@geekmidas/auth 9.0.2 → 10.0.0-alpha.0

package/dist/lambda/jwt.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","JwtVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","JwtVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,2BAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/jwt.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAiGY;cAjGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAqEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAgGY;cAhGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAoEH,4CACG,YACR,QAAQ"}

package/dist/lambda/jwt.d.mts

@@ -1,4 +1,4 @@
-import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
+import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
 
 //#region src/lambda/jwt.d.ts

package/dist/lambda/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAiGY;cAjGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAqEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAgGY;cAhGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAoEH,4CACG,YACR,QAAQ"}

package/dist/lambda/jwt.mjs

@@ -1,4 +1,5 @@
-import { JwtVerifier } from "../jwt-D88cPJyT.mjs";
+import { readCookie } from "../cookies-C80f8JtE.mjs";
+import { JwtVerifier } from "../jwt-bZR2_t8F.mjs";
 
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
@@ -93,9 +94,8 @@ var JwtAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) return match[1];
+				const cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);
+				if (cookie) return cookie;
 			}
 			return null;
 		};
@@ -121,5 +121,5 @@ var JwtAuthorizer = class {
 };
 
 //#endregion
-export { JwtAuthorizer, JwtVerifier };
+export { JwtAuthorizer };
 //# sourceMappingURL=jwt.mjs.map

package/dist/lambda/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.cjs

@@ -1,4 +1,5 @@
-const require_oidc = require('../oidc-C0KyYaAK.cjs');
+const require_cookies = require('../cookies-Bc6gUjb6.cjs');
+const require_oidc = require('../oidc-jdMfVyyC.cjs');
 
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
@@ -84,9 +85,8 @@ var OidcAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) return match[1];
+				const cookie = require_cookies.readCookie(headers.cookie ?? headers.Cookie, cookieName);
+				if (cookie) return cookie;
 			}
 			return null;
 		};
@@ -113,5 +113,4 @@ var OidcAuthorizer = class {
 
 //#endregion
 exports.OidcAuthorizer = OidcAuthorizer;
-exports.OidcVerifier = require_oidc.OidcVerifier;
 //# sourceMappingURL=oidc.cjs.map

package/dist/lambda/oidc.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","OidcVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","OidcVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,2BAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAkDiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AA0Fa,cA1FA,cA0FA,CAAA,gBA1F+B,UA0F/B,GA1F4C,UA0F5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAjFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAkEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AAyFa,cAzFA,cAyFA,CAAA,gBAzF+B,UAyF/B,GAzF4C,UAyF5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAhFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAiEH,4CACG,YACR,QAAQ"}

package/dist/lambda/oidc.d.mts

@@ -1,5 +1,5 @@
-import { TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
-import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-DTRgBBl6.mjs";
+import { TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-Ca7GYwmM.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
 
 //#region src/lambda/oidc.d.ts

package/dist/lambda/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAkDiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AA0Fa,cA1FA,cA0FA,CAAA,gBA1F+B,UA0F/B,GA1F4C,UA0F5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAjFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAkEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AAyFa,cAzFA,cAyFA,CAAA,gBAzF+B,UAyF/B,GAzF4C,UAyF5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAhFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAiEH,4CACG,YACR,QAAQ"}

package/dist/lambda/oidc.mjs

@@ -1,4 +1,5 @@
-import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+import { readCookie } from "../cookies-C80f8JtE.mjs";
+import { OidcVerifier } from "../oidc-BYHREHir.mjs";
 
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
@@ -84,9 +85,8 @@ var OidcAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) return match[1];
+				const cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);
+				if (cookie) return cookie;
 			}
 			return null;
 		};
@@ -112,5 +112,5 @@ var OidcAuthorizer = class {
 };
 
 //#endregion
-export { OidcAuthorizer, OidcVerifier };
+export { OidcAuthorizer };
 //# sourceMappingURL=oidc.mjs.map

package/dist/lambda/oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/{oidc-KA30gMlx.mjs → oidc-BYHREHir.mjs}

@@ -59,4 +59,4 @@ var OidcVerifier = class {
 
 //#endregion
 export { OidcVerifier };
-//# sourceMappingURL=oidc-KA30gMlx.mjs.map
+//# sourceMappingURL=oidc-BYHREHir.mjs.map

package/dist/{oidc-KA30gMlx.mjs.map → oidc-BYHREHir.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"oidc-KA30gMlx.mjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}
+{"version":3,"file":"oidc-BYHREHir.mjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}

package/dist/{oidc-DTRgBBl6.d.mts → oidc-Ca7GYwmM.d.mts}

@@ -1,4 +1,4 @@
-import { JwtClaims } from "./jwt-BqLlRkw-.mjs";
+import { JwtClaims } from "./jwt-kejix7rd.mjs";
 
 //#region src/oidc.d.ts
 
@@ -84,4 +84,4 @@ declare class OidcVerifier<TClaims extends OidcClaims = OidcClaims, TUserInfo ex
 //# sourceMappingURL=oidc.d.ts.map
 //#endregion
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier };
-//# sourceMappingURL=oidc-DTRgBBl6.d.mts.map
+//# sourceMappingURL=oidc-Ca7GYwmM.d.mts.map

package/dist/{oidc-DTRgBBl6.d.mts.map → oidc-Ca7GYwmM.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"oidc-DTRgBBl6.d.mts","names":[],"sources":["../src/oidc.ts"],"sourcesContent":[],"mappings":";;;;;AAQA;AAWA;AAiCiB,UA5CA,UAAA,SAAmB,SA4CN,CAAA;EAcb,KAAA,CAAA,EAAA,MAAU;EASd,SAAA,CAAA,EAAA,MAAY;EAAA,OAAA,CAAA,EAAA,MAAA;EAAA,MACR,CAAA,EAAA,MAAA;EAAU,GAAG,CAAA,EAAA,MAAA;;;;;AAaP,UAtEN,YAAA,CAsEM;EAAO,GAwBQ,EAAA,MAAA;EAAO,IAAf,CAAA,EAAA,MAAA;EAAO,UASO,CAAA,EAAA,MAAA;EAAO,WAAf,CAAA,EAAA,MAAA;EAAO,WAQE,CAAA,EAAA,MAAA;EAAS,QAAjB,CAAA,EAAA,MAAA;EAAO,kBAAA,CAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;UA9E3B,aAAA;;;;;;;;;;;;;UAcA,UAAA;;;;;;;;cASJ,6BACI,aAAa,8BACX,eAAe;;;;;sBAMI;kBAMf,QAAQ;;yBAwBD,QAAQ;+BASF,QAAQ;gCAQP,QAAQ"}
+{"version":3,"file":"oidc-Ca7GYwmM.d.mts","names":[],"sources":["../src/oidc.ts"],"sourcesContent":[],"mappings":";;;;;AAQA;AAWA;AAiCiB,UA5CA,UAAA,SAAmB,SA4CN,CAAA;EAcb,KAAA,CAAA,EAAA,MAAU;EASd,SAAA,CAAA,EAAA,MAAY;EAAA,OAAA,CAAA,EAAA,MAAA;EAAA,MACR,CAAA,EAAA,MAAA;EAAU,GAAG,CAAA,EAAA,MAAA;;;;;AAaP,UAtEN,YAAA,CAsEM;EAAO,GAwBQ,EAAA,MAAA;EAAO,IAAf,CAAA,EAAA,MAAA;EAAO,UASO,CAAA,EAAA,MAAA;EAAO,WAAf,CAAA,EAAA,MAAA;EAAO,WAQE,CAAA,EAAA,MAAA;EAAS,QAAjB,CAAA,EAAA,MAAA;EAAO,kBAAA,CAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;UA9E3B,aAAA;;;;;;;;;;;;;UAcA,UAAA;;;;;;;;cASJ,6BACI,aAAa,8BACX,eAAe;;;;;sBAMI;kBAMf,QAAQ;;yBAwBD,QAAQ;+BASF,QAAQ;gCAQP,QAAQ"}

package/dist/{oidc-C0KyYaAK.cjs → oidc-jdMfVyyC.cjs}

@@ -65,4 +65,4 @@ Object.defineProperty(exports, 'OidcVerifier', {
     return OidcVerifier;
   }
 });
-//# sourceMappingURL=oidc-C0KyYaAK.cjs.map
+//# sourceMappingURL=oidc-jdMfVyyC.cjs.map

package/dist/{oidc-C0KyYaAK.cjs.map → oidc-jdMfVyyC.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"oidc-C0KyYaAK.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}
+{"version":3,"file":"oidc-jdMfVyyC.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}

package/dist/oidc.cjs

@@ -1,3 +1,3 @@
-const require_oidc = require('./oidc-C0KyYaAK.cjs');
+const require_oidc = require('./oidc-jdMfVyyC.cjs');
 
 exports.OidcVerifier = require_oidc.OidcVerifier;

package/dist/oidc.d.mts

@@ -1,3 +1,3 @@
-import { TokenExtractionOptions } from "./jwt-BqLlRkw-.mjs";
-import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-DTRgBBl6.mjs";
+import { TokenExtractionOptions } from "./jwt-kejix7rd.mjs";
+import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-Ca7GYwmM.mjs";
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier, TokenExtractionOptions };

package/dist/oidc.mjs

@@ -1,3 +1,3 @@
-import { OidcVerifier } from "./oidc-KA30gMlx.mjs";
+import { OidcVerifier } from "./oidc-BYHREHir.mjs";
 
 export { OidcVerifier };

package/dist/server.cjs

@@ -1,5 +1,5 @@
 const require_cacheTokenStorage = require('./cacheTokenStorage-CEpMniTi.cjs');
-const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
+const require_tokenManager = require('./tokenManager-PQ-OI_NU.cjs');
 
 exports.CacheTokenStorage = require_cacheTokenStorage.CacheTokenStorage;
 exports.TokenManager = require_tokenManager.TokenManager;

package/dist/server.d.mts

@@ -1,3 +1,3 @@
-import { CacheTokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
+import { CacheTokenStorage } from "./cacheTokenStorage-DaqxdNxI.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CosB7J0i.mjs";
 export { CacheTokenStorage, DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/server.mjs

@@ -1,4 +1,4 @@
 import { CacheTokenStorage } from "./cacheTokenStorage-16NE8Cd9.mjs";
-import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
+import { TokenManager } from "./tokenManager-BbylTW7F.mjs";
 
 export { CacheTokenStorage, TokenManager };

package/dist/{tokenManager-Ci2Tgxp8.mjs → tokenManager-BbylTW7F.mjs}

@@ -63,4 +63,4 @@ var TokenManager = class {
 
 //#endregion
 export { TokenManager };
-//# sourceMappingURL=tokenManager-Ci2Tgxp8.mjs.map
+//# sourceMappingURL=tokenManager-BbylTW7F.mjs.map

package/dist/{tokenManager-Ci2Tgxp8.mjs.map → tokenManager-BbylTW7F.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tokenManager-Ci2Tgxp8.mjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,IAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}
+{"version":3,"file":"tokenManager-BbylTW7F.mjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,IAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}

package/dist/{tokenManager-RrwjL0y-.d.mts → tokenManager-CosB7J0i.d.mts}

@@ -37,4 +37,4 @@ declare class TokenManager {
 //# sourceMappingURL=tokenManager.d.ts.map
 //#endregion
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };
-//# sourceMappingURL=tokenManager-RrwjL0y-.d.mts.map
+//# sourceMappingURL=tokenManager-CosB7J0i.d.mts.map

package/dist/{tokenManager-RrwjL0y-.d.mts.map → tokenManager-CosB7J0i.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"tokenManager-RrwjL0y-.d.mts","names":[],"sources":["../src/tokenManager.ts"],"sourcesContent":[],"mappings":";;;UAGiB,YAAA;;EAAA,KAAA,CAAA,EAAA,MAAA;EAMA,CAAA,GAAA,EAAA,MAAS,CAAA,EAAA,GAAA;AAK1B;AAAoC,UALnB,SAAA,CAKmB;EAAA,WAGT,EAAA,MAAA;EAAW,YACV,EAAA,MAAA;AAAW;AAGtB,UAPA,mBAAA,CAOqB;EAKzB,iBAAY,EAAA,MAAA;EAAA,kBAAA,EAAA,MAAA;EAAA,oBAMH,CAAA,EAfE,EAAA,CAAG,WAeL;EAAmB,qBAOb,CAAA,EArBH,EAAA,CAAG,WAqBA;;AAeO,UAjClB,YAAA,SAAqB,YAiCH,CAAA;EAAY,GASX,EAAA,MAAA;EAAY,GAoBnB,EAAA,MAAA;;AAgBW,cAzE3B,YAAA,CAyE2B;;;;;uBAnElB;6BAOM,eAAe;oCAeR;qCASC;;8BAoBP;;qCAgBO"}
+{"version":3,"file":"tokenManager-CosB7J0i.d.mts","names":[],"sources":["../src/tokenManager.ts"],"sourcesContent":[],"mappings":";;;UAGiB,YAAA;;EAAA,KAAA,CAAA,EAAA,MAAA;EAMA,CAAA,GAAA,EAAA,MAAS,CAAA,EAAA,GAAA;AAK1B;AAAoC,UALnB,SAAA,CAKmB;EAAA,WAGT,EAAA,MAAA;EAAW,YACV,EAAA,MAAA;AAAW;AAGtB,UAPA,mBAAA,CAOqB;EAKzB,iBAAY,EAAA,MAAA;EAAA,kBAAA,EAAA,MAAA;EAAA,oBAMH,CAAA,EAfE,EAAA,CAAG,WAeL;EAAmB,qBAOb,CAAA,EArBH,EAAA,CAAG,WAqBA;;AAeO,UAjClB,YAAA,SAAqB,YAiCH,CAAA;EAAY,GASX,EAAA,MAAA;EAAY,GAoBnB,EAAA,MAAA;;AAgBW,cAzE3B,YAAA,CAyE2B;;;;;uBAnElB;6BAOM,eAAe;oCAeR;qCASC;;8BAoBP;;qCAgBO"}

package/dist/{tokenManager-CvEMgxOp.cjs → tokenManager-PQ-OI_NU.cjs}

@@ -69,4 +69,4 @@ Object.defineProperty(exports, 'TokenManager', {
     return TokenManager;
   }
 });
-//# sourceMappingURL=tokenManager-CvEMgxOp.cjs.map
+//# sourceMappingURL=tokenManager-PQ-OI_NU.cjs.map

package/dist/{tokenManager-CvEMgxOp.cjs.map → tokenManager-PQ-OI_NU.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"tokenManager-CvEMgxOp.cjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,qBAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}
+{"version":3,"file":"tokenManager-PQ-OI_NU.cjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,qBAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}

package/dist/tokenManager.cjs

@@ -1,3 +1,3 @@
-const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
+const require_tokenManager = require('./tokenManager-PQ-OI_NU.cjs');
 
 exports.TokenManager = require_tokenManager.TokenManager;

package/dist/tokenManager.d.mts

@@ -1,2 +1,2 @@
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CosB7J0i.mjs";
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/tokenManager.mjs

@@ -1,3 +1,3 @@
-import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
+import { TokenManager } from "./tokenManager-BbylTW7F.mjs";
 
 export { TokenManager };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/auth",
-  "version": "9.0.2",
+  "version": "10.0.0-alpha.0",
   "description": "JWT and OIDC authentication with token verification, Hono middleware, and Lambda authorizers",
   "type": "module",
   "exports": {
@@ -95,6 +95,9 @@
       }
     }
   },
+  "files": [
+    "dist"
+  ],
   "repository": {
     "type": "git",
     "url": "https://github.com/geekmidas/toolbox"
@@ -111,12 +114,12 @@
   },
   "devDependencies": {
     "@types/jsonwebtoken": "^9.0.5",
-    "@geekmidas/cache": "^9.0.2"
+    "@geekmidas/cache": "^10.0.0-alpha.0"
   },
   "peerDependencies": {
     "@types/aws-lambda": ">=8.10.92",
     "hono": ">=4.0.0",
-    "@geekmidas/cache": "^9.0.2"
+    "@geekmidas/cache": "^10.0.0-alpha.0"
   },
   "peerDependenciesMeta": {
     "@geekmidas/cache": {