@geekmidas/auth 10.0.0-alpha.98 → 10.0.0

package/dist/lambda/jwt.d.mts

@@ -1,7 +1,8 @@
-import { a as JwtVerifier, n as JwtConfig, o as TokenExtractionOptions, t as JwtClaims } from "../jwt-CoKrpeMB.mjs";
+import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
 //#region src/lambda/jwt.d.ts
-export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
+interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
   config: JwtConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -29,7 +30,7 @@ export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
+declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -46,6 +47,7 @@ export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
    */
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
+//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export type { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
+export { JwtAuthorizer, JwtAuthorizerOptions, JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
 //# sourceMappingURL=jwt.d.mts.map

package/dist/lambda/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":["LambdaContext"],"sources":["../../src/lambda/jwt.ts"],"mappings":";;;iBA8CiB,qBAAqB,gBAAgB,YAAY;EACjE,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;;;;qBAuB/B,cAAc,gBAAgB,YAAY;mBACrC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,qBAAqB;;;;EAY1C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;;;;EAiCZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAiGY;cAjGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAqEH,4CACG,YACR,QAAQ"}

package/dist/lambda/jwt.mjs

@@ -1,17 +1,18 @@
-import { readCookie } from "../cookies.mjs";
-import { JwtVerifier } from "../jwt.mjs";
+import { JwtVerifier } from "../jwt-D88cPJyT.mjs";
+
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
 	return {
 		principalId,
-		policyDocument: {
-			Version: "2012-10-17",
-			Statement: [{
-				Action: "execute-api:Invoke",
-				Effect: effect,
-				Resource: resource
-			}]
-		},
+		policyDocument,
 		context
 	};
 }
@@ -65,7 +66,8 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -91,8 +93,9 @@ var JwtAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);
-				if (cookie) return cookie;
+				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match?.[1]) return match[1];
 			}
 			return null;
 		};
@@ -104,7 +107,8 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -115,7 +119,7 @@ var JwtAuthorizer = class {
 		};
 	}
 };
-//#endregion
-export { JwtAuthorizer };
 
+//#endregion
+export { JwtAuthorizer, JwtVerifier };
 //# sourceMappingURL=jwt.mjs.map

package/dist/lambda/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,gBAAb,MAAkE;CACjE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAwC;EACnD,KAAK,WAAW,IAAI,YAAY,QAAQ,MAAM;EAC9C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;;;;CAKA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;;;;CAKA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.cjs

@@ -1,18 +1,18 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cookies = require("../cookies.cjs");
-const require_oidc = require("../oidc.cjs");
+const require_oidc = require('../oidc-C0KyYaAK.cjs');
+
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
 	return {
 		principalId,
-		policyDocument: {
-			Version: "2012-10-17",
-			Statement: [{
-				Action: "execute-api:Invoke",
-				Effect: effect,
-				Resource: resource
-			}]
-		},
+		policyDocument,
 		context
 	};
 }
@@ -60,7 +60,8 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -83,8 +84,9 @@ var OidcAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookie = require_cookies.readCookie(headers.cookie ?? headers.Cookie, cookieName);
-				if (cookie) return cookie;
+				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match?.[1]) return match[1];
 			}
 			return null;
 		};
@@ -96,7 +98,8 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -107,7 +110,8 @@ var OidcAuthorizer = class {
 		};
 	}
 };
+
 //#endregion
 exports.OidcAuthorizer = OidcAuthorizer;
-
+exports.OidcVerifier = require_oidc.OidcVerifier;
 //# sourceMappingURL=oidc.cjs.map

package/dist/lambda/oidc.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.cjs","names":["OidcVerifier","readCookie"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCA,IAAa,iBAAb,MAAqE;CACpE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAyC;EACpD,KAAK,WAAW,IAAIA,aAAAA,aAAa,QAAQ,MAAM;EAC/C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;CAEA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;CAEA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAASC,gBAAAA,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","OidcVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.d.cts

@@ -1,8 +1,9 @@
-import { o as TokenExtractionOptions } from "../jwt-CoKrpeMB.cjs";
-import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc.cjs";
+import { TokenExtractionOptions } from "../jwt-3eIuY2dg.cjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-ChA17wLB.cjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
 //#region src/lambda/oidc.d.ts
-export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
   config: OidcConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -27,7 +28,7 @@ export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims>
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -38,6 +39,7 @@ export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
+//# sourceMappingURL=oidc.d.ts.map
 //#endregion
-export type { OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
 //# sourceMappingURL=oidc.d.cts.map

package/dist/lambda/oidc.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.cts","names":["LambdaContext"],"sources":["../../src/lambda/oidc.ts"],"mappings":";;;;iBA8CiB,sBAChB,gBAAgB,aAAa;EAE7B,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;qBAoB/B,eAAe,gBAAgB,aAAa;mBACvC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,sBAAsB;EAS3C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;EA8BZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAkDiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AA0Fa,cA1FA,cA0FA,CAAA,gBA1F+B,UA0F/B,GA1F4C,UA0F5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAjFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAkEH,4CACG,YACR,QAAQ"}

package/dist/lambda/oidc.d.mts

@@ -1,8 +1,9 @@
-import { o as TokenExtractionOptions } from "../jwt-CoKrpeMB.mjs";
-import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc.mjs";
+import { TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-DTRgBBl6.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
 //#region src/lambda/oidc.d.ts
-export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
   config: OidcConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -27,7 +28,7 @@ export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims>
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -38,6 +39,7 @@ export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
+//# sourceMappingURL=oidc.d.ts.map
 //#endregion
-export type { OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
 //# sourceMappingURL=oidc.d.mts.map

package/dist/lambda/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","names":["LambdaContext"],"sources":["../../src/lambda/oidc.ts"],"mappings":";;;;iBA8CiB,sBAChB,gBAAgB,aAAa;EAE7B,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;qBAoB/B,eAAe,gBAAgB,aAAa;mBACvC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,sBAAsB;EAS3C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;EA8BZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAkDiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AA0Fa,cA1FA,cA0FA,CAAA,gBA1F+B,UA0F/B,GA1F4C,UA0F5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAjFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAkEH,4CACG,YACR,QAAQ"}

package/dist/lambda/oidc.mjs

@@ -1,17 +1,18 @@
-import { readCookie } from "../cookies.mjs";
-import { OidcVerifier } from "../oidc.mjs";
+import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
 	return {
 		principalId,
-		policyDocument: {
-			Version: "2012-10-17",
-			Statement: [{
-				Action: "execute-api:Invoke",
-				Effect: effect,
-				Resource: resource
-			}]
-		},
+		policyDocument,
 		context
 	};
 }
@@ -59,7 +60,8 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -82,8 +84,9 @@ var OidcAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);
-				if (cookie) return cookie;
+				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match?.[1]) return match[1];
 			}
 			return null;
 		};
@@ -95,7 +98,8 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -106,7 +110,7 @@ var OidcAuthorizer = class {
 		};
 	}
 };
-//#endregion
-export { OidcAuthorizer };
 
+//#endregion
+export { OidcAuthorizer, OidcVerifier };
 //# sourceMappingURL=oidc.mjs.map

package/dist/lambda/oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.mjs","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCA,IAAa,iBAAb,MAAqE;CACpE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAyC;EACpD,KAAK,WAAW,IAAI,aAAa,QAAQ,MAAM;EAC/C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;CAEA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;CAEA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/oidc-C0KyYaAK.cjs

@@ -0,0 +1,68 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const jose = require_chunk.__toESM(require("jose"));
+
+//#region src/oidc.ts
+/**
+* OIDC Verifier with auto-discovery and caching
+*/
+var OidcVerifier = class {
+	discovery = null;
+	jwks = null;
+	discoveryUrl;
+	constructor(config) {
+		this.config = config;
+		this.discoveryUrl = config.issuer.endsWith("/") ? `${config.issuer}.well-known/openid-configuration` : `${config.issuer}/.well-known/openid-configuration`;
+	}
+	async getDiscovery() {
+		if (this.discovery && this.config.cacheDiscovery !== false) return this.discovery;
+		const response = await fetch(this.discoveryUrl);
+		if (!response.ok) throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);
+		this.discovery = await response.json();
+		return this.discovery;
+	}
+	async getJwks() {
+		if (this.jwks && this.config.cacheDiscovery !== false) return this.jwks;
+		const disc = await this.getDiscovery();
+		this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));
+		return this.jwks;
+	}
+	async verify(token) {
+		const key = await this.getJwks();
+		const { payload } = await jose.jwtVerify(token, key, {
+			issuer: this.config.issuer,
+			audience: this.config.audience
+		});
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	async fetchUserInfo(token) {
+		try {
+			const disc = await this.getDiscovery();
+			if (!disc.userinfo_endpoint) return null;
+			const response = await fetch(disc.userinfo_endpoint, { headers: { Authorization: `Bearer ${token}` } });
+			if (!response.ok) return null;
+			return await response.json();
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.discovery = null;
+		this.jwks = null;
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'OidcVerifier', {
+  enumerable: true,
+  get: function () {
+    return OidcVerifier;
+  }
+});
+//# sourceMappingURL=oidc-C0KyYaAK.cjs.map

package/dist/oidc-C0KyYaAK.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-C0KyYaAK.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}