-  const target = joinPublicUrl(getAuthPublicUrl(), path);
-  const targetIsAbsolute = /^https?:\/\//.test(target);
-  const fallbackOrigin = "http://localhost";
-  const url = new URL(target, origin ?? fallbackOrigin);
-  url.searchParams.set("redirectTo", redirectTo);
-  const href = url.toString();
-  if (origin || targetIsAbsolute) return href;
-  return href.replace(fallbackOrigin, "");
-}
-function buildAuthLoginUrl(redirectTo, origin) {
-  return buildAuthUrl("/login", redirectTo, origin);
-}
-function buildAuthLogoutUrl(redirectTo, origin) {
-  return buildAuthUrl(
-    "/logout",
-    process.env.NEXT_PUBLIC_SIGN_OUT_REDIRECT_URL ?? redirectTo,
-    origin
-  );
-}
-function buildAccountProfileUrl() {
-  return joinPublicUrl(getAccountPublicUrl(), "/profile");
-}
-
-export {
-  normalizeUrlLike,
-  getAuthPublicUrl,
-  getAccountPublicUrl,
-  getAppBasePath,
-  getPublicSiteUrl,
-  buildPublicUrl,
-  buildAuthLoginUrl,
-  buildAuthLogoutUrl,
-  buildAccountProfileUrl
-};