@dyrected/core 2.6.3 → 2.6.4

package/dist/auth/token.d.ts

@@ -0,0 +1,23 @@
+import { type JWTPayload } from 'jose';
+export interface CollectionTokenPayload extends JWTPayload {
+    sub: string;
+    email: string;
+    collection: string;
+    sid?: string;
+    purpose?: 'invite' | 'reset';
+    providerId?: string;
+    authSource?: 'local' | 'external';
+}
+/**
+ * Issue a signed JWT for a user document in an auth collection.
+ */
+export declare function signCollectionToken(payload: Omit<CollectionTokenPayload, 'iat' | 'exp'>, expiresIn?: string): Promise<string>;
+/**
+ * Verify and decode a collection JWT. Throws if invalid or expired.
+ */
+export declare function verifyCollectionToken(token: string): Promise<CollectionTokenPayload>;
+/**
+ * Decode a token without verification (read-only, for middleware that wants to be non-blocking).
+ */
+export declare function decodeCollectionToken(token: string): CollectionTokenPayload | null;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAGtE,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CACnC;AAeD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,KAAK,GAAG,KAAK,CAAC,EACpD,SAAS,GAAE,MAAuB,GACjC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAG1F;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAMlF"}

package/dist/auth/token.js

@@ -0,0 +1,40 @@
+import { SignJWT, jwtVerify, decodeJwt } from 'jose';
+import { TextEncoder } from 'node:util';
+function getSecret() {
+    const secret = process.env.DYRECTED_JWT_SECRET;
+    if (!secret) {
+        throw new Error('[dyrected/core] DYRECTED_JWT_SECRET is not set. ' +
+            'Add it to your environment variables to enable auth collections.');
+    }
+    return new TextEncoder().encode(secret);
+}
+const DEFAULT_EXPIRY = '7d';
+/**
+ * Issue a signed JWT for a user document in an auth collection.
+ */
+export async function signCollectionToken(payload, expiresIn = DEFAULT_EXPIRY) {
+    return new SignJWT({ ...payload })
+        .setProtectedHeader({ alg: 'HS256' })
+        .setIssuedAt()
+        .setExpirationTime(expiresIn)
+        .sign(getSecret());
+}
+/**
+ * Verify and decode a collection JWT. Throws if invalid or expired.
+ */
+export async function verifyCollectionToken(token) {
+    const { payload } = await jwtVerify(token, getSecret());
+    return payload;
+}
+/**
+ * Decode a token without verification (read-only, for middleware that wants to be non-blocking).
+ */
+export function decodeCollectionToken(token) {
+    try {
+        return decodeJwt(token);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/auth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAYxC,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kDAAkD;YAClD,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAoD,EACpD,YAAoB,cAAc;IAElC,OAAO,IAAI,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;SAC/B,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,SAAS,CAAC;SAC5B,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,OAAO,OAAiC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAA2B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}