@cocreate/authenticate 1.12.1 → 1.12.3

package/.github/workflows/automated.yml

@@ -3,7 +3,7 @@ name: Automated Workflow
 on:
   push:
     branches:
-      - master
+      - main
 
 jobs:
   about:

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [1.12.2](https://github.com/CoCreate-app/CoCreate-authenticate/compare/v1.12.1...v1.12.2) (2026-07-19)
+
+
+### Bug Fixes
+
+* set default branch to main ([4fcc1e9](https://github.com/CoCreate-app/CoCreate-authenticate/commit/4fcc1e9ebaf17e97641d6c44ea7c99dec96e3c63))
+
 ## [1.12.1](https://github.com/CoCreate-app/CoCreate-authenticate/compare/v1.12.0...v1.12.1) (2026-07-17)
 
 

package/README.md

@@ -1,83 +1,135 @@
-# CoCreate-authenticate
+# @cocreate/authentication
 
-A convenient chain handler allows user to chain multiple CoCreate components together. When one authenticate is complete next one will start. The sequence goes untill all authenticates completed. Grounded on Vanilla javascript, easily configured using HTML5 data-attributes and/or JavaScript API. Take it for a spin in our [playground!](https://cocreate.app/docs/authenticate)
+A high-performance, native RS256 JWT session management and authentication engine. Designed as a zero-dependency ESM singleton cache layer, this engine dynamically provisions 2048-bit RSA keypairs, signs non-opaque session tokens, syncs live connection statuses back to databases via CoCreate CRUD gateways, and runs fast local public-key signature verification to guard distributed nodes against forged requests.
 
-![GitHub latest release](https://img.shields.io/github/v/release/CoCreate-app/CoCreate-authenticate?style=flat-square)
-![GitHub contributors](https://img.shields.io/github/contributors/CoCreate-app/CoCreate-authenticate?style=flat-square)
-![License](https://img.shields.io/static/v1?style=flat-square&label=license&message=SSPL&color=green)
-![Hiring](https://img.shields.io/static/v1?style=flat-square&label=&message=Hiring&color=blueviolet)
+---
 
-![CoCreate-authenticate](https://cdn.cocreate.app/docs/CoCreate-authenticate.gif)
+## Table of Contents
 
-## [Docs & Demo](https://cocreate.app/docs/authenticate)
+* [Features](#features)
+* [Installation](#installation)
+* [Usage](#usage)
+* [How it Works](#how-it-works)
+* [API Reference](#api-reference)
+* [How to Contribute](#how-to-contribute)
+* [License](#license)
 
-For a complete guide and working demo refer to the [doumentation](https://cocreate.app/docs/authenticate)
+---
 
-## CDN
+## Features
 
-```html
-<script src="https://cdn.cocreate.app/authenticate/latest/CoCreate-authenticate.min.js"></script>
-```
+* **Zero-Dependency Native RS256:** Leverages Node's internal `node:crypto` subsystem to sign and verify JSON Web Tokens (JWT) using asymmetric cryptography without relying on massive external dependencies.
+* **Ephemeral Key-Pair Lifecycles:** Automatically provisions 2048-bit RSA key pairs, assigns isolated tracker IDs (`kid`), and handles local cache purging when lifetimes expire.
+* **Multi-Layered Hot Cache:** Accelerates performance by keeping active key pairs and client connections within rapid-access memory structures (`Map`), dropping signature evaluation latency to a minimum.
+* **CRUD Gateway Synchronization:** Seamlessly broadcasts active user sessions and lifecycle states down to persistent target database collections via internal protocol events (`object.update`).
+* **Fast Signature Guard:** Isolates signature validations from state persistence layers, checking incoming signatures against active in-memory keys to drop structural forgery attempts instantly before making database round trips.
 
-```html
-<script src="https://cdn.cocreate.app/authenticate/latest/CoCreate-authenticate.min.css"></script>
-```
+---
 
-## NPM
+## Installation
+
+```bash
+npm install @cocreate/authentication
 
-```shell
-$ npm i @cocreate/authenticate
 ```
 
-# Table of Contents
+---
 
--   [Table of Contents](#table-of-contents)
--   [Announcements](#announcements)
--   [Roadmap](#roadmap)
--   [How to Contribute](#how-to-contribute)
--   [About](#about)
--   [License](#license)
+## Usage
 
-<a name="announcements"></a>
+### Token Issuance (Session Generation)
 
-# Announcements
+Generate a cryptographically signed RS256 token for a successful client connection and synchronize the state into database layers:
 
-All updates to this library are documented in our [CHANGELOG](https://github.com/CoCreate-app/CoCreate-authenticate/blob/master/CHANGELOG.md) and [releases](https://github.com/CoCreate-app/CoCreate-authenticate/releases). You may also subscribe to email for releases and breaking changes.
+```javascript
+import auth from '@cocreate/authentication';
 
-<a name="roadmap"></a>
+const sessionParams = {
+  organization_id: "64b9a32e18f21bc56789abcd",
+  user_id: "64b9a35f18f21bc5e9812456",
+  clientId: "client_ws_90210_alpha",
+  host: "app.cocreate.js"
+};
 
-# Roadmap
+// Creates/reuses keys, signs the JWT, and saves the session
+const token = auth.encodeToken(
+  sessionParams.organization_id,
+  sessionParams.user_id,
+  sessionParams.clientId,
+  sessionParams.host
+);
 
-If you are interested in the future direction of this project, please take a look at our open [issues](https://github.com/CoCreate-app/CoCreate-authenticate/issues) and [pull requests](https://github.com/CoCreate-app/CoCreate-authenticate/pulls). We would love to hear your feedback.
+console.log("Generated JWT:", token);
 
-<a name="about"></a>
+```
 
-# About
+### Token Verification & Decoding
 
-CoCreate-authenticate is guided and supported by the CoCreate Developer Experience Team.
+Intercept incoming request channels, extract identity records, and catch forged signatures locally:
 
-Please Email the Developer Experience Team [here](mailto:develop@cocreate.app) in case of any queries.
+```javascript
+import auth from '@cocreate/authentication';
 
-CoCreate-authenticate is maintained and funded by CoCreate. The names and logos for CoCreate are trademarks of CoCreate, LLC.
+const inboundToken = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6...";
+const context = {
+  organization_id: "64b9a32e18f21bc56789abcd",
+  clientId: "client_ws_90210_alpha",
+  host: "app.cocreate.js"
+};
 
-<a name="contribute"></a>
+// Verifies integrity against local keys and falls back to structural DB records if required
+const session = await auth.decodeToken(
+  inboundToken,
+  context.organization_id,
+  context.clientId,
+  context.host
+);
 
-# How to Contribute
+if (!session.user_id) {
+  console.log("Authentication Failed: Session missing, expired, or signature forged.");
+} else {
+  console.log(`Authenticated User: ${session.user_id}, Expires at: ${session.expires}`);
+}
 
-We encourage contribution to our libraries (you might even score some nifty swag), please see our [CONTRIBUTING](https://github.com/CoCreate-app/CoCreate-authenticate/blob/master/CONTRIBUTING.md) guide for details.
+```
 
-We want this library to be community-driven, and CoCreate led. We need your help to realize this goal. To help make sure we are building the right things in the right order, we ask that you create [issues](https://github.com/CoCreate-app/CoCreate-authenticate/issues) and [pull requests](https://github.com/CoCreate-app/CoCreate-authenticate/pulls) or merely upvote or comment on existing issues or pull requests.
+---
 
-We appreciate your continued support, thank you!
+## How it Works
 
-<a name="license"></a>
+1. **Lifecycle Rotation & Key Selection:** When `encodeToken` runs, the engine checks its active in-memory cache map. It automatically prunes expired keys and searches for a valid, unexpired asymmetric pair. If none are found, it triggers a 2048-bit RSA generation run.
+2. **Asymmetric Envelope Signing:** It constructs standard JSON Web Token blocks (Header with `kid` + Payload with `user_id` and timestamps), serializes them into Base64URL string footprints, and signs the unified buffer natively via an asymmetric SHA-256 algorithm.
+3. **Persisted State Bridging:** Once the token is assembled, the engine logs the structure into local memory slots and issues asynchronous events (`object.update`) down to central arrays to keep database records aligned with client connection parameters.
+4. **Signature Pre-Screening:** During decoding checks (`decodeToken`), the engine parses the incoming header instantly to read the key identification string (`kid`). If that key is cached locally, it executes an direct crypto check (`verifySignature`). Forged payloads are intercepted and dropped right here, skipping down-stream infrastructure operations.
+5. **State Invalidation & Synchronization:** If local signatures check out but matching memory records are absent (e.g., when scaled out across distributed processes), it sends query lookups down to persistent storage (`read`). If the token is verified to be expired or invalid, the engine clears all local tracking points and flags the database to nullify the state.
 
-# License
+---
 
-This software is dual-licensed under the GNU Affero General Public License version 3 (AGPLv3) and a commercial license.
+## API Reference
+
+### Default Manifest Exports
 
--   **Open Source Use**: For open-source projects and non-commercial use, this software is available under the AGPLv3. The AGPLv3 allows you to freely use, modify, and distribute this software, provided that all modifications and derivative works are also licensed under the AGPLv3. For the full license text, see the [LICENSE file](https://github.com/CoCreate-app/CoCreate-authenticate/blob/master/LICENSE).
+| Method Selector | Payload Input Structure | Returns | Role |
+| --- | --- | --- | --- |
+| **`createKeyPair()`** | *None* | `Object` | Generates a new secure 2048-bit RSA key pair object with automatic expiration tracking. |
+| **`deleteKeyPair(keyPair)`** | `keyPair: Object` | `Boolean` | Explicitly removes targeted cryptographic configurations from the local tracking cache. |
+| **`encodeToken(orgId, userId, clientId, host)`** | `String, String, String, String` | `String` | Generates a zero-dependency RS256 token, assigns local session parameters, and pushes changes to databases. |
+| **`decodeToken(token, orgId, clientId, host)`** | `String, String, String, String` | `Object` | Decodes signatures, catches structural forgery attempts instantly, and returns verified identity states. |
+| **`read(orgId, clientId, host)`** | `String, String, String` | `Promise<Object|null>` | Reaches out into data backends via internal CRUD pathways to retrieve active persistent session payloads. |
 
--   **Commercial Use**: For-profit companies and individuals intending to use this software for commercial purposes must obtain a commercial license. The commercial license is available when you sign up for an API key on our [website](https://cocreate.app). This license permits proprietary use and modification of the software without the copyleft requirements of the AGPLv3. It is ideal for integrating this software into proprietary commercial products and applications.
+---
+
+## How to Contribute
+
+We encourage contribution to our libraries (you might even score some nifty swag), please see our [CONTRIBUTING.md](https://github.com/CoCreate-app/CoCreate-authentication/blob/master/CONTRIBUTING.md) guide for details. If you encounter any bugs or wish to make feature requests, please submit an issue on our [GitHub Issues](https://github.com/CoCreate-app/CoCreate-authentication/issues) tracker. We want this library to be community-driven, and CoCreate led. We need your help to realize this goal.
+
+For broader system configurations and API guides, please visit our [CoCreate Authentication Documentation](https://cocreatejs.com/docs/authentication).
+
+---
+
+## License
+
+This software is dual-licensed under the GNU Affero General Public License version 3 (AGPLv3) and a commercial license.
 
-If you have not purchased a commercial license and intend to use this software for commercial purposes, you are required to sign up for an API key on our website.
+* **Open Source Use:** For open-source projects and non-commercial use, this software is available under the AGPLv3. For the full license text, see the LICENSE file.
+* **Commercial Use:** For-profit companies and individuals intending to use this software for commercial purposes must obtain a commercial license. The commercial license is available when you sign up for an API key on our website.

package/package.json

@@ -1,16 +1,22 @@
 {
   "name": "@cocreate/authenticate",
-  "version": "1.12.1",
-  "description": "A simple authenticate component in vanilla javascript. Easily configured using HTML5 data-attributes and/or JavaScript API.",
+  "version": "1.12.3",
+  "description": "A high-performance, zero-dependency ESM session management and authentication engine using native RS256 asymmetric cryptography, ephemeral 2048-bit RSA keypair rotation, and reactive database state synchronization.",
   "keywords": [
-    "authenticate",
-    "low-code",
-    "realtime",
-    "realtime-framework",
-    "collaboration",
-    "shared-editing",
-    "html5-framework",
-    "javascript-framework"
+    "cocreate",
+    "cocreate-app",
+    "authentication",
+    "auth",
+    "jwt",
+    "rs256",
+    "crypto",
+    "session-management",
+    "rsa-2048",
+    "multi-tenant",
+    "token-verification",
+    "zero-dependency",
+    "esm",
+    "security"
   ],
   "scripts": {
     "start": "webpack --config webpack.config.js --watch",
@@ -30,8 +36,5 @@
   },
   "type": "module",
   "main": "./src/index.js",
-  "homepage": "https://cocreate.app/docs/authenticate",
-  "dependencies": {
-    "jsonwebtoken": "^9.0.0"
-  }
+  "homepage": "https://cocreate.app/docs/authenticate"
 }

package/release.config.js

@@ -1,6 +1,6 @@
 export default {
   dryRun: false,
-  branches: ["master"],
+  branches: ["main"],
   plugins: [
     "@semantic-release/commit-analyzer",
     "@semantic-release/release-notes-generator",

package/src/index.js

@@ -20,29 +20,34 @@
 // you must obtain a commercial license from CoCreate LLC.
 // For details, visit <https://cocreate.app/licenses/> or contact us at sales@cocreate.app.
 
-import crypto from 'crypto';
-import jwt from 'jsonwebtoken';
+import crypto from 'node:crypto';
 import crud from '@cocreate/crud-server';
 
-// ==========================================
-// Module-Level Sandbox State (ESM Singleton Container)
-// ==========================================
 const tokenExpiration = 60; // Token expiration in minutes
-const keyPairs = new Map();
-const sessions = new Map();
+const keyPairs = new Map();  // Active public/private cryptographic key pairs
+const sessions = new Map();  // In-memory hot session storage cache
 
 /**
  * Generates a new RSA key pair dynamically and tracks its expiration lifecycle.
  * @returns {Object} Newly created key pair configuration
  */
 function createKeyPair() {
+    // Generate secure 2048-bit RSA keys natively using Node's built-in Crypto module
     const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {
         modulusLength: 2048,
+        publicKeyEncoding: {
+            type: 'spki',
+            format: 'pem'
+        },
+        privateKeyEncoding: {
+            type: 'pkcs8',
+            format: 'pem'
+        }
     });
 
-    const created = new Date(new Date().toISOString()).getTime();
+    const created = Date.now();
     const keyPair = {
-        _id: crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).substring(2),
+        _id: crypto.randomUUID(),
         privateKey,
         publicKey,
         created,
@@ -53,6 +58,7 @@ function createKeyPair() {
     return keyPair;
 }
 
+
 /**
  * Deletes an expired or revoked RSA key pair from local tracking.
  * @param {Object} keyPair - The target key pair to remove
@@ -63,15 +69,35 @@ function deleteKeyPair(keyPair) {
     }
 }
 
+/**
+ * Helper to encode JSON payloads safely as Base64URL string representations
+ */
+function base64urlEncode(obj) {
+    return Buffer.from(JSON.stringify(obj)).toString('base64url');
+}
+
+/**
+ * Helper to decode Base64URL strings safely back to JSON objects
+ */
+function base64urlDecode(str) {
+    try {
+        return JSON.parse(Buffer.from(str, 'base64url').toString('utf8'));
+    } catch {
+        return null;
+    }
+}
+
+
 /**
  * Creates and signs a new token utilizing the latest available RSA key pair.
- * Saves session markers back to storage and registers client tracking nodes.
+ * Generates a zero-dependency RS256 JWT natively.
  */
 function encodeToken(organization_id, user_id, clientId, host) {
     let keyPair = null;
-    const currentTime = new Date(new Date().toISOString()).getTime();
+    const currentTime = Date.now();
     
-    for (let [key, value] of keyPairs) {
+    // Prune expired keypairs and locate/reuse a valid active one
+    for (const [key, value] of keyPairs) {
         if (currentTime > value.expires) {
             deleteKeyPair(value);
         } else {
@@ -83,10 +109,33 @@ function encodeToken(organization_id, user_id, clientId, host) {
         keyPair = createKeyPair();
     }
 
-    const token = jwt.sign({ user_id, clientId }, keyPair.privateKey, { 
-        algorithm: 'RS256', 
-        expiresIn: tokenExpiration * 60 
-    });
+    const iat = Math.floor(currentTime / 1000);
+    const exp = iat + (tokenExpiration * 60);
+
+    // Standard JWT Segments (Header containing Key ID + Alg, and standard Payload)
+    const header = {
+        alg: 'RS256',
+        typ: 'JWT',
+        kid: keyPair._id
+    };
+
+    const payload = {
+        user_id,
+        clientId,
+        iat,
+        exp
+    };
+
+    const encodedHeader = base64urlEncode(header);
+    const encodedPayload = base64urlEncode(payload);
+    const signatureInput = `${encodedHeader}.${encodedPayload}`;
+
+    // Cryptographically sign the envelope natively using SHA-256 and RSA Private Key
+    const signer = crypto.createSign('RSA-SHA256');
+    signer.update(signatureInput);
+    const signature = signer.sign(keyPair.privateKey, 'base64url');
+
+    const token = `${signatureInput}.${signature}`;
 
     const session = { 
         user_id, 
@@ -114,6 +163,7 @@ function encodeToken(organization_id, user_id, clientId, host) {
     return token;
 }
 
+
 /**
  * Reads, parses, and validates the configuration and active state of client sessions.
  */
@@ -137,13 +187,53 @@ async function read(organization_id, clientId, host) {
     return null;
 }
 
+
+/**
+ * Verifies the integrity of a cryptographic token envelope natively.
+ */
+function verifySignature(token, publicKey) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) return false;
+
+        const [header, payload, signature] = parts;
+        const verifier = crypto.createVerify('RSA-SHA256');
+        verifier.update(`${header}.${payload}`);
+
+        return verifier.verify(publicKey, signature, 'base64url');
+    } catch {
+        return false;
+    }
+}
+
 /**
  * Verifies and decodes an incoming session token, resolving the associated user identifier.
+ * Incorporates local RSA public-key validation before hitting session layers.
  */
 async function decodeToken(token, organization_id, clientId, host) {
     if (!token) return {};
     
-    const currentTime = new Date().getTime();
+    const parts = token.split('.');
+    if (parts.length !== 3) return {};
+
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = base64urlDecode(headerB64);
+    const payload = base64urlDecode(payloadB64);
+
+    if (!header || !payload) return {};
+
+    // 1. Core Security Check: Identify active signing keys using Key ID (kid)
+    const keyPair = keyPairs.get(header.kid);
+    if (keyPair) {
+        // Reject forged signatures instantly without proceeding to database/session checks
+        const isValid = verifySignature(token, keyPair.publicKey);
+        if (!isValid) {
+            console.warn(`[SECURITY WARNING] Blocked forged token attempt on clientId: ${clientId}`);
+            return {};
+        }
+    }
+
+    const currentTime = Date.now();
     let session = sessions.get(clientId);
 
     if (!session || session.token !== token) {