@geekmidas/auth 0.1.0 → 1.0.0

package/src/hono/oidc.ts

@@ -1,61 +1,61 @@
 import type { Context, MiddlewareHandler, Next } from 'hono';
 import {
-  type OidcClaims,
-  type OidcConfig,
-  type OidcUserInfo,
-  OidcVerifier,
-  type TokenExtractionOptions,
+	type OidcClaims,
+	type OidcConfig,
+	type OidcUserInfo,
+	OidcVerifier,
+	type TokenExtractionOptions,
 } from '../oidc';
 
 export {
-  OidcVerifier,
-  type OidcClaims,
-  type OidcConfig,
-  type OidcUserInfo,
-  type TokenExtractionOptions,
+	OidcVerifier,
+	type OidcClaims,
+	type OidcConfig,
+	type OidcUserInfo,
+	type TokenExtractionOptions,
 };
 
 function extractToken(
-  c: Context,
-  options: TokenExtractionOptions = {},
+	c: Context,
+	options: TokenExtractionOptions = {},
 ): string | null {
-  const {
-    headerName = 'authorization',
-    cookieName,
-    tokenPrefix = 'Bearer ',
-  } = options;
-
-  const headerValue = c.req.header(headerName);
-  if (headerValue) {
-    if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-      return headerValue.slice(tokenPrefix.length);
-    }
-    return headerValue;
-  }
-
-  if (cookieName) {
-    const cookieHeader = c.req.header('cookie');
-    if (cookieHeader) {
-      const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-      if (match) {
-        return match[1];
-      }
-    }
-  }
-
-  return null;
+	const {
+		headerName = 'authorization',
+		cookieName,
+		tokenPrefix = 'Bearer ',
+	} = options;
+
+	const headerValue = c.req.header(headerName);
+	if (headerValue) {
+		if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
+			return headerValue.slice(tokenPrefix.length);
+		}
+		return headerValue;
+	}
+
+	if (cookieName) {
+		const cookieHeader = c.req.header('cookie');
+		if (cookieHeader) {
+			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+			if (match?.[1]) {
+				return match[1];
+			}
+		}
+	}
+
+	return null;
 }
 
 export interface OidcMiddlewareOptions<
-  TClaims extends OidcClaims = OidcClaims,
-  TUserInfo extends OidcUserInfo = OidcUserInfo,
+	TClaims extends OidcClaims = OidcClaims,
+	TUserInfo extends OidcUserInfo = OidcUserInfo,
 > {
-  config: OidcConfig;
-  extraction?: TokenExtractionOptions;
-  contextKey?: string;
-  fetchUserInfo?: boolean;
-  onError?: (c: Context, error: Error) => Response | Promise<Response>;
-  transformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;
+	config: OidcConfig;
+	extraction?: TokenExtractionOptions;
+	contextKey?: string;
+	fetchUserInfo?: boolean;
+	onError?: (c: Context, error: Error) => Response | Promise<Response>;
+	transformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;
 }
 
 /**
@@ -80,91 +80,91 @@ export interface OidcMiddlewareOptions<
  * ```
  */
 export class OidcMiddleware<
-  TClaims extends OidcClaims = OidcClaims,
-  TUserInfo extends OidcUserInfo = OidcUserInfo,
+	TClaims extends OidcClaims = OidcClaims,
+	TUserInfo extends OidcUserInfo = OidcUserInfo,
 > {
-  private readonly verifier: OidcVerifier<TClaims, TUserInfo>;
-  private readonly extraction: TokenExtractionOptions;
-  private readonly contextKey: string;
-  private readonly fetchUserInfo: boolean;
-  private readonly onError?: (
-    c: Context,
-    error: Error,
-  ) => Response | Promise<Response>;
-  private readonly transformClaims?: (
-    claims: OidcClaims,
-    userInfo?: TUserInfo,
-  ) => TClaims;
-
-  constructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {
-    this.verifier = new OidcVerifier(options.config);
-    this.extraction = options.extraction ?? {};
-    this.contextKey = options.contextKey ?? 'oidcClaims';
-    this.fetchUserInfo = options.fetchUserInfo ?? false;
-    this.onError = options.onError;
-    this.transformClaims = options.transformClaims;
-  }
-
-  handler(): MiddlewareHandler {
-    return async (c: Context, next: Next) => {
-      const token = extractToken(c, this.extraction);
-
-      if (!token) {
-        if (this.onError) {
-          return this.onError(c, new Error('No token provided'));
-        }
-        return c.json({ error: 'Unauthorized' }, 401);
-      }
-
-      try {
-        const payload = await this.verifier.verify(token);
-
-        let userInfo: TUserInfo | undefined;
-        if (this.fetchUserInfo) {
-          userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
-          c.set('oidcUserInfo', userInfo);
-        }
-
-        const claims = this.transformClaims
-          ? this.transformClaims(payload, userInfo)
-          : payload;
-
-        c.set(this.contextKey, claims);
-        c.set('oidcToken', token);
-
-        await next();
-      } catch (error) {
-        if (this.onError) {
-          return this.onError(c, error as Error);
-        }
-        return c.json({ error: 'Invalid token' }, 401);
-      }
-    };
-  }
-
-  optional(): MiddlewareHandler {
-    return async (c: Context, next: Next) => {
-      const token = extractToken(c, this.extraction);
-
-      if (token) {
-        const payload = await this.verifier.verifyOrNull(token);
-        if (payload) {
-          let userInfo: TUserInfo | undefined;
-          if (this.fetchUserInfo) {
-            userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
-            c.set('oidcUserInfo', userInfo);
-          }
-
-          const claims = this.transformClaims
-            ? this.transformClaims(payload, userInfo)
-            : payload;
-
-          c.set(this.contextKey, claims);
-          c.set('oidcToken', token);
-        }
-      }
-
-      await next();
-    };
-  }
+	private readonly verifier: OidcVerifier<TClaims, TUserInfo>;
+	private readonly extraction: TokenExtractionOptions;
+	private readonly contextKey: string;
+	private readonly fetchUserInfo: boolean;
+	private readonly onError?: (
+		c: Context,
+		error: Error,
+	) => Response | Promise<Response>;
+	private readonly transformClaims?: (
+		claims: OidcClaims,
+		userInfo?: TUserInfo,
+	) => TClaims;
+
+	constructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {
+		this.verifier = new OidcVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.contextKey = options.contextKey ?? 'oidcClaims';
+		this.fetchUserInfo = options.fetchUserInfo ?? false;
+		this.onError = options.onError;
+		this.transformClaims = options.transformClaims;
+	}
+
+	handler(): MiddlewareHandler {
+		return async (c: Context, next: Next) => {
+			const token = extractToken(c, this.extraction);
+
+			if (!token) {
+				if (this.onError) {
+					return this.onError(c, new Error('No token provided'));
+				}
+				return c.json({ error: 'Unauthorized' }, 401);
+			}
+
+			try {
+				const payload = await this.verifier.verify(token);
+
+				let userInfo: TUserInfo | undefined;
+				if (this.fetchUserInfo) {
+					userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
+					c.set('oidcUserInfo', userInfo);
+				}
+
+				const claims = this.transformClaims
+					? this.transformClaims(payload, userInfo)
+					: payload;
+
+				c.set(this.contextKey, claims);
+				c.set('oidcToken', token);
+
+				await next();
+			} catch (error) {
+				if (this.onError) {
+					return this.onError(c, error as Error);
+				}
+				return c.json({ error: 'Invalid token' }, 401);
+			}
+		};
+	}
+
+	optional(): MiddlewareHandler {
+		return async (c: Context, next: Next) => {
+			const token = extractToken(c, this.extraction);
+
+			if (token) {
+				const payload = await this.verifier.verifyOrNull(token);
+				if (payload) {
+					let userInfo: TUserInfo | undefined;
+					if (this.fetchUserInfo) {
+						userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
+						c.set('oidcUserInfo', userInfo);
+					}
+
+					const claims = this.transformClaims
+						? this.transformClaims(payload, userInfo)
+						: payload;
+
+					c.set(this.contextKey, claims);
+					c.set('oidcToken', token);
+				}
+			}
+
+			await next();
+		};
+	}
 }

package/src/index.ts

@@ -1,3 +1,3 @@
-export * from './tokenManager.js';
-export * from './client.js';
 export * from './cacheTokenStorage.js';
+export * from './client.js';
+export * from './tokenManager.js';

package/src/jwt.ts

@@ -4,33 +4,33 @@ import * as jose from 'jose';
  * Standard JWT claims
  */
 export interface JwtClaims {
-  sub?: string;
-  iss?: string;
-  aud?: string | string[];
-  exp?: number;
-  iat?: number;
-  nbf?: number;
-  jti?: string;
+	sub?: string;
+	iss?: string;
+	aud?: string | string[];
+	exp?: number;
+	iat?: number;
+	nbf?: number;
+	jti?: string;
 }
 
 /**
  * Configuration for JWT verification with a symmetric secret
  */
 export interface JwtSecretConfig {
-  secret: string;
-  issuer?: string;
-  audience?: string | string[];
-  algorithms?: string[];
+	secret: string;
+	issuer?: string;
+	audience?: string | string[];
+	algorithms?: string[];
 }
 
 /**
  * Configuration for JWT verification with JWKS
  */
 export interface JwtJwksConfig {
-  jwksUri: string;
-  issuer?: string;
-  audience?: string | string[];
-  algorithms?: string[];
+	jwksUri: string;
+	issuer?: string;
+	audience?: string | string[];
+	algorithms?: string[];
 }
 
 export type JwtConfig = JwtSecretConfig | JwtJwksConfig;
@@ -39,60 +39,60 @@ export type JwtConfig = JwtSecretConfig | JwtJwksConfig;
  * Options for token extraction from requests
  */
 export interface TokenExtractionOptions {
-  headerName?: string;
-  cookieName?: string;
-  tokenPrefix?: string;
+	headerName?: string;
+	cookieName?: string;
+	tokenPrefix?: string;
 }
 
 export function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {
-  return 'jwksUri' in config;
+	return 'jwksUri' in config;
 }
 
 /**
  * JWT Verifier with JWKS caching
  */
 export class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
-  private jwks: jose.JWTVerifyGetKey | null = null;
-  private readonly verifyOptions: jose.JWTVerifyOptions;
+	private jwks: jose.JWTVerifyGetKey | null = null;
+	private readonly verifyOptions: jose.JWTVerifyOptions;
 
-  constructor(private readonly config: JwtConfig) {
-    this.verifyOptions = {
-      issuer: config.issuer,
-      audience: config.audience,
-      algorithms:
-        config.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),
-    };
-  }
+	constructor(private readonly config: JwtConfig) {
+		this.verifyOptions = {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms:
+				config.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),
+		};
+	}
 
-  async verify(token: string): Promise<TClaims> {
-    if (isJwksConfig(this.config)) {
-      if (!this.jwks) {
-        this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
-      }
-      const { payload } = await jose.jwtVerify(
-        token,
-        this.jwks,
-        this.verifyOptions,
-      );
-      return payload as unknown as TClaims;
-    }
+	async verify(token: string): Promise<TClaims> {
+		if (isJwksConfig(this.config)) {
+			if (!this.jwks) {
+				this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+			}
+			const { payload } = await jose.jwtVerify(
+				token,
+				this.jwks,
+				this.verifyOptions,
+			);
+			return payload as unknown as TClaims;
+		}
 
-    const secret = new TextEncoder().encode(this.config.secret);
-    const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
-    return payload as unknown as TClaims;
-  }
+		const secret = new TextEncoder().encode(this.config.secret);
+		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
+		return payload as unknown as TClaims;
+	}
 
-  async verifyOrNull(token: string): Promise<TClaims | null> {
-    try {
-      return await this.verify(token);
-    } catch {
-      return null;
-    }
-  }
+	async verifyOrNull(token: string): Promise<TClaims | null> {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
 
-  clearCache(): void {
-    this.jwks = null;
-  }
+	clearCache(): void {
+		this.jwks = null;
+	}
 }
 
 /**
@@ -100,7 +100,7 @@ export class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
  * WARNING: This does NOT verify the token signature!
  */
 export function decodeJwt<TClaims extends JwtClaims = JwtClaims>(
-  token: string,
+	token: string,
 ): TClaims {
-  return jose.decodeJwt(token) as unknown as TClaims;
+	return jose.decodeJwt(token) as unknown as TClaims;
 }