@danainnovations/sonance-gate 0.1.0 → 0.2.0

package/README.md

@@ -60,4 +60,20 @@ The gate serves `GET /auth/me` → `{ sub, name, email }` (a fake Dev User outsi
 
 Endpoints: `/auth/signin` (optionally `?returnTo=/path`), `/auth/signout`, `/auth/me`, `/auth/callback` (Okta's redirect URI — register `https://<your-domain>/auth/callback`).
 
+## Identity in backend code (v0.2+)
+
+On every request the gate lets through, it injects an `x-sonance-user` request header (spoof-proof: any client-supplied value is stripped and replaced). Read it with the bundled helper — works in any route handler or server function:
+
+```ts
+import { getUser } from '@danainnovations/sonance-gate'
+
+export async function POST(req: Request) {
+  const user = getUser(req)          // { sub, name, email } | null
+  if (!user) return new Response('unauthenticated', { status: 401 })
+  // ... write rows keyed by user.sub, etc.
+}
+```
+
+Outside production it returns the fake Dev User, so backend code behaves identically in local dev. On `publicPaths` routes it returns `null` unless the visitor happens to have a session.
+
 Sign-out clears the app session and forces a fresh Okta credential prompt on the next visit (your Okta org session for other apps stays alive).

package/dist/index.cjs

@@ -31,7 +31,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   DEV_USER: () => DEV_USER,
-  createGate: () => createGate
+  createGate: () => createGate,
+  getUser: () => getUser
 });
 module.exports = __toCommonJS(index_exports);
 var import_middleware = require("@vercel/functions/middleware");
@@ -197,7 +198,7 @@ async function handleRequest(request, opts = {}, vars = process.env, deps = {})
   if (env.mode === "open") {
     if (path === "/auth/me") return json(DEV_USER);
     if (path === "/auth/signin" || path === "/auth/signout") return redirect("/");
-    return void 0;
+    return { user: DEV_USER };
   }
   if (env.mode === "misconfigured") {
     return new Response(
@@ -278,8 +279,9 @@ async function enforce(request, path, env, opts, deps) {
     const { sub, name, email } = session;
     return json({ sub, name, email });
   }
-  if (isPublic(path, opts.publicPaths)) return void 0;
-  if (session) return void 0;
+  const passUser = session ? { sub: session.sub, name: session.name, email: session.email } : null;
+  if (isPublic(path, opts.publicPaths)) return { user: passUser };
+  if (session) return { user: passUser };
   if (wantsHtml(request)) {
     return startSignin(url, url.pathname + url.search, env, deps, signedOut);
   }
@@ -348,13 +350,34 @@ async function handleCallback(request, url, env, deps) {
 }
 
 // src/index.ts
-function createGate(opts = {}) {
+var USER_HEADER = "x-sonance-user";
+function createGate(opts = {}, vars, deps) {
   return async (request) => {
-    return await handleRequest(request, opts) ?? (0, import_middleware.next)();
+    const result = await handleRequest(request, opts, vars, deps);
+    if (result instanceof Response) return result;
+    const headers = new Headers(request.headers);
+    headers.delete(USER_HEADER);
+    if (result.user) {
+      headers.set(USER_HEADER, Buffer.from(JSON.stringify(result.user)).toString("base64url"));
+    }
+    return (0, import_middleware.next)({ request: { headers } });
   };
 }
+function getUser(source) {
+  const headers = source instanceof Headers ? source : source.headers;
+  const raw = headers.get(USER_HEADER);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString());
+    if (typeof parsed?.sub === "string" && typeof parsed?.email === "string") return parsed;
+    return null;
+  } catch {
+    return null;
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEV_USER,
-  createGate
+  createGate,
+  getUser
 });

package/dist/index.d.cts

@@ -1,12 +1,22 @@
-interface GateOptions {
-    publicPaths?: string[];
-}
-declare const DEV_USER: {
+import { JWTVerifyGetKey } from 'jose';
+
+interface SessionClaims {
     sub: string;
     name: string;
     email: string;
-};
+}
+
+interface GateOptions {
+    publicPaths?: string[];
+}
+interface GateDeps {
+    fetchFn?: typeof fetch;
+    jwks?: JWTVerifyGetKey;
+}
+declare const DEV_USER: SessionClaims;
 
-declare function createGate(opts?: GateOptions): (request: Request) => Promise<Response>;
+declare function createGate(opts?: GateOptions, vars?: Record<string, string | undefined>, deps?: GateDeps): (request: Request) => Promise<Response>;
+/** Read the gate-injected identity from an incoming request (server-side). */
+declare function getUser(source: Request | Headers): SessionClaims | null;
 
-export { DEV_USER, type GateOptions, createGate };
+export { DEV_USER, type GateOptions, type SessionClaims, createGate, getUser };

package/dist/index.d.ts

@@ -1,12 +1,22 @@
-interface GateOptions {
-    publicPaths?: string[];
-}
-declare const DEV_USER: {
+import { JWTVerifyGetKey } from 'jose';
+
+interface SessionClaims {
     sub: string;
     name: string;
     email: string;
-};
+}
+
+interface GateOptions {
+    publicPaths?: string[];
+}
+interface GateDeps {
+    fetchFn?: typeof fetch;
+    jwks?: JWTVerifyGetKey;
+}
+declare const DEV_USER: SessionClaims;
 
-declare function createGate(opts?: GateOptions): (request: Request) => Promise<Response>;
+declare function createGate(opts?: GateOptions, vars?: Record<string, string | undefined>, deps?: GateDeps): (request: Request) => Promise<Response>;
+/** Read the gate-injected identity from an incoming request (server-side). */
+declare function getUser(source: Request | Headers): SessionClaims | null;
 
-export { DEV_USER, type GateOptions, createGate };
+export { DEV_USER, type GateOptions, type SessionClaims, createGate, getUser };

package/dist/index.js

@@ -162,7 +162,7 @@ async function handleRequest(request, opts = {}, vars = process.env, deps = {})
   if (env.mode === "open") {
     if (path === "/auth/me") return json(DEV_USER);
     if (path === "/auth/signin" || path === "/auth/signout") return redirect("/");
-    return void 0;
+    return { user: DEV_USER };
   }
   if (env.mode === "misconfigured") {
     return new Response(
@@ -243,8 +243,9 @@ async function enforce(request, path, env, opts, deps) {
     const { sub, name, email } = session;
     return json({ sub, name, email });
   }
-  if (isPublic(path, opts.publicPaths)) return void 0;
-  if (session) return void 0;
+  const passUser = session ? { sub: session.sub, name: session.name, email: session.email } : null;
+  if (isPublic(path, opts.publicPaths)) return { user: passUser };
+  if (session) return { user: passUser };
   if (wantsHtml(request)) {
     return startSignin(url, url.pathname + url.search, env, deps, signedOut);
   }
@@ -313,12 +314,33 @@ async function handleCallback(request, url, env, deps) {
 }
 
 // src/index.ts
-function createGate(opts = {}) {
+var USER_HEADER = "x-sonance-user";
+function createGate(opts = {}, vars, deps) {
   return async (request) => {
-    return await handleRequest(request, opts) ?? next();
+    const result = await handleRequest(request, opts, vars, deps);
+    if (result instanceof Response) return result;
+    const headers = new Headers(request.headers);
+    headers.delete(USER_HEADER);
+    if (result.user) {
+      headers.set(USER_HEADER, Buffer.from(JSON.stringify(result.user)).toString("base64url"));
+    }
+    return next({ request: { headers } });
   };
 }
+function getUser(source) {
+  const headers = source instanceof Headers ? source : source.headers;
+  const raw = headers.get(USER_HEADER);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString());
+    if (typeof parsed?.sub === "string" && typeof parsed?.email === "string") return parsed;
+    return null;
+  } catch {
+    return null;
+  }
+}
 export {
   DEV_USER,
-  createGate
+  createGate,
+  getUser
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danainnovations/sonance-gate",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Framework-agnostic Sonance Okta SSO gate for Vercel apps (Routing Middleware)",
   "type": "module",
   "main": "./dist/index.cjs",