@everystack/auth 0.1.0

package/src/client/index.tsx

@@ -0,0 +1,139 @@
+/**
+ * @everystack/auth/client — React auth context with localStorage persistence.
+ *
+ * Usage:
+ *   import { AuthProvider, useAuth } from '@everystack/auth/client';
+ *
+ *   <AuthProvider>
+ *     <App />
+ *   </AuthProvider>
+ *
+ *   const { user, token, signIn, signUp, signOut, isLoading } = useAuth();
+ */
+
+import React, { createContext, useContext, useState, useEffect, useCallback } from 'react';
+
+export interface AuthUser {
+  id: string;
+  email: string;
+  username: string;
+  displayName: string;
+  avatarUrl?: string | null;
+  role?: string;
+}
+
+export interface AuthContextValue {
+  user: AuthUser | null;
+  token: string | null;
+  isLoading: boolean;
+  signIn: (email: string, password: string) => Promise<void>;
+  signUp: (email: string, password: string, username: string, displayName: string) => Promise<void>;
+  signOut: () => void;
+}
+
+const AuthContext = createContext<AuthContextValue | null>(null);
+
+const TOKEN_KEY = 'everystack-token';
+const REFRESH_KEY = 'everystack-refresh';
+const USER_KEY = 'everystack-user';
+
+export const storage = {
+  getToken(): string | null {
+    try { return localStorage.getItem(TOKEN_KEY); } catch { return null; }
+  },
+  getRefresh(): string | null {
+    try { return localStorage.getItem(REFRESH_KEY); } catch { return null; }
+  },
+  getUser(): AuthUser | null {
+    try {
+      const s = localStorage.getItem(USER_KEY);
+      return s ? JSON.parse(s) : null;
+    } catch { return null; }
+  },
+  save(token: string, refresh: string, user: AuthUser): void {
+    try {
+      localStorage.setItem(TOKEN_KEY, token);
+      localStorage.setItem(REFRESH_KEY, refresh);
+      localStorage.setItem(USER_KEY, JSON.stringify(user));
+    } catch {}
+  },
+  clear(): void {
+    try {
+      localStorage.removeItem(TOKEN_KEY);
+      localStorage.removeItem(REFRESH_KEY);
+      localStorage.removeItem(USER_KEY);
+    } catch {}
+  },
+};
+
+export function AuthProvider({ children }: { children: React.ReactNode }): React.ReactElement {
+  const [user, setUser] = useState<AuthUser | null>(null);
+  const [token, setToken] = useState<string | null>(null);
+  const [isLoading, setIsLoading] = useState(true);
+
+  useEffect(() => {
+    const savedToken = storage.getToken();
+    const savedUser = storage.getUser();
+    if (savedToken && savedUser) {
+      setToken(savedToken);
+      setUser(savedUser);
+    }
+    setIsLoading(false);
+  }, []);
+
+  const signIn = useCallback(async (email: string, password: string) => {
+    const res = await fetch('/api/auth/signin', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+    });
+
+    const body = await res.json();
+
+    if (!res.ok) {
+      throw new Error(body.error || 'Sign in failed');
+    }
+
+    storage.save(body.token, body.refreshToken, body.user);
+    setToken(body.token);
+    setUser(body.user);
+  }, []);
+
+  const signUp = useCallback(async (email: string, password: string, username: string, displayName: string) => {
+    const res = await fetch('/api/auth/signup', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password, username, displayName }),
+    });
+
+    const body = await res.json();
+
+    if (!res.ok) {
+      throw new Error(body.error || 'Sign up failed');
+    }
+
+    storage.save(body.token, body.refreshToken, body.user);
+    setToken(body.token);
+    setUser(body.user);
+  }, []);
+
+  const signOut = useCallback(() => {
+    // Clear server-side cookies (best-effort, don't block UI)
+    fetch('/api/auth/signout', { method: 'POST' }).catch(() => {});
+    storage.clear();
+    setToken(null);
+    setUser(null);
+  }, []);
+
+  return (
+    <AuthContext.Provider value={{ user, token, isLoading, signIn, signUp, signOut }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth(): AuthContextValue {
+  const ctx = useContext(AuthContext);
+  if (!ctx) throw new Error('useAuth must be used within AuthProvider');
+  return ctx;
+}

package/src/context.ts

@@ -0,0 +1,30 @@
+/**
+ * SSR auth context via AsyncLocalStorage.
+ *
+ * The SSR handler wraps each request in `runWithAuthContext(user, fn)`.
+ * Inside that scope, SSR loaders call `getAuthContext()` to read the
+ * authenticated user's claims without prop-drilling or global mutation.
+ */
+
+import { AsyncLocalStorage } from 'node:async_hooks';
+import type { TokenPayload } from './index';
+
+const authStore = new AsyncLocalStorage<TokenPayload | null>();
+
+/**
+ * Run a function with auth context available via getAuthContext().
+ */
+export function runWithAuthContext<T>(
+  user: TokenPayload | null,
+  fn: () => T | Promise<T>,
+): T | Promise<T> {
+  return authStore.run(user, fn);
+}
+
+/**
+ * Get the current auth context from within an SSR loader.
+ * Returns null if no authenticated user or not within an SSR request.
+ */
+export function getAuthContext(): TokenPayload | null {
+  return authStore.getStore() ?? null;
+}

package/src/cookies.ts

@@ -0,0 +1,93 @@
+/**
+ * Cookie serialization and parsing utilities for SSR authentication.
+ *
+ * Access token cookie is sent on all requests (Path=/).
+ * Refresh token cookie is scoped to the refresh endpoint only (Path=/api/auth/refresh).
+ * Both are HttpOnly + Secure + SameSite=Lax.
+ */
+
+export const COOKIE_NAMES = {
+  token: '__es_token',
+  refresh: '__es_refresh',
+} as const;
+
+export interface CookieOptions {
+  /** Custom domain for cookies. Omit for exact-origin match (most secure). */
+  domain?: string;
+  /** Base path for the token cookie. Default '/'. */
+  path?: string;
+  /** Whether to set Secure flag. Default true. Set false for localhost dev. */
+  secure?: boolean;
+  /** Access token max-age in seconds. Default 3600 (1 hour). */
+  tokenMaxAge?: number;
+  /** Refresh token max-age in seconds. Default 604800 (7 days). */
+  refreshMaxAge?: number;
+}
+
+/**
+ * Build Set-Cookie header values for access + refresh tokens.
+ * Returns an array of two Set-Cookie strings.
+ */
+export function serializeAuthCookies(
+  token: string,
+  refreshToken: string,
+  opts?: CookieOptions,
+): string[] {
+  const secure = opts?.secure !== false;
+  const domain = opts?.domain ? `; Domain=${opts.domain}` : '';
+  const basePath = opts?.path ?? '/';
+  const tokenMaxAge = opts?.tokenMaxAge ?? 3600;
+  const refreshMaxAge = opts?.refreshMaxAge ?? 604800;
+
+  return [
+    `${COOKIE_NAMES.token}=${token}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=${basePath}; Max-Age=${tokenMaxAge}${domain}`,
+    `${COOKIE_NAMES.refresh}=${refreshToken}; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/api/auth/refresh; Max-Age=${refreshMaxAge}${domain}`,
+  ];
+}
+
+/**
+ * Build Set-Cookie header values that clear auth cookies (Max-Age=0).
+ */
+export function clearAuthCookies(opts?: CookieOptions): string[] {
+  const secure = opts?.secure !== false;
+  const domain = opts?.domain ? `; Domain=${opts.domain}` : '';
+  const basePath = opts?.path ?? '/';
+
+  return [
+    `${COOKIE_NAMES.token}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=${basePath}; Max-Age=0${domain}`,
+    `${COOKIE_NAMES.refresh}=; HttpOnly; ${secure ? 'Secure; ' : ''}SameSite=Lax; Path=/api/auth/refresh; Max-Age=0${domain}`,
+  ];
+}
+
+/**
+ * Parse a Cookie header string into a key-value map.
+ */
+export function parseCookies(header: string): Record<string, string> {
+  const cookies: Record<string, string> = {};
+  for (const pair of header.split(';')) {
+    const idx = pair.indexOf('=');
+    if (idx === -1) continue;
+    const key = pair.slice(0, idx).trim();
+    const val = pair.slice(idx + 1).trim();
+    if (key) cookies[key] = val;
+  }
+  return cookies;
+}
+
+/**
+ * Extract the access token from a Cookie header string.
+ */
+export function getTokenFromCookies(cookieHeader: string | null): string | null {
+  if (!cookieHeader) return null;
+  const cookies = parseCookies(cookieHeader);
+  return cookies[COOKIE_NAMES.token] ?? null;
+}
+
+/**
+ * Extract the refresh token from a Cookie header string.
+ */
+export function getRefreshFromCookies(cookieHeader: string | null): string | null {
+  if (!cookieHeader) return null;
+  const cookies = parseCookies(cookieHeader);
+  return cookies[COOKIE_NAMES.refresh] ?? null;
+}