@geekmidas/auth 0.1.0 → 1.0.0

package/src/lambda/oidc.ts

@@ -1,64 +1,64 @@
 import type {
-  APIGatewayAuthorizerResult,
-  APIGatewayRequestAuthorizerEvent,
-  APIGatewayTokenAuthorizerEvent,
-  Context as LambdaContext,
-  PolicyDocument,
+	APIGatewayAuthorizerResult,
+	APIGatewayRequestAuthorizerEvent,
+	APIGatewayTokenAuthorizerEvent,
+	Context as LambdaContext,
+	PolicyDocument,
 } from 'aws-lambda';
 import {
-  type OidcClaims,
-  type OidcConfig,
-  OidcVerifier,
-  type TokenExtractionOptions,
+	type OidcClaims,
+	type OidcConfig,
+	OidcVerifier,
+	type TokenExtractionOptions,
 } from '../oidc';
 
 export {
-  OidcVerifier,
-  type OidcClaims,
-  type OidcConfig,
-  type TokenExtractionOptions,
+	OidcVerifier,
+	type OidcClaims,
+	type OidcConfig,
+	type TokenExtractionOptions,
 };
 
 function generatePolicy(
-  principalId: string,
-  effect: 'Allow' | 'Deny',
-  resource: string,
-  context?: Record<string, string | number | boolean>,
+	principalId: string,
+	effect: 'Allow' | 'Deny',
+	resource: string,
+	context?: Record<string, string | number | boolean>,
 ): APIGatewayAuthorizerResult {
-  const policyDocument: PolicyDocument = {
-    Version: '2012-10-17',
-    Statement: [
-      {
-        Action: 'execute-api:Invoke',
-        Effect: effect,
-        Resource: resource,
-      },
-    ],
-  };
-
-  return {
-    principalId,
-    policyDocument,
-    context,
-  };
+	const policyDocument: PolicyDocument = {
+		Version: '2012-10-17',
+		Statement: [
+			{
+				Action: 'execute-api:Invoke',
+				Effect: effect,
+				Resource: resource,
+			},
+		],
+	};
+
+	return {
+		principalId,
+		policyDocument,
+		context,
+	};
 }
 
 function getWildcardResource(methodArn: string): string {
-  const parts = methodArn.split('/');
-  return `${parts[0]}/${parts[1]}/*`;
+	const parts = methodArn.split('/');
+	return `${parts[0]}/${parts[1]}/*`;
 }
 
 export interface OidcAuthorizerOptions<
-  TClaims extends OidcClaims = OidcClaims,
+	TClaims extends OidcClaims = OidcClaims,
 > {
-  config: OidcConfig;
-  extraction?: TokenExtractionOptions;
-  wildcardResource?: boolean;
-  getPrincipalId?: (claims: TClaims) => string;
-  getContext?: (
-    claims: TClaims,
-  ) => Record<string, string | number | boolean> | undefined;
-  authorize?: (claims: TClaims) => boolean | Promise<boolean>;
+	config: OidcConfig;
+	extraction?: TokenExtractionOptions;
+	wildcardResource?: boolean;
+	getPrincipalId?: (claims: TClaims) => string;
+	getContext?: (
+		claims: TClaims,
+	) => Record<string, string | number | boolean> | undefined;
+	authorize?: (claims: TClaims) => boolean | Promise<boolean>;
 }
 
 /**
@@ -79,125 +79,125 @@ export interface OidcAuthorizerOptions<
  * ```
  */
 export class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
-  private readonly verifier: OidcVerifier<TClaims>;
-  private readonly extraction: TokenExtractionOptions;
-  private readonly wildcardResource: boolean;
-  private readonly getPrincipalId: (claims: TClaims) => string;
-  private readonly getContext?: (
-    claims: TClaims,
-  ) => Record<string, string | number | boolean> | undefined;
-  private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;
-
-  constructor(options: OidcAuthorizerOptions<TClaims>) {
-    this.verifier = new OidcVerifier(options.config);
-    this.extraction = options.extraction ?? {};
-    this.wildcardResource = options.wildcardResource ?? true;
-    this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');
-    this.getContext = options.getContext;
-    this.authorize = options.authorize;
-  }
-
-  tokenHandler() {
-    return async (
-      event: APIGatewayTokenAuthorizerEvent,
-      _context: LambdaContext,
-    ): Promise<APIGatewayAuthorizerResult> => {
-      const { authorizationToken, methodArn } = event;
-      const resource = this.wildcardResource
-        ? getWildcardResource(methodArn)
-        : methodArn;
-
-      const token = authorizationToken.startsWith('Bearer ')
-        ? authorizationToken.slice(7)
-        : authorizationToken;
-
-      try {
-        const claims = await this.verifier.verify(token);
-
-        if (this.authorize) {
-          const isAuthorized = await this.authorize(claims);
-          if (!isAuthorized) {
-            return generatePolicy('unauthorized', 'Deny', resource);
-          }
-        }
-
-        const principalId = this.getPrincipalId(claims);
-        const context = this.getContext?.(claims);
-
-        return generatePolicy(principalId, 'Allow', resource, context);
-      } catch {
-        return generatePolicy('unauthorized', 'Deny', resource);
-      }
-    };
-  }
-
-  requestHandler() {
-    const {
-      headerName = 'authorization',
-      cookieName,
-      tokenPrefix = 'Bearer ',
-    } = this.extraction;
-
-    const extractToken = (
-      event: APIGatewayRequestAuthorizerEvent,
-    ): string | null => {
-      const headers = event.headers ?? {};
-      const headerKey = Object.keys(headers).find(
-        (k) => k.toLowerCase() === headerName.toLowerCase(),
-      );
-      if (headerKey) {
-        const headerValue = headers[headerKey];
-        if (headerValue) {
-          if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-            return headerValue.slice(tokenPrefix.length);
-          }
-          return headerValue;
-        }
-      }
-
-      if (cookieName) {
-        const cookieHeader = headers['cookie'] ?? headers['Cookie'] ?? '';
-        const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-        if (match) {
-          return match[1];
-        }
-      }
-
-      return null;
-    };
-
-    return async (
-      event: APIGatewayRequestAuthorizerEvent,
-      _context: LambdaContext,
-    ): Promise<APIGatewayAuthorizerResult> => {
-      const methodArn = event.methodArn;
-      const resource = this.wildcardResource
-        ? getWildcardResource(methodArn)
-        : methodArn;
-
-      const token = extractToken(event);
-
-      if (!token) {
-        return generatePolicy('unauthorized', 'Deny', resource);
-      }
-
-      try {
-        const claims = await this.verifier.verify(token);
-
-        if (this.authorize) {
-          const isAuthorized = await this.authorize(claims);
-          if (!isAuthorized) {
-            return generatePolicy('unauthorized', 'Deny', resource);
-          }
-        }
-
-        const principalId = this.getPrincipalId(claims);
-        const context = this.getContext?.(claims);
-
-        return generatePolicy(principalId, 'Allow', resource, context);
-      } catch {
-        return generatePolicy('unauthorized', 'Deny', resource);
-      }
-    };
-  }
+	private readonly verifier: OidcVerifier<TClaims>;
+	private readonly extraction: TokenExtractionOptions;
+	private readonly wildcardResource: boolean;
+	private readonly getPrincipalId: (claims: TClaims) => string;
+	private readonly getContext?: (
+		claims: TClaims,
+	) => Record<string, string | number | boolean> | undefined;
+	private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;
+
+	constructor(options: OidcAuthorizerOptions<TClaims>) {
+		this.verifier = new OidcVerifier(options.config);
+		this.extraction = options.extraction ?? {};
+		this.wildcardResource = options.wildcardResource ?? true;
+		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');
+		this.getContext = options.getContext;
+		this.authorize = options.authorize;
+	}
+
+	tokenHandler() {
+		return async (
+			event: APIGatewayTokenAuthorizerEvent,
+			_context: LambdaContext,
+		): Promise<APIGatewayAuthorizerResult> => {
+			const { authorizationToken, methodArn } = event;
+			const resource = this.wildcardResource
+				? getWildcardResource(methodArn)
+				: methodArn;
+
+			const token = authorizationToken.startsWith('Bearer ')
+				? authorizationToken.slice(7)
+				: authorizationToken;
+
+			try {
+				const claims = await this.verifier.verify(token);
+
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) {
+						return generatePolicy('unauthorized', 'Deny', resource);
+					}
+				}
+
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+
+				return generatePolicy(principalId, 'Allow', resource, context);
+			} catch {
+				return generatePolicy('unauthorized', 'Deny', resource);
+			}
+		};
+	}
+
+	requestHandler() {
+		const {
+			headerName = 'authorization',
+			cookieName,
+			tokenPrefix = 'Bearer ',
+		} = this.extraction;
+
+		const extractToken = (
+			event: APIGatewayRequestAuthorizerEvent,
+		): string | null => {
+			const headers = event.headers ?? {};
+			const headerKey = Object.keys(headers).find(
+				(k) => k.toLowerCase() === headerName.toLowerCase(),
+			);
+			if (headerKey) {
+				const headerValue = headers[headerKey];
+				if (headerValue) {
+					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
+						return headerValue.slice(tokenPrefix.length);
+					}
+					return headerValue;
+				}
+			}
+
+			if (cookieName) {
+				const cookieHeader = headers.cookie ?? headers.Cookie ?? '';
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match?.[1]) {
+					return match[1];
+				}
+			}
+
+			return null;
+		};
+
+		return async (
+			event: APIGatewayRequestAuthorizerEvent,
+			_context: LambdaContext,
+		): Promise<APIGatewayAuthorizerResult> => {
+			const methodArn = event.methodArn;
+			const resource = this.wildcardResource
+				? getWildcardResource(methodArn)
+				: methodArn;
+
+			const token = extractToken(event);
+
+			if (!token) {
+				return generatePolicy('unauthorized', 'Deny', resource);
+			}
+
+			try {
+				const claims = await this.verifier.verify(token);
+
+				if (this.authorize) {
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) {
+						return generatePolicy('unauthorized', 'Deny', resource);
+					}
+				}
+
+				const principalId = this.getPrincipalId(claims);
+				const context = this.getContext?.(claims);
+
+				return generatePolicy(principalId, 'Allow', resource, context);
+			} catch {
+				return generatePolicy('unauthorized', 'Deny', resource);
+			}
+		};
+	}
 }

package/src/oidc.ts

@@ -7,150 +7,150 @@ export type { TokenExtractionOptions };
  * Standard OIDC claims (extends JWT claims)
  */
 export interface OidcClaims extends JwtClaims {
-  nonce?: string;
-  auth_time?: number;
-  at_hash?: string;
-  c_hash?: string;
-  azp?: string;
+	nonce?: string;
+	auth_time?: number;
+	at_hash?: string;
+	c_hash?: string;
+	azp?: string;
 }
 
 /**
  * Standard OIDC user info claims
  */
 export interface OidcUserInfo {
-  sub: string;
-  name?: string;
-  given_name?: string;
-  family_name?: string;
-  middle_name?: string;
-  nickname?: string;
-  preferred_username?: string;
-  profile?: string;
-  picture?: string;
-  website?: string;
-  email?: string;
-  email_verified?: boolean;
-  gender?: string;
-  birthdate?: string;
-  zoneinfo?: string;
-  locale?: string;
-  phone_number?: string;
-  phone_number_verified?: boolean;
-  address?: {
-    formatted?: string;
-    street_address?: string;
-    locality?: string;
-    region?: string;
-    postal_code?: string;
-    country?: string;
-  };
-  updated_at?: number;
+	sub: string;
+	name?: string;
+	given_name?: string;
+	family_name?: string;
+	middle_name?: string;
+	nickname?: string;
+	preferred_username?: string;
+	profile?: string;
+	picture?: string;
+	website?: string;
+	email?: string;
+	email_verified?: boolean;
+	gender?: string;
+	birthdate?: string;
+	zoneinfo?: string;
+	locale?: string;
+	phone_number?: string;
+	phone_number_verified?: boolean;
+	address?: {
+		formatted?: string;
+		street_address?: string;
+		locality?: string;
+		region?: string;
+		postal_code?: string;
+		country?: string;
+	};
+	updated_at?: number;
 }
 
 /**
  * OIDC Discovery document
  */
 export interface OidcDiscovery {
-  issuer: string;
-  authorization_endpoint: string;
-  token_endpoint: string;
-  userinfo_endpoint?: string;
-  jwks_uri: string;
-  scopes_supported?: string[];
-  response_types_supported: string[];
-  claims_supported?: string[];
+	issuer: string;
+	authorization_endpoint: string;
+	token_endpoint: string;
+	userinfo_endpoint?: string;
+	jwks_uri: string;
+	scopes_supported?: string[];
+	response_types_supported: string[];
+	claims_supported?: string[];
 }
 
 /**
  * Configuration for OIDC verification
  */
 export interface OidcConfig {
-  issuer: string;
-  audience: string | string[];
-  cacheDiscovery?: boolean;
+	issuer: string;
+	audience: string | string[];
+	cacheDiscovery?: boolean;
 }
 
 /**
  * OIDC Verifier with auto-discovery and caching
  */
 export class OidcVerifier<
-  TClaims extends OidcClaims = OidcClaims,
-  TUserInfo extends OidcUserInfo = OidcUserInfo,
+	TClaims extends OidcClaims = OidcClaims,
+	TUserInfo extends OidcUserInfo = OidcUserInfo,
 > {
-  private discovery: OidcDiscovery | null = null;
-  private jwks: jose.JWTVerifyGetKey | null = null;
-  private readonly discoveryUrl: string;
-
-  constructor(private readonly config: OidcConfig) {
-    this.discoveryUrl = config.issuer.endsWith('/')
-      ? `${config.issuer}.well-known/openid-configuration`
-      : `${config.issuer}/.well-known/openid-configuration`;
-  }
-
-  async getDiscovery(): Promise<OidcDiscovery> {
-    if (this.discovery && this.config.cacheDiscovery !== false) {
-      return this.discovery;
-    }
-
-    const response = await fetch(this.discoveryUrl);
-    if (!response.ok) {
-      throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);
-    }
-
-    this.discovery = (await response.json()) as OidcDiscovery;
-    return this.discovery;
-  }
-
-  private async getJwks(): Promise<jose.JWTVerifyGetKey> {
-    if (this.jwks && this.config.cacheDiscovery !== false) {
-      return this.jwks;
-    }
-
-    const disc = await this.getDiscovery();
-    this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));
-    return this.jwks;
-  }
-
-  async verify(token: string): Promise<TClaims> {
-    const key = await this.getJwks();
-    const { payload } = await jose.jwtVerify(token, key, {
-      issuer: this.config.issuer,
-      audience: this.config.audience,
-    });
-    return payload as unknown as TClaims;
-  }
-
-  async verifyOrNull(token: string): Promise<TClaims | null> {
-    try {
-      return await this.verify(token);
-    } catch {
-      return null;
-    }
-  }
-
-  async fetchUserInfo(token: string): Promise<TUserInfo | null> {
-    try {
-      const disc = await this.getDiscovery();
-      if (!disc.userinfo_endpoint) {
-        return null;
-      }
-
-      const response = await fetch(disc.userinfo_endpoint, {
-        headers: { Authorization: `Bearer ${token}` },
-      });
-
-      if (!response.ok) {
-        return null;
-      }
-
-      return (await response.json()) as TUserInfo;
-    } catch {
-      return null;
-    }
-  }
-
-  clearCache(): void {
-    this.discovery = null;
-    this.jwks = null;
-  }
+	private discovery: OidcDiscovery | null = null;
+	private jwks: jose.JWTVerifyGetKey | null = null;
+	private readonly discoveryUrl: string;
+
+	constructor(private readonly config: OidcConfig) {
+		this.discoveryUrl = config.issuer.endsWith('/')
+			? `${config.issuer}.well-known/openid-configuration`
+			: `${config.issuer}/.well-known/openid-configuration`;
+	}
+
+	async getDiscovery(): Promise<OidcDiscovery> {
+		if (this.discovery && this.config.cacheDiscovery !== false) {
+			return this.discovery;
+		}
+
+		const response = await fetch(this.discoveryUrl);
+		if (!response.ok) {
+			throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);
+		}
+
+		this.discovery = (await response.json()) as OidcDiscovery;
+		return this.discovery;
+	}
+
+	private async getJwks(): Promise<jose.JWTVerifyGetKey> {
+		if (this.jwks && this.config.cacheDiscovery !== false) {
+			return this.jwks;
+		}
+
+		const disc = await this.getDiscovery();
+		this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));
+		return this.jwks;
+	}
+
+	async verify(token: string): Promise<TClaims> {
+		const key = await this.getJwks();
+		const { payload } = await jose.jwtVerify(token, key, {
+			issuer: this.config.issuer,
+			audience: this.config.audience,
+		});
+		return payload as unknown as TClaims;
+	}
+
+	async verifyOrNull(token: string): Promise<TClaims | null> {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+
+	async fetchUserInfo(token: string): Promise<TUserInfo | null> {
+		try {
+			const disc = await this.getDiscovery();
+			if (!disc.userinfo_endpoint) {
+				return null;
+			}
+
+			const response = await fetch(disc.userinfo_endpoint, {
+				headers: { Authorization: `Bearer ${token}` },
+			});
+
+			if (!response.ok) {
+				return null;
+			}
+
+			return (await response.json()) as TUserInfo;
+		} catch {
+			return null;
+		}
+	}
+
+	clearCache(): void {
+		this.discovery = null;
+		this.jwks = null;
+	}
 }

package/src/server.ts

@@ -1,9 +1,8 @@
+export { CacheTokenStorage } from './cacheTokenStorage.js';
 export {
-  TokenManager,
-  type TokenPayload,
-  type TokenPair,
-  type TokenManagerOptions,
-  type DecodedToken,
+	type DecodedToken,
+	TokenManager,
+	type TokenManagerOptions,
+	type TokenPair,
+	type TokenPayload,
 } from './tokenManager.js';
-
-export { CacheTokenStorage } from './cacheTokenStorage.js';