@geekmidas/auth 2.0.2 → 10.0.0-alpha.0

package/src/client.ts

@@ -1,220 +0,0 @@
-export interface TokenStorage {
-	getAccessToken(): Promise<string | null> | string | null;
-	setAccessToken(token: string, ttl?: number): Promise<void> | void;
-	getRefreshToken(): Promise<string | null> | string | null;
-	setRefreshToken(token: string, ttl?: number): Promise<void> | void;
-	clearTokens(): Promise<void> | void;
-}
-
-export class LocalStorageTokenStorage implements TokenStorage {
-	private accessTokenKey: string;
-	private refreshTokenKey: string;
-
-	constructor(
-		accessTokenKey: string = 'access_token',
-		refreshTokenKey: string = 'refresh_token',
-	) {
-		this.accessTokenKey = accessTokenKey;
-		this.refreshTokenKey = refreshTokenKey;
-	}
-
-	getAccessToken(): string | null {
-		if (typeof window === 'undefined') return null;
-		return localStorage.getItem(this.accessTokenKey);
-	}
-
-	setAccessToken(token: string, _ttl?: number): void {
-		if (typeof window === 'undefined') return;
-		localStorage.setItem(this.accessTokenKey, token);
-	}
-
-	getRefreshToken(): string | null {
-		if (typeof window === 'undefined') return null;
-		return localStorage.getItem(this.refreshTokenKey);
-	}
-
-	setRefreshToken(token: string, _ttl?: number): void {
-		if (typeof window === 'undefined') return;
-		localStorage.setItem(this.refreshTokenKey, token);
-	}
-
-	clearTokens(): void {
-		if (typeof window === 'undefined') return;
-		localStorage.removeItem(this.accessTokenKey);
-		localStorage.removeItem(this.refreshTokenKey);
-	}
-}
-
-export class MemoryTokenStorage implements TokenStorage {
-	private accessToken: string | null = null;
-	private refreshToken: string | null = null;
-
-	getAccessToken(): string | null {
-		return this.accessToken;
-	}
-
-	setAccessToken(token: string, _ttl?: number): void {
-		this.accessToken = token;
-	}
-
-	getRefreshToken(): string | null {
-		return this.refreshToken;
-	}
-
-	setRefreshToken(token: string, _ttl?: number): void {
-		this.refreshToken = token;
-	}
-
-	clearTokens(): void {
-		this.accessToken = null;
-		this.refreshToken = null;
-	}
-}
-
-export interface TokenClientOptions {
-	storage?: TokenStorage;
-	refreshEndpoint?: string;
-	onTokenRefresh?: (tokens: {
-		accessToken: string;
-		refreshToken?: string;
-	}) => void;
-	onTokenExpired?: () => void;
-}
-
-export class TokenClient {
-	private storage: TokenStorage;
-	private refreshEndpoint?: string;
-	private onTokenRefresh?: (tokens: {
-		accessToken: string;
-		refreshToken?: string;
-	}) => void;
-	private onTokenExpired?: () => void;
-
-	constructor(options: TokenClientOptions = {}) {
-		this.storage = options.storage || new LocalStorageTokenStorage();
-		this.refreshEndpoint = options.refreshEndpoint;
-		this.onTokenRefresh = options.onTokenRefresh;
-		this.onTokenExpired = options.onTokenExpired;
-	}
-
-	async getAccessToken(): Promise<string | null> {
-		return await this.storage.getAccessToken();
-	}
-
-	async getRefreshToken(): Promise<string | null> {
-		return await this.storage.getRefreshToken();
-	}
-
-	async setTokens(
-		accessToken: string,
-		refreshToken?: string,
-		accessTtl?: number,
-		refreshTtl?: number,
-	): Promise<void> {
-		await this.storage.setAccessToken(accessToken, accessTtl);
-		if (refreshToken) {
-			await this.storage.setRefreshToken(refreshToken, refreshTtl);
-		}
-	}
-
-	async clearTokens(): Promise<void> {
-		await this.storage.clearTokens();
-	}
-
-	isTokenExpired(token: string): boolean {
-		try {
-			const parts = token.split('.');
-			const payloadPart = parts[1];
-			if (!payloadPart) return true;
-			const payload = JSON.parse(atob(payloadPart));
-			const now = Math.floor(Date.now() / 1000);
-			return payload.exp < now;
-		} catch {
-			return true;
-		}
-	}
-
-	getTokenExpiration(token: string): Date | null {
-		try {
-			const parts = token.split('.');
-			const payloadPart = parts[1];
-			if (!payloadPart) return null;
-			const payload = JSON.parse(atob(payloadPart));
-			return new Date(payload.exp * 1000);
-		} catch {
-			return null;
-		}
-	}
-
-	async refreshTokens(): Promise<boolean> {
-		const refreshToken = await this.getRefreshToken();
-
-		if (!refreshToken || !this.refreshEndpoint) {
-			return false;
-		}
-
-		try {
-			const response = await fetch(this.refreshEndpoint, {
-				method: 'POST',
-				headers: {
-					'Content-Type': 'application/json',
-				},
-				body: JSON.stringify({ refreshToken }),
-			});
-
-			if (!response.ok) {
-				throw new Error('Failed to refresh token');
-			}
-
-			const data = (await response.json()) as {
-				accessToken: string;
-				refreshToken: string;
-			};
-			const { accessToken, refreshToken: newRefreshToken } = data;
-
-			await this.setTokens(accessToken, newRefreshToken);
-
-			if (this.onTokenRefresh) {
-				this.onTokenRefresh({ accessToken, refreshToken: newRefreshToken });
-			}
-
-			return true;
-		} catch (_error) {
-			await this.clearTokens();
-			if (this.onTokenExpired) {
-				this.onTokenExpired();
-			}
-			return false;
-		}
-	}
-
-	async getValidAccessToken(): Promise<string | null> {
-		const accessToken = await this.getAccessToken();
-
-		if (!accessToken) {
-			return null;
-		}
-
-		if (this.isTokenExpired(accessToken)) {
-			const refreshed = await this.refreshTokens();
-			if (!refreshed) {
-				return null;
-			}
-			return await this.getAccessToken();
-		}
-
-		return accessToken;
-	}
-
-	async createAuthHeaders(): Promise<Record<string, string>> {
-		const token = await this.getAccessToken();
-		return token ? { Authorization: `Bearer ${token}` } : {};
-	}
-
-	async createValidAuthHeaders(): Promise<Record<string, string>> {
-		const token = await this.getValidAccessToken();
-		return token ? { Authorization: `Bearer ${token}` } : {};
-	}
-}
-
-export { CacheTokenStorage } from './cacheTokenStorage.js';

package/src/hono/jwt.ts

@@ -1,142 +0,0 @@
-import type { Context, MiddlewareHandler, Next } from 'hono';
-import {
-	type JwtClaims,
-	type JwtConfig,
-	JwtVerifier,
-	type TokenExtractionOptions,
-} from '../jwt';
-
-export {
-	JwtVerifier,
-	type JwtClaims,
-	type JwtConfig,
-	type TokenExtractionOptions,
-};
-
-function extractToken(
-	c: Context,
-	options: TokenExtractionOptions = {},
-): string | null {
-	const {
-		headerName = 'authorization',
-		cookieName,
-		tokenPrefix = 'Bearer ',
-	} = options;
-
-	const headerValue = c.req.header(headerName);
-	if (headerValue) {
-		if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-			return headerValue.slice(tokenPrefix.length);
-		}
-		return headerValue;
-	}
-
-	if (cookieName) {
-		const cookieHeader = c.req.header('cookie');
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) {
-				return match[1];
-			}
-		}
-	}
-
-	return null;
-}
-
-export interface JwtMiddlewareOptions<TClaims extends JwtClaims = JwtClaims> {
-	config: JwtConfig;
-	extraction?: TokenExtractionOptions;
-	contextKey?: string;
-	onError?: (c: Context, error: Error) => Response | Promise<Response>;
-	transformClaims?: (claims: JwtClaims) => TClaims;
-}
-
-/**
- * JWT Middleware for Hono
- *
- * @example
- * ```typescript
- * const jwt = new JwtMiddleware({
- *   config: { secret: process.env.JWT_SECRET! },
- * });
- *
- * app.use('/api/*', jwt.handler());
- *
- * // Or for optional auth
- * app.use('/public/*', jwt.optional());
- * ```
- */
-export class JwtMiddleware<TClaims extends JwtClaims = JwtClaims> {
-	private readonly verifier: JwtVerifier<TClaims>;
-	private readonly extraction: TokenExtractionOptions;
-	private readonly contextKey: string;
-	private readonly onError?: (
-		c: Context,
-		error: Error,
-	) => Response | Promise<Response>;
-	private readonly transformClaims?: (claims: JwtClaims) => TClaims;
-
-	constructor(options: JwtMiddlewareOptions<TClaims>) {
-		this.verifier = new JwtVerifier(options.config);
-		this.extraction = options.extraction ?? {};
-		this.contextKey = options.contextKey ?? 'jwtClaims';
-		this.onError = options.onError;
-		this.transformClaims = options.transformClaims;
-	}
-
-	/**
-	 * Returns middleware that requires valid JWT
-	 */
-	handler(): MiddlewareHandler {
-		return async (c: Context, next: Next) => {
-			const token = extractToken(c, this.extraction);
-
-			if (!token) {
-				if (this.onError) {
-					return this.onError(c, new Error('No token provided'));
-				}
-				return c.json({ error: 'Unauthorized' }, 401);
-			}
-
-			try {
-				const payload = await this.verifier.verify(token);
-				const claims = this.transformClaims
-					? this.transformClaims(payload)
-					: payload;
-
-				c.set(this.contextKey, claims);
-				c.set('jwtToken', token);
-
-				await next();
-			} catch (error) {
-				if (this.onError) {
-					return this.onError(c, error as Error);
-				}
-				return c.json({ error: 'Invalid token' }, 401);
-			}
-		};
-	}
-
-	/**
-	 * Returns middleware that allows unauthenticated requests
-	 */
-	optional(): MiddlewareHandler {
-		return async (c: Context, next: Next) => {
-			const token = extractToken(c, this.extraction);
-
-			if (token) {
-				const claims = await this.verifier.verifyOrNull(token);
-				if (claims) {
-					const transformed = this.transformClaims
-						? this.transformClaims(claims)
-						: claims;
-					c.set(this.contextKey, transformed);
-					c.set('jwtToken', token);
-				}
-			}
-
-			await next();
-		};
-	}
-}

package/src/hono/oidc.ts

@@ -1,170 +0,0 @@
-import type { Context, MiddlewareHandler, Next } from 'hono';
-import {
-	type OidcClaims,
-	type OidcConfig,
-	type OidcUserInfo,
-	OidcVerifier,
-	type TokenExtractionOptions,
-} from '../oidc';
-
-export {
-	OidcVerifier,
-	type OidcClaims,
-	type OidcConfig,
-	type OidcUserInfo,
-	type TokenExtractionOptions,
-};
-
-function extractToken(
-	c: Context,
-	options: TokenExtractionOptions = {},
-): string | null {
-	const {
-		headerName = 'authorization',
-		cookieName,
-		tokenPrefix = 'Bearer ',
-	} = options;
-
-	const headerValue = c.req.header(headerName);
-	if (headerValue) {
-		if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-			return headerValue.slice(tokenPrefix.length);
-		}
-		return headerValue;
-	}
-
-	if (cookieName) {
-		const cookieHeader = c.req.header('cookie');
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) {
-				return match[1];
-			}
-		}
-	}
-
-	return null;
-}
-
-export interface OidcMiddlewareOptions<
-	TClaims extends OidcClaims = OidcClaims,
-	TUserInfo extends OidcUserInfo = OidcUserInfo,
-> {
-	config: OidcConfig;
-	extraction?: TokenExtractionOptions;
-	contextKey?: string;
-	fetchUserInfo?: boolean;
-	onError?: (c: Context, error: Error) => Response | Promise<Response>;
-	transformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;
-}
-
-/**
- * OIDC Middleware for Hono
- *
- * @example
- * ```typescript
- * const oidc = new OidcMiddleware({
- *   config: {
- *     issuer: 'https://auth.example.com',
- *     audience: 'my-client-id',
- *   },
- * });
- *
- * app.use('/api/*', oidc.handler());
- *
- * // With user info
- * const oidcWithUserInfo = new OidcMiddleware({
- *   config: { issuer: '...', audience: '...' },
- *   fetchUserInfo: true,
- * });
- * ```
- */
-export class OidcMiddleware<
-	TClaims extends OidcClaims = OidcClaims,
-	TUserInfo extends OidcUserInfo = OidcUserInfo,
-> {
-	private readonly verifier: OidcVerifier<TClaims, TUserInfo>;
-	private readonly extraction: TokenExtractionOptions;
-	private readonly contextKey: string;
-	private readonly fetchUserInfo: boolean;
-	private readonly onError?: (
-		c: Context,
-		error: Error,
-	) => Response | Promise<Response>;
-	private readonly transformClaims?: (
-		claims: OidcClaims,
-		userInfo?: TUserInfo,
-	) => TClaims;
-
-	constructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {
-		this.verifier = new OidcVerifier(options.config);
-		this.extraction = options.extraction ?? {};
-		this.contextKey = options.contextKey ?? 'oidcClaims';
-		this.fetchUserInfo = options.fetchUserInfo ?? false;
-		this.onError = options.onError;
-		this.transformClaims = options.transformClaims;
-	}
-
-	handler(): MiddlewareHandler {
-		return async (c: Context, next: Next) => {
-			const token = extractToken(c, this.extraction);
-
-			if (!token) {
-				if (this.onError) {
-					return this.onError(c, new Error('No token provided'));
-				}
-				return c.json({ error: 'Unauthorized' }, 401);
-			}
-
-			try {
-				const payload = await this.verifier.verify(token);
-
-				let userInfo: TUserInfo | undefined;
-				if (this.fetchUserInfo) {
-					userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
-					c.set('oidcUserInfo', userInfo);
-				}
-
-				const claims = this.transformClaims
-					? this.transformClaims(payload, userInfo)
-					: payload;
-
-				c.set(this.contextKey, claims);
-				c.set('oidcToken', token);
-
-				await next();
-			} catch (error) {
-				if (this.onError) {
-					return this.onError(c, error as Error);
-				}
-				return c.json({ error: 'Invalid token' }, 401);
-			}
-		};
-	}
-
-	optional(): MiddlewareHandler {
-		return async (c: Context, next: Next) => {
-			const token = extractToken(c, this.extraction);
-
-			if (token) {
-				const payload = await this.verifier.verifyOrNull(token);
-				if (payload) {
-					let userInfo: TUserInfo | undefined;
-					if (this.fetchUserInfo) {
-						userInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;
-						c.set('oidcUserInfo', userInfo);
-					}
-
-					const claims = this.transformClaims
-						? this.transformClaims(payload, userInfo)
-						: payload;
-
-					c.set(this.contextKey, claims);
-					c.set('oidcToken', token);
-				}
-			}
-
-			await next();
-		};
-	}
-}

package/src/index.ts

@@ -1,3 +0,0 @@
-export * from './cacheTokenStorage.js';
-export * from './client.js';
-export * from './tokenManager.js';

package/src/jwt.ts

@@ -1,106 +0,0 @@
-import * as jose from 'jose';
-
-/**
- * Standard JWT claims
- */
-export interface JwtClaims {
-	sub?: string;
-	iss?: string;
-	aud?: string | string[];
-	exp?: number;
-	iat?: number;
-	nbf?: number;
-	jti?: string;
-}
-
-/**
- * Configuration for JWT verification with a symmetric secret
- */
-export interface JwtSecretConfig {
-	secret: string;
-	issuer?: string;
-	audience?: string | string[];
-	algorithms?: string[];
-}
-
-/**
- * Configuration for JWT verification with JWKS
- */
-export interface JwtJwksConfig {
-	jwksUri: string;
-	issuer?: string;
-	audience?: string | string[];
-	algorithms?: string[];
-}
-
-export type JwtConfig = JwtSecretConfig | JwtJwksConfig;
-
-/**
- * Options for token extraction from requests
- */
-export interface TokenExtractionOptions {
-	headerName?: string;
-	cookieName?: string;
-	tokenPrefix?: string;
-}
-
-export function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {
-	return 'jwksUri' in config;
-}
-
-/**
- * JWT Verifier with JWKS caching
- */
-export class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
-	private jwks: jose.JWTVerifyGetKey | null = null;
-	private readonly verifyOptions: jose.JWTVerifyOptions;
-
-	constructor(private readonly config: JwtConfig) {
-		this.verifyOptions = {
-			issuer: config.issuer,
-			audience: config.audience,
-			algorithms:
-				config.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),
-		};
-	}
-
-	async verify(token: string): Promise<TClaims> {
-		if (isJwksConfig(this.config)) {
-			if (!this.jwks) {
-				this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
-			}
-			const { payload } = await jose.jwtVerify(
-				token,
-				this.jwks,
-				this.verifyOptions,
-			);
-			return payload as unknown as TClaims;
-		}
-
-		const secret = new TextEncoder().encode(this.config.secret);
-		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
-		return payload as unknown as TClaims;
-	}
-
-	async verifyOrNull(token: string): Promise<TClaims | null> {
-		try {
-			return await this.verify(token);
-		} catch {
-			return null;
-		}
-	}
-
-	clearCache(): void {
-		this.jwks = null;
-	}
-}
-
-/**
- * Decode a JWT without verification
- * WARNING: This does NOT verify the token signature!
- */
-export function decodeJwt<TClaims extends JwtClaims = JwtClaims>(
-	token: string,
-): TClaims {
-	return jose.decodeJwt(token) as unknown as TClaims;
-}