@drawnagency/primitives 0.1.53 → 0.1.55

package/dist/auth/cookies.d.ts

@@ -2,7 +2,10 @@ import type { Session, CookieLike } from "./types";
 export declare const SESSION_COOKIE = "bp-session";
 export declare const AUDIENCE_COOKIE = "bp-audience";
 export declare const SESSION_MAX_AGE_SECONDS: number;
+export declare const AUDIENCE_MAX_AGE_SECONDS: number;
 export declare function signSessionToken(session: Session): Promise<string>;
 export declare function verifySessionToken(token: string): Promise<Session | null>;
+export declare function signAudienceToken(audience: string): Promise<string>;
+export declare function verifyAudienceToken(token: string): Promise<string | null>;
 export declare function setSessionCookie(cookies: CookieLike, token: string, isProduction: boolean): void;
 //# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AAEpD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,uBAAuB,QAAe,CAAC;AACpD,eAAO,MAAM,wBAAwB,QAAoB,CAAC;AAE1D,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAe/E;AAMD,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMzE;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS/E;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,GACpB,IAAI,CAQN"}

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export type { Role, Session, SiteUser, Audience, SignInMethod, SignInResult, TokenExchangeType, TokenExchangeResult, AuthProvider, CookieLike, AuthContext, } from "./types";
 export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
-export { signSessionToken, verifySessionToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS } from "./cookies";
+export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
 export { LastOwnerError } from "./errors";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAC7I,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,IAAI,EACJ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAC/M,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC"}

package/dist/auth/index.js

@@ -1,12 +1,15 @@
 import {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
-} from "../chunk-YEOGH3QH.js";
+} from "../chunk-B5VYSTPB.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,
@@ -15,6 +18,7 @@ import {
 import "../chunk-WKZ7OENC.js";
 export {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
@@ -22,6 +26,8 @@ export {
   requireSessionSecret,
   safeNextPath,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
 };

package/dist/{chunk-YEOGH3QH.js → chunk-B5VYSTPB.js}

@@ -7,6 +7,7 @@ import * as jose from "jose";
 var SESSION_COOKIE = "bp-session";
 var AUDIENCE_COOKIE = "bp-audience";
 var SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
+var AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 async function signSessionToken(session) {
   return new jose.SignJWT({
     userId: session.userId,
@@ -18,7 +19,7 @@ async function signSessionToken(session) {
 async function verifySessionToken(token) {
   const secret = requireSessionSecret();
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const role = payload.role;
     if (role !== "owner" && role !== "editor") return null;
     return {
@@ -31,6 +32,19 @@ async function verifySessionToken(token) {
     return null;
   }
 }
+async function signAudienceToken(audience) {
+  return new jose.SignJWT({ audience }).setProtectedHeader({ alg: "HS256" }).setExpirationTime(`${AUDIENCE_MAX_AGE_SECONDS}s`).setIssuedAt().sign(requireSessionSecret());
+}
+async function verifyAudienceToken(token) {
+  const secret = requireSessionSecret();
+  try {
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
+    const audience = payload.audience;
+    return typeof audience === "string" && audience !== "" ? audience : null;
+  } catch {
+    return null;
+  }
+}
 function setSessionCookie(cookies, token, isProduction) {
   cookies.set(SESSION_COOKIE, token, {
     httpOnly: true,
@@ -53,8 +67,11 @@ export {
   SESSION_COOKIE,
   AUDIENCE_COOKIE,
   SESSION_MAX_AGE_SECONDS,
+  AUDIENCE_MAX_AGE_SECONDS,
   signSessionToken,
   verifySessionToken,
+  signAudienceToken,
+  verifyAudienceToken,
   setSessionCookie,
   LastOwnerError
 };

package/dist/index.js

@@ -61,13 +61,16 @@ import {
 } from "./chunk-24SUF2BC.js";
 import {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   LastOwnerError,
   SESSION_COOKIE,
   SESSION_MAX_AGE_SECONDS,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
+  verifyAudienceToken,
   verifySessionToken
-} from "./chunk-YEOGH3QH.js";
+} from "./chunk-B5VYSTPB.js";
 import {
   isSameOriginRequest,
   requireSessionSecret,
@@ -100,6 +103,7 @@ import {
 } from "./chunk-DKOUFIP6.js";
 export {
   AUDIENCE_COOKIE,
+  AUDIENCE_MAX_AGE_SECONDS,
   AudienceColorSchema,
   AudienceNameSchema,
   AudienceSchema,
@@ -177,8 +181,10 @@ export {
   sanitizeMediaName,
   setMediaProvider,
   setSessionCookie,
+  signAudienceToken,
   signSessionToken,
   slugifyAudienceName,
   toSectionId,
+  verifyAudienceToken,
   verifySessionToken
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drawnagency/primitives",
-  "version": "0.1.53",
+  "version": "0.1.55",
   "type": "module",
   "exports": {
     "./package.json": "./package.json",

package/src/auth/cookies.ts

@@ -5,6 +5,7 @@ import { requireSessionSecret } from "./security";
 export const SESSION_COOKIE = "bp-session";
 export const AUDIENCE_COOKIE = "bp-audience";
 export const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24;
+export const AUDIENCE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 
 export async function signSessionToken(session: Session): Promise<string> {
   return new jose.SignJWT({
@@ -22,7 +23,7 @@ export async function signSessionToken(session: Session): Promise<string> {
 export async function verifySessionToken(token: string): Promise<Session | null> {
   const secret = requireSessionSecret();  // throws on misconfiguration, before try
   try {
-    const { payload } = await jose.jwtVerify(token, secret);
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
     const role = payload.role;
     if (role !== "owner" && role !== "editor") return null;
     return {
@@ -36,6 +37,29 @@ export async function verifySessionToken(token: string): Promise<Session | null>
   }
 }
 
+// The audience cookie must be unforgeable: middleware trusts its value to gate
+// viewer content, so it carries a signed JWT, not a plaintext audience name.
+// SESSION_SECRET is generated per-site by the provisioner, so the signature
+// alone also prevents cross-site replay — no siteId claim needed.
+export async function signAudienceToken(audience: string): Promise<string> {
+  return new jose.SignJWT({ audience })
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime(`${AUDIENCE_MAX_AGE_SECONDS}s`)
+    .setIssuedAt()
+    .sign(requireSessionSecret());
+}
+
+export async function verifyAudienceToken(token: string): Promise<string | null> {
+  const secret = requireSessionSecret(); // throws on misconfiguration, before try
+  try {
+    const { payload } = await jose.jwtVerify(token, secret, { algorithms: ["HS256"] });
+    const audience = payload.audience;
+    return typeof audience === "string" && audience !== "" ? audience : null;
+  } catch {
+    return null;
+  }
+}
+
 export function setSessionCookie(
   cookies: CookieLike,
   token: string,

package/src/auth/index.ts

@@ -13,5 +13,5 @@ export type {
 } from "./types";
 
 export { requireSessionSecret, isSameOriginRequest, safeNextPath } from "./security";
-export { signSessionToken, verifySessionToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS } from "./cookies";
+export { signSessionToken, verifySessionToken, signAudienceToken, verifyAudienceToken, setSessionCookie, SESSION_COOKIE, AUDIENCE_COOKIE, SESSION_MAX_AGE_SECONDS, AUDIENCE_MAX_AGE_SECONDS } from "./cookies";
 export { LastOwnerError } from "./errors";

package/src/components/shell/EditorShell.tsx

@@ -444,7 +444,7 @@ export default function EditorShell({
           if (restoredContent) {
             return {
               section: { id, ...restoredContent },
-              meta: restoredIndex.sections[id] ?? existing?.meta ?? { type: restoredContent.type, status: "draft", access: ["internal"] },
+              meta: restoredIndex.sections[id] ?? existing?.meta ?? { type: restoredContent.type, status: "draft", access: [] },
             };
           }
           if (existing) {