@geekmidas/auth 0.0.4 → 0.1.0

package/dist/lambda/jwt.d.mts

@@ -0,0 +1,52 @@
+import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-DH8CJ2xC.mjs";
+import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
+//#region src/lambda/jwt.d.ts
+interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
+  config: JwtConfig;
+  extraction?: TokenExtractionOptions;
+  wildcardResource?: boolean;
+  getPrincipalId?: (claims: TClaims) => string;
+  getContext?: (claims: TClaims) => Record<string, string | number | boolean> | undefined;
+  authorize?: (claims: TClaims) => boolean | Promise<boolean>;
+}
+/**
+ * JWT Lambda Authorizer
+ *
+ * @example
+ * ```typescript
+ * const authorizer = new JwtAuthorizer({
+ *   config: {
+ *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',
+ *     issuer: 'https://auth.example.com',
+ *   },
+ *   getContext: (claims) => ({ userId: claims.sub! }),
+ * });
+ *
+ * // TOKEN authorizer
+ * export const tokenHandler = authorizer.tokenHandler();
+ *
+ * // REQUEST authorizer
+ * export const requestHandler = authorizer.requestHandler();
+ * ```
+ */
+declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
+  private readonly verifier;
+  private readonly extraction;
+  private readonly wildcardResource;
+  private readonly getPrincipalId;
+  private readonly getContext?;
+  private readonly authorize?;
+  constructor(options: JwtAuthorizerOptions<TClaims>);
+  /**
+   * Returns a TOKEN authorizer handler
+   */
+  tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+  /**
+   * Returns a REQUEST authorizer handler
+   */
+  requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+}
+//#endregion
+export { JwtAuthorizer, JwtAuthorizerOptions, JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
+//# sourceMappingURL=jwt.d.mts.map

package/dist/lambda/jwt.mjs

@@ -0,0 +1,125 @@
+import { JwtVerifier } from "../jwt-D88cPJyT.mjs";
+
+//#region src/lambda/jwt.ts
+function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
+	return {
+		principalId,
+		policyDocument,
+		context
+	};
+}
+function getWildcardResource(methodArn) {
+	const parts = methodArn.split("/");
+	return `${parts[0]}/${parts[1]}/*`;
+}
+/**
+* JWT Lambda Authorizer
+*
+* @example
+* ```typescript
+* const authorizer = new JwtAuthorizer({
+*   config: {
+*     jwksUri: 'https://auth.example.com/.well-known/jwks.json',
+*     issuer: 'https://auth.example.com',
+*   },
+*   getContext: (claims) => ({ userId: claims.sub! }),
+* });
+*
+* // TOKEN authorizer
+* export const tokenHandler = authorizer.tokenHandler();
+*
+* // REQUEST authorizer
+* export const requestHandler = authorizer.requestHandler();
+* ```
+*/
+var JwtAuthorizer = class {
+	verifier;
+	extraction;
+	wildcardResource;
+	getPrincipalId;
+	getContext;
+	authorize;
+	constructor(options) {
+		this.verifier = new JwtVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.wildcardResource = options.wildcardResource ?? true;
+		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? "unknown");
+		this.getContext = options.getContext;
+		this.authorize = options.authorize;
+	}
+	/**
+	* Returns a TOKEN authorizer handler
+	*/
+	tokenHandler() {
+		return async (event, _context) => {
+			const { authorizationToken, methodArn } = event;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = authorizationToken.startsWith("Bearer ") ? authorizationToken.slice(7) : authorizationToken;
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+	/**
+	* Returns a REQUEST authorizer handler
+	*/
+	requestHandler() {
+		const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = this.extraction;
+		const extractToken = (event) => {
+			const headers = event.headers ?? {};
+			const headerKey = Object.keys(headers).find((k) => k.toLowerCase() === headerName.toLowerCase());
+			if (headerKey) {
+				const headerValue = headers[headerKey];
+				if (headerValue) {
+					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) return headerValue.slice(tokenPrefix.length);
+					return headerValue;
+				}
+			}
+			if (cookieName) {
+				const cookieHeader = headers["cookie"] ?? headers["Cookie"] ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match) return match[1];
+			}
+			return null;
+		};
+		return async (event, _context) => {
+			const methodArn = event.methodArn;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = extractToken(event);
+			if (!token) return generatePolicy("unauthorized", "Deny", resource);
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+};
+
+//#endregion
+export { JwtAuthorizer, JwtVerifier };
+//# sourceMappingURL=jwt.mjs.map

package/dist/lambda/jwt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n  APIGatewayAuthorizerResult,\n  APIGatewayRequestAuthorizerEvent,\n  APIGatewayTokenAuthorizerEvent,\n  Context as LambdaContext,\n  PolicyDocument,\n} from 'aws-lambda';\nimport {\n  type JwtClaims,\n  type JwtConfig,\n  JwtVerifier,\n  type TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n  JwtVerifier,\n  type JwtClaims,\n  type JwtConfig,\n  type TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n  principalId: string,\n  effect: 'Allow' | 'Deny',\n  resource: string,\n  context?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n  const policyDocument: PolicyDocument = {\n    Version: '2012-10-17',\n    Statement: [\n      {\n        Action: 'execute-api:Invoke',\n        Effect: effect,\n        Resource: resource,\n      },\n    ],\n  };\n\n  return {\n    principalId,\n    policyDocument,\n    context,\n  };\n}\n\nfunction getWildcardResource(methodArn: string): string {\n  const parts = methodArn.split('/');\n  return `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n  config: JwtConfig;\n  extraction?: TokenExtractionOptions;\n  wildcardResource?: boolean;\n  getPrincipalId?: (claims: TClaims) => string;\n  getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n  private readonly verifier: JwtVerifier<TClaims>;\n  private readonly extraction: TokenExtractionOptions;\n  private readonly wildcardResource: boolean;\n  private readonly getPrincipalId: (claims: TClaims) => string;\n  private readonly getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n  constructor(options: JwtAuthorizerOptions<TClaims>) {\n    this.verifier = new JwtVerifier(options.config);\n    this.extraction = options.extraction ?? {};\n    this.wildcardResource = options.wildcardResource ?? true;\n    this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n    this.getContext = options.getContext;\n    this.authorize = options.authorize;\n  }\n\n  /**\n   * Returns a TOKEN authorizer handler\n   */\n  tokenHandler() {\n    return async (\n      event: APIGatewayTokenAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const { authorizationToken, methodArn } = event;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = authorizationToken.startsWith('Bearer ')\n        ? authorizationToken.slice(7)\n        : authorizationToken;\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n\n  /**\n   * Returns a REQUEST authorizer handler\n   */\n  requestHandler() {\n    const {\n      headerName = 'authorization',\n      cookieName,\n      tokenPrefix = 'Bearer ',\n    } = this.extraction;\n\n    const extractToken = (\n      event: APIGatewayRequestAuthorizerEvent,\n    ): string | null => {\n      const headers = event.headers ?? {};\n      const headerKey = Object.keys(headers).find(\n        (k) => k.toLowerCase() === headerName.toLowerCase(),\n      );\n      if (headerKey) {\n        const headerValue = headers[headerKey];\n        if (headerValue) {\n          if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n            return headerValue.slice(tokenPrefix.length);\n          }\n          return headerValue;\n        }\n      }\n\n      if (cookieName) {\n        const cookieHeader = headers['cookie'] ?? headers['Cookie'] ?? '';\n        const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n        if (match) {\n          return match[1];\n        }\n      }\n\n      return null;\n    };\n\n    return async (\n      event: APIGatewayRequestAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const methodArn = event.methodArn;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = extractToken(event);\n\n      if (!token) {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n}\n"],"mappings":";;;AAqBA,SAAS,eACPA,aACAC,QACAC,UACAC,SAC4B;CAC5B,MAAMC,iBAAiC;EACrC,SAAS;EACT,WAAW,CACT;GACE,QAAQ;GACR,QAAQ;GACR,UAAU;EACX,CACF;CACF;AAED,QAAO;EACL;EACA;EACA;CACD;AACF;AAED,SAAS,oBAAoBC,WAA2B;CACtD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CAChE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AAClD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CAC1B;;;;CAKD,eAAe;AACb,SAAO,OACLC,OACAC,aACwC;GACxC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GAClD,mBAAmB,MAAM,EAAE,GAC3B;AAEJ,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;;;;CAKD,iBAAiB;EACf,MAAM,EACJ,aAAa,iBACb,YACA,cAAc,WACf,GAAG,KAAK;EAET,MAAM,eAAe,CACnBC,UACkB;GAClB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACrC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACpD;AACD,OAAI,WAAW;IACb,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AACf,SAAI,eAAe,YAAY,WAAW,YAAY,CACpD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE9C,YAAO;IACR;GACF;AAED,OAAI,YAAY;IACd,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;IAC/D,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,MACF,QAAO,MAAM;GAEhB;AAED,UAAO;EACR;AAED,SAAO,OACLA,OACAD,aACwC;GACxC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGzD,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;AACF"}

package/dist/lambda/oidc.cjs

@@ -0,0 +1,117 @@
+const require_oidc = require('../oidc-C0KyYaAK.cjs');
+
+//#region src/lambda/oidc.ts
+function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
+	return {
+		principalId,
+		policyDocument,
+		context
+	};
+}
+function getWildcardResource(methodArn) {
+	const parts = methodArn.split("/");
+	return `${parts[0]}/${parts[1]}/*`;
+}
+/**
+* OIDC Lambda Authorizer
+*
+* @example
+* ```typescript
+* const authorizer = new OidcAuthorizer({
+*   config: {
+*     issuer: 'https://auth.example.com',
+*     audience: 'my-api',
+*   },
+*   getContext: (claims) => ({ userId: claims.sub! }),
+* });
+*
+* export const tokenHandler = authorizer.tokenHandler();
+* export const requestHandler = authorizer.requestHandler();
+* ```
+*/
+var OidcAuthorizer = class {
+	verifier;
+	extraction;
+	wildcardResource;
+	getPrincipalId;
+	getContext;
+	authorize;
+	constructor(options) {
+		this.verifier = new require_oidc.OidcVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.wildcardResource = options.wildcardResource ?? true;
+		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? "unknown");
+		this.getContext = options.getContext;
+		this.authorize = options.authorize;
+	}
+	tokenHandler() {
+		return async (event, _context) => {
+			const { authorizationToken, methodArn } = event;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = authorizationToken.startsWith("Bearer ") ? authorizationToken.slice(7) : authorizationToken;
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+	requestHandler() {
+		const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = this.extraction;
+		const extractToken = (event) => {
+			const headers = event.headers ?? {};
+			const headerKey = Object.keys(headers).find((k) => k.toLowerCase() === headerName.toLowerCase());
+			if (headerKey) {
+				const headerValue = headers[headerKey];
+				if (headerValue) {
+					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) return headerValue.slice(tokenPrefix.length);
+					return headerValue;
+				}
+			}
+			if (cookieName) {
+				const cookieHeader = headers["cookie"] ?? headers["Cookie"] ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match) return match[1];
+			}
+			return null;
+		};
+		return async (event, _context) => {
+			const methodArn = event.methodArn;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = extractToken(event);
+			if (!token) return generatePolicy("unauthorized", "Deny", resource);
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+};
+
+//#endregion
+exports.OidcAuthorizer = OidcAuthorizer;
+exports.OidcVerifier = require_oidc.OidcVerifier;
+//# sourceMappingURL=oidc.cjs.map

package/dist/lambda/oidc.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","OidcVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n  APIGatewayAuthorizerResult,\n  APIGatewayRequestAuthorizerEvent,\n  APIGatewayTokenAuthorizerEvent,\n  Context as LambdaContext,\n  PolicyDocument,\n} from 'aws-lambda';\nimport {\n  type OidcClaims,\n  type OidcConfig,\n  OidcVerifier,\n  type TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n  OidcVerifier,\n  type OidcClaims,\n  type OidcConfig,\n  type TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n  principalId: string,\n  effect: 'Allow' | 'Deny',\n  resource: string,\n  context?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n  const policyDocument: PolicyDocument = {\n    Version: '2012-10-17',\n    Statement: [\n      {\n        Action: 'execute-api:Invoke',\n        Effect: effect,\n        Resource: resource,\n      },\n    ],\n  };\n\n  return {\n    principalId,\n    policyDocument,\n    context,\n  };\n}\n\nfunction getWildcardResource(methodArn: string): string {\n  const parts = methodArn.split('/');\n  return `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n  TClaims extends OidcClaims = OidcClaims,\n> {\n  config: OidcConfig;\n  extraction?: TokenExtractionOptions;\n  wildcardResource?: boolean;\n  getPrincipalId?: (claims: TClaims) => string;\n  getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n  private readonly verifier: OidcVerifier<TClaims>;\n  private readonly extraction: TokenExtractionOptions;\n  private readonly wildcardResource: boolean;\n  private readonly getPrincipalId: (claims: TClaims) => string;\n  private readonly getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n  constructor(options: OidcAuthorizerOptions<TClaims>) {\n    this.verifier = new OidcVerifier(options.config);\n    this.extraction = options.extraction ?? {};\n    this.wildcardResource = options.wildcardResource ?? true;\n    this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n    this.getContext = options.getContext;\n    this.authorize = options.authorize;\n  }\n\n  tokenHandler() {\n    return async (\n      event: APIGatewayTokenAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const { authorizationToken, methodArn } = event;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = authorizationToken.startsWith('Bearer ')\n        ? authorizationToken.slice(7)\n        : authorizationToken;\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n\n  requestHandler() {\n    const {\n      headerName = 'authorization',\n      cookieName,\n      tokenPrefix = 'Bearer ',\n    } = this.extraction;\n\n    const extractToken = (\n      event: APIGatewayRequestAuthorizerEvent,\n    ): string | null => {\n      const headers = event.headers ?? {};\n      const headerKey = Object.keys(headers).find(\n        (k) => k.toLowerCase() === headerName.toLowerCase(),\n      );\n      if (headerKey) {\n        const headerValue = headers[headerKey];\n        if (headerValue) {\n          if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n            return headerValue.slice(tokenPrefix.length);\n          }\n          return headerValue;\n        }\n      }\n\n      if (cookieName) {\n        const cookieHeader = headers['cookie'] ?? headers['Cookie'] ?? '';\n        const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n        if (match) {\n          return match[1];\n        }\n      }\n\n      return null;\n    };\n\n    return async (\n      event: APIGatewayRequestAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const methodArn = event.methodArn;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = extractToken(event);\n\n      if (!token) {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n}\n"],"mappings":";;;AAqBA,SAAS,eACPA,aACAC,QACAC,UACAC,SAC4B;CAC5B,MAAMC,iBAAiC;EACrC,SAAS;EACT,WAAW,CACT;GACE,QAAQ;GACR,QAAQ;GACR,UAAU;EACX,CACF;CACF;AAED,QAAO;EACL;EACA;EACA;CACD;AACF;AAED,SAAS,oBAAoBC,WAA2B;CACtD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACnE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACnD,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CAC1B;CAED,eAAe;AACb,SAAO,OACLC,OACAC,aACwC;GACxC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GAClD,mBAAmB,MAAM,EAAE,GAC3B;AAEJ,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;CAED,iBAAiB;EACf,MAAM,EACJ,aAAa,iBACb,YACA,cAAc,WACf,GAAG,KAAK;EAET,MAAM,eAAe,CACnBC,UACkB;GAClB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACrC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACpD;AACD,OAAI,WAAW;IACb,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AACf,SAAI,eAAe,YAAY,WAAW,YAAY,CACpD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE9C,YAAO;IACR;GACF;AAED,OAAI,YAAY;IACd,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;IAC/D,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,MACF,QAAO,MAAM;GAEhB;AAED,UAAO;EACR;AAED,SAAO,OACLA,OACAD,aACwC;GACxC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGzD,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;AACF"}

package/dist/lambda/oidc.d.cts

@@ -0,0 +1,44 @@
+import { TokenExtractionOptions } from "../jwt-DF9kFbmh.cjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-DDLIB5gb.cjs";
+import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
+//#region src/lambda/oidc.d.ts
+interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+  config: OidcConfig;
+  extraction?: TokenExtractionOptions;
+  wildcardResource?: boolean;
+  getPrincipalId?: (claims: TClaims) => string;
+  getContext?: (claims: TClaims) => Record<string, string | number | boolean> | undefined;
+  authorize?: (claims: TClaims) => boolean | Promise<boolean>;
+}
+/**
+ * OIDC Lambda Authorizer
+ *
+ * @example
+ * ```typescript
+ * const authorizer = new OidcAuthorizer({
+ *   config: {
+ *     issuer: 'https://auth.example.com',
+ *     audience: 'my-api',
+ *   },
+ *   getContext: (claims) => ({ userId: claims.sub! }),
+ * });
+ *
+ * export const tokenHandler = authorizer.tokenHandler();
+ * export const requestHandler = authorizer.requestHandler();
+ * ```
+ */
+declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+  private readonly verifier;
+  private readonly extraction;
+  private readonly wildcardResource;
+  private readonly getPrincipalId;
+  private readonly getContext?;
+  private readonly authorize?;
+  constructor(options: OidcAuthorizerOptions<TClaims>);
+  tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+  requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+}
+//#endregion
+export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+//# sourceMappingURL=oidc.d.cts.map

package/dist/lambda/oidc.d.mts

@@ -0,0 +1,44 @@
+import { TokenExtractionOptions } from "../jwt-DH8CJ2xC.mjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-CKOGLxjV.mjs";
+import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
+//#region src/lambda/oidc.d.ts
+interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+  config: OidcConfig;
+  extraction?: TokenExtractionOptions;
+  wildcardResource?: boolean;
+  getPrincipalId?: (claims: TClaims) => string;
+  getContext?: (claims: TClaims) => Record<string, string | number | boolean> | undefined;
+  authorize?: (claims: TClaims) => boolean | Promise<boolean>;
+}
+/**
+ * OIDC Lambda Authorizer
+ *
+ * @example
+ * ```typescript
+ * const authorizer = new OidcAuthorizer({
+ *   config: {
+ *     issuer: 'https://auth.example.com',
+ *     audience: 'my-api',
+ *   },
+ *   getContext: (claims) => ({ userId: claims.sub! }),
+ * });
+ *
+ * export const tokenHandler = authorizer.tokenHandler();
+ * export const requestHandler = authorizer.requestHandler();
+ * ```
+ */
+declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+  private readonly verifier;
+  private readonly extraction;
+  private readonly wildcardResource;
+  private readonly getPrincipalId;
+  private readonly getContext?;
+  private readonly authorize?;
+  constructor(options: OidcAuthorizerOptions<TClaims>);
+  tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+  requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
+}
+//#endregion
+export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+//# sourceMappingURL=oidc.d.mts.map

package/dist/lambda/oidc.mjs

@@ -0,0 +1,116 @@
+import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+
+//#region src/lambda/oidc.ts
+function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
+	return {
+		principalId,
+		policyDocument,
+		context
+	};
+}
+function getWildcardResource(methodArn) {
+	const parts = methodArn.split("/");
+	return `${parts[0]}/${parts[1]}/*`;
+}
+/**
+* OIDC Lambda Authorizer
+*
+* @example
+* ```typescript
+* const authorizer = new OidcAuthorizer({
+*   config: {
+*     issuer: 'https://auth.example.com',
+*     audience: 'my-api',
+*   },
+*   getContext: (claims) => ({ userId: claims.sub! }),
+* });
+*
+* export const tokenHandler = authorizer.tokenHandler();
+* export const requestHandler = authorizer.requestHandler();
+* ```
+*/
+var OidcAuthorizer = class {
+	verifier;
+	extraction;
+	wildcardResource;
+	getPrincipalId;
+	getContext;
+	authorize;
+	constructor(options) {
+		this.verifier = new OidcVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.wildcardResource = options.wildcardResource ?? true;
+		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? "unknown");
+		this.getContext = options.getContext;
+		this.authorize = options.authorize;
+	}
+	tokenHandler() {
+		return async (event, _context) => {
+			const { authorizationToken, methodArn } = event;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = authorizationToken.startsWith("Bearer ") ? authorizationToken.slice(7) : authorizationToken;
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+	requestHandler() {
+		const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = this.extraction;
+		const extractToken = (event) => {
+			const headers = event.headers ?? {};
+			const headerKey = Object.keys(headers).find((k) => k.toLowerCase() === headerName.toLowerCase());
+			if (headerKey) {
+				const headerValue = headers[headerKey];
+				if (headerValue) {
+					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) return headerValue.slice(tokenPrefix.length);
+					return headerValue;
+				}
+			}
+			if (cookieName) {
+				const cookieHeader = headers["cookie"] ?? headers["Cookie"] ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match) return match[1];
+			}
+			return null;
+		};
+		return async (event, _context) => {
+			const methodArn = event.methodArn;
+			const resource = this.wildcardResource ? getWildcardResource(methodArn) : methodArn;
+			const token = extractToken(event);
+			if (!token) return generatePolicy("unauthorized", "Deny", resource);
+			try {
+				const claims = await this.verifier.verify(token);
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+				}
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+				return generatePolicy(principalId, "Allow", resource, context);
+			} catch {
+				return generatePolicy("unauthorized", "Deny", resource);
+			}
+		};
+	}
+};
+
+//#endregion
+export { OidcAuthorizer, OidcVerifier };
+//# sourceMappingURL=oidc.mjs.map

package/dist/lambda/oidc.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n  APIGatewayAuthorizerResult,\n  APIGatewayRequestAuthorizerEvent,\n  APIGatewayTokenAuthorizerEvent,\n  Context as LambdaContext,\n  PolicyDocument,\n} from 'aws-lambda';\nimport {\n  type OidcClaims,\n  type OidcConfig,\n  OidcVerifier,\n  type TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n  OidcVerifier,\n  type OidcClaims,\n  type OidcConfig,\n  type TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n  principalId: string,\n  effect: 'Allow' | 'Deny',\n  resource: string,\n  context?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n  const policyDocument: PolicyDocument = {\n    Version: '2012-10-17',\n    Statement: [\n      {\n        Action: 'execute-api:Invoke',\n        Effect: effect,\n        Resource: resource,\n      },\n    ],\n  };\n\n  return {\n    principalId,\n    policyDocument,\n    context,\n  };\n}\n\nfunction getWildcardResource(methodArn: string): string {\n  const parts = methodArn.split('/');\n  return `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n  TClaims extends OidcClaims = OidcClaims,\n> {\n  config: OidcConfig;\n  extraction?: TokenExtractionOptions;\n  wildcardResource?: boolean;\n  getPrincipalId?: (claims: TClaims) => string;\n  getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n  private readonly verifier: OidcVerifier<TClaims>;\n  private readonly extraction: TokenExtractionOptions;\n  private readonly wildcardResource: boolean;\n  private readonly getPrincipalId: (claims: TClaims) => string;\n  private readonly getContext?: (\n    claims: TClaims,\n  ) => Record<string, string | number | boolean> | undefined;\n  private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n  constructor(options: OidcAuthorizerOptions<TClaims>) {\n    this.verifier = new OidcVerifier(options.config);\n    this.extraction = options.extraction ?? {};\n    this.wildcardResource = options.wildcardResource ?? true;\n    this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n    this.getContext = options.getContext;\n    this.authorize = options.authorize;\n  }\n\n  tokenHandler() {\n    return async (\n      event: APIGatewayTokenAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const { authorizationToken, methodArn } = event;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = authorizationToken.startsWith('Bearer ')\n        ? authorizationToken.slice(7)\n        : authorizationToken;\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n\n  requestHandler() {\n    const {\n      headerName = 'authorization',\n      cookieName,\n      tokenPrefix = 'Bearer ',\n    } = this.extraction;\n\n    const extractToken = (\n      event: APIGatewayRequestAuthorizerEvent,\n    ): string | null => {\n      const headers = event.headers ?? {};\n      const headerKey = Object.keys(headers).find(\n        (k) => k.toLowerCase() === headerName.toLowerCase(),\n      );\n      if (headerKey) {\n        const headerValue = headers[headerKey];\n        if (headerValue) {\n          if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n            return headerValue.slice(tokenPrefix.length);\n          }\n          return headerValue;\n        }\n      }\n\n      if (cookieName) {\n        const cookieHeader = headers['cookie'] ?? headers['Cookie'] ?? '';\n        const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n        if (match) {\n          return match[1];\n        }\n      }\n\n      return null;\n    };\n\n    return async (\n      event: APIGatewayRequestAuthorizerEvent,\n      _context: LambdaContext,\n    ): Promise<APIGatewayAuthorizerResult> => {\n      const methodArn = event.methodArn;\n      const resource = this.wildcardResource\n        ? getWildcardResource(methodArn)\n        : methodArn;\n\n      const token = extractToken(event);\n\n      if (!token) {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n\n      try {\n        const claims = await this.verifier.verify(token);\n\n        if (this.authorize) {\n          const isAuthorized = await this.authorize(claims);\n          if (!isAuthorized) {\n            return generatePolicy('unauthorized', 'Deny', resource);\n          }\n        }\n\n        const principalId = this.getPrincipalId(claims);\n        const context = this.getContext?.(claims);\n\n        return generatePolicy(principalId, 'Allow', resource, context);\n      } catch {\n        return generatePolicy('unauthorized', 'Deny', resource);\n      }\n    };\n  }\n}\n"],"mappings":";;;AAqBA,SAAS,eACPA,aACAC,QACAC,UACAC,SAC4B;CAC5B,MAAMC,iBAAiC;EACrC,SAAS;EACT,WAAW,CACT;GACE,QAAQ;GACR,QAAQ;GACR,UAAU;EACX,CACF;CACF;AAED,QAAO;EACL;EACA;EACA;CACD;AACF;AAED,SAAS,oBAAoBC,WAA2B;CACtD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACnE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACnD,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CAC1B;CAED,eAAe;AACb,SAAO,OACLC,OACAC,aACwC;GACxC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GAClD,mBAAmB,MAAM,EAAE,GAC3B;AAEJ,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;CAED,iBAAiB;EACf,MAAM,EACJ,aAAa,iBACb,YACA,cAAc,WACf,GAAG,KAAK;EAET,MAAM,eAAe,CACnBC,UACkB;GAClB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACrC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACpD;AACD,OAAI,WAAW;IACb,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AACf,SAAI,eAAe,YAAY,WAAW,YAAY,CACpD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE9C,YAAO;IACR;GACF;AAED,OAAI,YAAY;IACd,MAAM,eAAe,QAAQ,aAAa,QAAQ,aAAa;IAC/D,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,MACF,QAAO,MAAM;GAEhB;AAED,UAAO;EACR;AAED,SAAO,OACLA,OACAD,aACwC;GACxC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBAClB,oBAAoB,UAAU,GAC9B;GAEJ,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGzD,OAAI;IACF,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KAClB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACH,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAE1D;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC/D,QAAO;AACN,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACxD;EACF;CACF;AACF"}

package/dist/oidc-C0KyYaAK.cjs

@@ -0,0 +1,68 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const jose = require_chunk.__toESM(require("jose"));
+
+//#region src/oidc.ts
+/**
+* OIDC Verifier with auto-discovery and caching
+*/
+var OidcVerifier = class {
+	discovery = null;
+	jwks = null;
+	discoveryUrl;
+	constructor(config) {
+		this.config = config;
+		this.discoveryUrl = config.issuer.endsWith("/") ? `${config.issuer}.well-known/openid-configuration` : `${config.issuer}/.well-known/openid-configuration`;
+	}
+	async getDiscovery() {
+		if (this.discovery && this.config.cacheDiscovery !== false) return this.discovery;
+		const response = await fetch(this.discoveryUrl);
+		if (!response.ok) throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);
+		this.discovery = await response.json();
+		return this.discovery;
+	}
+	async getJwks() {
+		if (this.jwks && this.config.cacheDiscovery !== false) return this.jwks;
+		const disc = await this.getDiscovery();
+		this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));
+		return this.jwks;
+	}
+	async verify(token) {
+		const key = await this.getJwks();
+		const { payload } = await jose.jwtVerify(token, key, {
+			issuer: this.config.issuer,
+			audience: this.config.audience
+		});
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	async fetchUserInfo(token) {
+		try {
+			const disc = await this.getDiscovery();
+			if (!disc.userinfo_endpoint) return null;
+			const response = await fetch(disc.userinfo_endpoint, { headers: { Authorization: `Bearer ${token}` } });
+			if (!response.ok) return null;
+			return await response.json();
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.discovery = null;
+		this.jwks = null;
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'OidcVerifier', {
+  enumerable: true,
+  get: function () {
+    return OidcVerifier;
+  }
+});
+//# sourceMappingURL=oidc-C0KyYaAK.cjs.map

package/dist/oidc-C0KyYaAK.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-C0KyYaAK.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n  nonce?: string;\n  auth_time?: number;\n  at_hash?: string;\n  c_hash?: string;\n  azp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: string;\n  birthdate?: string;\n  zoneinfo?: string;\n  locale?: string;\n  phone_number?: string;\n  phone_number_verified?: boolean;\n  address?: {\n    formatted?: string;\n    street_address?: string;\n    locality?: string;\n    region?: string;\n    postal_code?: string;\n    country?: string;\n  };\n  updated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint?: string;\n  jwks_uri: string;\n  scopes_supported?: string[];\n  response_types_supported: string[];\n  claims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n  issuer: string;\n  audience: string | string[];\n  cacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n  TClaims extends OidcClaims = OidcClaims,\n  TUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n  private discovery: OidcDiscovery | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n  private readonly discoveryUrl: string;\n\n  constructor(private readonly config: OidcConfig) {\n    this.discoveryUrl = config.issuer.endsWith('/')\n      ? `${config.issuer}.well-known/openid-configuration`\n      : `${config.issuer}/.well-known/openid-configuration`;\n  }\n\n  async getDiscovery(): Promise<OidcDiscovery> {\n    if (this.discovery && this.config.cacheDiscovery !== false) {\n      return this.discovery;\n    }\n\n    const response = await fetch(this.discoveryUrl);\n    if (!response.ok) {\n      throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n    }\n\n    this.discovery = (await response.json()) as OidcDiscovery;\n    return this.discovery;\n  }\n\n  private async getJwks(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks && this.config.cacheDiscovery !== false) {\n      return this.jwks;\n    }\n\n    const disc = await this.getDiscovery();\n    this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n    return this.jwks;\n  }\n\n  async verify(token: string): Promise<TClaims> {\n    const key = await this.getJwks();\n    const { payload } = await jose.jwtVerify(token, key, {\n      issuer: this.config.issuer,\n      audience: this.config.audience,\n    });\n    return payload as unknown as TClaims;\n  }\n\n  async verifyOrNull(token: string): Promise<TClaims | null> {\n    try {\n      return await this.verify(token);\n    } catch {\n      return null;\n    }\n  }\n\n  async fetchUserInfo(token: string): Promise<TUserInfo | null> {\n    try {\n      const disc = await this.getDiscovery();\n      if (!disc.userinfo_endpoint) {\n        return null;\n      }\n\n      const response = await fetch(disc.userinfo_endpoint, {\n        headers: { Authorization: `Bearer ${token}` },\n      });\n\n      if (!response.ok) {\n        return null;\n      }\n\n      return (await response.json()) as TUserInfo;\n    } catch {\n      return null;\n    }\n  }\n\n  clearCache(): void {\n    this.discovery = null;\n    this.jwks = null;\n  }\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACA,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC3B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC1C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACtB;CAED,MAAM,eAAuC;AAC3C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACnD,QAAO,KAAK;EAGd,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACZ,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGzE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACb;CAED,MAAc,UAAyC;AACrD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC9C,QAAO,KAAK;EAGd,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACb;CAED,MAAM,OAAOC,OAAiC;EAC5C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACnD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACvB,EAAC;AACF,SAAO;CACR;CAED,MAAM,aAAaA,OAAwC;AACzD,MAAI;AACF,UAAO,MAAM,KAAK,OAAO,MAAM;EAChC,QAAO;AACN,UAAO;EACR;CACF;CAED,MAAM,cAAcA,OAA0C;AAC5D,MAAI;GACF,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACR,QAAO;GAGT,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACnD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC9C,EAAC;AAEF,QAAK,SAAS,GACZ,QAAO;AAGT,UAAQ,MAAM,SAAS,MAAM;EAC9B,QAAO;AACN,UAAO;EACR;CACF;CAED,aAAmB;AACjB,OAAK,YAAY;AACjB,OAAK,OAAO;CACb;AACF"}