@geekmidas/auth 9.0.2 → 10.0.0-alpha.1

package/src/lambda/jwt.ts

@@ -1,210 +0,0 @@
-import type {
-	APIGatewayAuthorizerResult,
-	APIGatewayRequestAuthorizerEvent,
-	APIGatewayTokenAuthorizerEvent,
-	Context as LambdaContext,
-	PolicyDocument,
-} from 'aws-lambda';
-import {
-	type JwtClaims,
-	type JwtConfig,
-	JwtVerifier,
-	type TokenExtractionOptions,
-} from '../jwt';
-
-export {
-	JwtVerifier,
-	type JwtClaims,
-	type JwtConfig,
-	type TokenExtractionOptions,
-};
-
-function generatePolicy(
-	principalId: string,
-	effect: 'Allow' | 'Deny',
-	resource: string,
-	context?: Record<string, string | number | boolean>,
-): APIGatewayAuthorizerResult {
-	const policyDocument: PolicyDocument = {
-		Version: '2012-10-17',
-		Statement: [
-			{
-				Action: 'execute-api:Invoke',
-				Effect: effect,
-				Resource: resource,
-			},
-		],
-	};
-
-	return {
-		principalId,
-		policyDocument,
-		context,
-	};
-}
-
-function getWildcardResource(methodArn: string): string {
-	const parts = methodArn.split('/');
-	return `${parts[0]}/${parts[1]}/*`;
-}
-
-export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
-	config: JwtConfig;
-	extraction?: TokenExtractionOptions;
-	wildcardResource?: boolean;
-	getPrincipalId?: (claims: TClaims) => string;
-	getContext?: (
-		claims: TClaims,
-	) => Record<string, string | number | boolean> | undefined;
-	authorize?: (claims: TClaims) => boolean | Promise<boolean>;
-}
-
-/**
- * JWT Lambda Authorizer
- *
- * @example
- * ```typescript
- * const authorizer = new JwtAuthorizer({
- *   config: {
- *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',
- *     issuer: 'https://auth.example.com',
- *   },
- *   getContext: (claims) => ({ userId: claims.sub! }),
- * });
- *
- * // TOKEN authorizer
- * export const tokenHandler = authorizer.tokenHandler();
- *
- * // REQUEST authorizer
- * export const requestHandler = authorizer.requestHandler();
- * ```
- */
-export class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
-	private readonly verifier: JwtVerifier<TClaims>;
-	private readonly extraction: TokenExtractionOptions;
-	private readonly wildcardResource: boolean;
-	private readonly getPrincipalId: (claims: TClaims) => string;
-	private readonly getContext?: (
-		claims: TClaims,
-	) => Record<string, string | number | boolean> | undefined;
-	private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;
-
-	constructor(options: JwtAuthorizerOptions<TClaims>) {
-		this.verifier = new JwtVerifier(options.config);
-		this.extraction = options.extraction ?? {};
-		this.wildcardResource = options.wildcardResource ?? true;
-		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');
-		this.getContext = options.getContext;
-		this.authorize = options.authorize;
-	}
-
-	/**
-	 * Returns a TOKEN authorizer handler
-	 */
-	tokenHandler() {
-		return async (
-			event: APIGatewayTokenAuthorizerEvent,
-			_context: LambdaContext,
-		): Promise<APIGatewayAuthorizerResult> => {
-			const { authorizationToken, methodArn } = event;
-			const resource = this.wildcardResource
-				? getWildcardResource(methodArn)
-				: methodArn;
-
-			const token = authorizationToken.startsWith('Bearer ')
-				? authorizationToken.slice(7)
-				: authorizationToken;
-
-			try {
-				const claims = await this.verifier.verify(token);
-
-				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) {
-						return generatePolicy('unauthorized', 'Deny', resource);
-					}
-				}
-
-				const principalId = this.getPrincipalId(claims);
-				const context = this.getContext?.(claims);
-
-				return generatePolicy(principalId, 'Allow', resource, context);
-			} catch {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-		};
-	}
-
-	/**
-	 * Returns a REQUEST authorizer handler
-	 */
-	requestHandler() {
-		const {
-			headerName = 'authorization',
-			cookieName,
-			tokenPrefix = 'Bearer ',
-		} = this.extraction;
-
-		const extractToken = (
-			event: APIGatewayRequestAuthorizerEvent,
-		): string | null => {
-			const headers = event.headers ?? {};
-			const headerKey = Object.keys(headers).find(
-				(k) => k.toLowerCase() === headerName.toLowerCase(),
-			);
-			if (headerKey) {
-				const headerValue = headers[headerKey];
-				if (headerValue) {
-					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-						return headerValue.slice(tokenPrefix.length);
-					}
-					return headerValue;
-				}
-			}
-
-			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? '';
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) {
-					return match[1];
-				}
-			}
-
-			return null;
-		};
-
-		return async (
-			event: APIGatewayRequestAuthorizerEvent,
-			_context: LambdaContext,
-		): Promise<APIGatewayAuthorizerResult> => {
-			const methodArn = event.methodArn;
-			const resource = this.wildcardResource
-				? getWildcardResource(methodArn)
-				: methodArn;
-
-			const token = extractToken(event);
-
-			if (!token) {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-
-			try {
-				const claims = await this.verifier.verify(token);
-
-				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) {
-						return generatePolicy('unauthorized', 'Deny', resource);
-					}
-				}
-
-				const principalId = this.getPrincipalId(claims);
-				const context = this.getContext?.(claims);
-
-				return generatePolicy(principalId, 'Allow', resource, context);
-			} catch {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-		};
-	}
-}

package/src/lambda/oidc.ts

@@ -1,203 +0,0 @@
-import type {
-	APIGatewayAuthorizerResult,
-	APIGatewayRequestAuthorizerEvent,
-	APIGatewayTokenAuthorizerEvent,
-	Context as LambdaContext,
-	PolicyDocument,
-} from 'aws-lambda';
-import {
-	type OidcClaims,
-	type OidcConfig,
-	OidcVerifier,
-	type TokenExtractionOptions,
-} from '../oidc';
-
-export {
-	OidcVerifier,
-	type OidcClaims,
-	type OidcConfig,
-	type TokenExtractionOptions,
-};
-
-function generatePolicy(
-	principalId: string,
-	effect: 'Allow' | 'Deny',
-	resource: string,
-	context?: Record<string, string | number | boolean>,
-): APIGatewayAuthorizerResult {
-	const policyDocument: PolicyDocument = {
-		Version: '2012-10-17',
-		Statement: [
-			{
-				Action: 'execute-api:Invoke',
-				Effect: effect,
-				Resource: resource,
-			},
-		],
-	};
-
-	return {
-		principalId,
-		policyDocument,
-		context,
-	};
-}
-
-function getWildcardResource(methodArn: string): string {
-	const parts = methodArn.split('/');
-	return `${parts[0]}/${parts[1]}/*`;
-}
-
-export interface OidcAuthorizerOptions<
-	TClaims extends OidcClaims = OidcClaims,
-> {
-	config: OidcConfig;
-	extraction?: TokenExtractionOptions;
-	wildcardResource?: boolean;
-	getPrincipalId?: (claims: TClaims) => string;
-	getContext?: (
-		claims: TClaims,
-	) => Record<string, string | number | boolean> | undefined;
-	authorize?: (claims: TClaims) => boolean | Promise<boolean>;
-}
-
-/**
- * OIDC Lambda Authorizer
- *
- * @example
- * ```typescript
- * const authorizer = new OidcAuthorizer({
- *   config: {
- *     issuer: 'https://auth.example.com',
- *     audience: 'my-api',
- *   },
- *   getContext: (claims) => ({ userId: claims.sub! }),
- * });
- *
- * export const tokenHandler = authorizer.tokenHandler();
- * export const requestHandler = authorizer.requestHandler();
- * ```
- */
-export class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
-	private readonly verifier: OidcVerifier<TClaims>;
-	private readonly extraction: TokenExtractionOptions;
-	private readonly wildcardResource: boolean;
-	private readonly getPrincipalId: (claims: TClaims) => string;
-	private readonly getContext?: (
-		claims: TClaims,
-	) => Record<string, string | number | boolean> | undefined;
-	private readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;
-
-	constructor(options: OidcAuthorizerOptions<TClaims>) {
-		this.verifier = new OidcVerifier(options.config);
-		this.extraction = options.extraction ?? {};
-		this.wildcardResource = options.wildcardResource ?? true;
-		this.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');
-		this.getContext = options.getContext;
-		this.authorize = options.authorize;
-	}
-
-	tokenHandler() {
-		return async (
-			event: APIGatewayTokenAuthorizerEvent,
-			_context: LambdaContext,
-		): Promise<APIGatewayAuthorizerResult> => {
-			const { authorizationToken, methodArn } = event;
-			const resource = this.wildcardResource
-				? getWildcardResource(methodArn)
-				: methodArn;
-
-			const token = authorizationToken.startsWith('Bearer ')
-				? authorizationToken.slice(7)
-				: authorizationToken;
-
-			try {
-				const claims = await this.verifier.verify(token);
-
-				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) {
-						return generatePolicy('unauthorized', 'Deny', resource);
-					}
-				}
-
-				const principalId = this.getPrincipalId(claims);
-				const context = this.getContext?.(claims);
-
-				return generatePolicy(principalId, 'Allow', resource, context);
-			} catch {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-		};
-	}
-
-	requestHandler() {
-		const {
-			headerName = 'authorization',
-			cookieName,
-			tokenPrefix = 'Bearer ',
-		} = this.extraction;
-
-		const extractToken = (
-			event: APIGatewayRequestAuthorizerEvent,
-		): string | null => {
-			const headers = event.headers ?? {};
-			const headerKey = Object.keys(headers).find(
-				(k) => k.toLowerCase() === headerName.toLowerCase(),
-			);
-			if (headerKey) {
-				const headerValue = headers[headerKey];
-				if (headerValue) {
-					if (tokenPrefix && headerValue.startsWith(tokenPrefix)) {
-						return headerValue.slice(tokenPrefix.length);
-					}
-					return headerValue;
-				}
-			}
-
-			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? '';
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) {
-					return match[1];
-				}
-			}
-
-			return null;
-		};
-
-		return async (
-			event: APIGatewayRequestAuthorizerEvent,
-			_context: LambdaContext,
-		): Promise<APIGatewayAuthorizerResult> => {
-			const methodArn = event.methodArn;
-			const resource = this.wildcardResource
-				? getWildcardResource(methodArn)
-				: methodArn;
-
-			const token = extractToken(event);
-
-			if (!token) {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-
-			try {
-				const claims = await this.verifier.verify(token);
-
-				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) {
-						return generatePolicy('unauthorized', 'Deny', resource);
-					}
-				}
-
-				const principalId = this.getPrincipalId(claims);
-				const context = this.getContext?.(claims);
-
-				return generatePolicy(principalId, 'Allow', resource, context);
-			} catch {
-				return generatePolicy('unauthorized', 'Deny', resource);
-			}
-		};
-	}
-}

package/src/oidc.ts

@@ -1,156 +0,0 @@
-import * as jose from 'jose';
-import type { JwtClaims, TokenExtractionOptions } from './jwt';
-
-export type { TokenExtractionOptions };
-
-/**
- * Standard OIDC claims (extends JWT claims)
- */
-export interface OidcClaims extends JwtClaims {
-	nonce?: string;
-	auth_time?: number;
-	at_hash?: string;
-	c_hash?: string;
-	azp?: string;
-}
-
-/**
- * Standard OIDC user info claims
- */
-export interface OidcUserInfo {
-	sub: string;
-	name?: string;
-	given_name?: string;
-	family_name?: string;
-	middle_name?: string;
-	nickname?: string;
-	preferred_username?: string;
-	profile?: string;
-	picture?: string;
-	website?: string;
-	email?: string;
-	email_verified?: boolean;
-	gender?: string;
-	birthdate?: string;
-	zoneinfo?: string;
-	locale?: string;
-	phone_number?: string;
-	phone_number_verified?: boolean;
-	address?: {
-		formatted?: string;
-		street_address?: string;
-		locality?: string;
-		region?: string;
-		postal_code?: string;
-		country?: string;
-	};
-	updated_at?: number;
-}
-
-/**
- * OIDC Discovery document
- */
-export interface OidcDiscovery {
-	issuer: string;
-	authorization_endpoint: string;
-	token_endpoint: string;
-	userinfo_endpoint?: string;
-	jwks_uri: string;
-	scopes_supported?: string[];
-	response_types_supported: string[];
-	claims_supported?: string[];
-}
-
-/**
- * Configuration for OIDC verification
- */
-export interface OidcConfig {
-	issuer: string;
-	audience: string | string[];
-	cacheDiscovery?: boolean;
-}
-
-/**
- * OIDC Verifier with auto-discovery and caching
- */
-export class OidcVerifier<
-	TClaims extends OidcClaims = OidcClaims,
-	TUserInfo extends OidcUserInfo = OidcUserInfo,
-> {
-	private discovery: OidcDiscovery | null = null;
-	private jwks: jose.JWTVerifyGetKey | null = null;
-	private readonly discoveryUrl: string;
-
-	constructor(private readonly config: OidcConfig) {
-		this.discoveryUrl = config.issuer.endsWith('/')
-			? `${config.issuer}.well-known/openid-configuration`
-			: `${config.issuer}/.well-known/openid-configuration`;
-	}
-
-	async getDiscovery(): Promise<OidcDiscovery> {
-		if (this.discovery && this.config.cacheDiscovery !== false) {
-			return this.discovery;
-		}
-
-		const response = await fetch(this.discoveryUrl);
-		if (!response.ok) {
-			throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);
-		}
-
-		this.discovery = (await response.json()) as OidcDiscovery;
-		return this.discovery;
-	}
-
-	private async getJwks(): Promise<jose.JWTVerifyGetKey> {
-		if (this.jwks && this.config.cacheDiscovery !== false) {
-			return this.jwks;
-		}
-
-		const disc = await this.getDiscovery();
-		this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));
-		return this.jwks;
-	}
-
-	async verify(token: string): Promise<TClaims> {
-		const key = await this.getJwks();
-		const { payload } = await jose.jwtVerify(token, key, {
-			issuer: this.config.issuer,
-			audience: this.config.audience,
-		});
-		return payload as unknown as TClaims;
-	}
-
-	async verifyOrNull(token: string): Promise<TClaims | null> {
-		try {
-			return await this.verify(token);
-		} catch {
-			return null;
-		}
-	}
-
-	async fetchUserInfo(token: string): Promise<TUserInfo | null> {
-		try {
-			const disc = await this.getDiscovery();
-			if (!disc.userinfo_endpoint) {
-				return null;
-			}
-
-			const response = await fetch(disc.userinfo_endpoint, {
-				headers: { Authorization: `Bearer ${token}` },
-			});
-
-			if (!response.ok) {
-				return null;
-			}
-
-			return (await response.json()) as TUserInfo;
-		} catch {
-			return null;
-		}
-	}
-
-	clearCache(): void {
-		this.discovery = null;
-		this.jwks = null;
-	}
-}

package/src/server.ts

@@ -1,8 +0,0 @@
-export { CacheTokenStorage } from './cacheTokenStorage.js';
-export {
-	type DecodedToken,
-	TokenManager,
-	type TokenManagerOptions,
-	type TokenPair,
-	type TokenPayload,
-} from './tokenManager.js';

package/src/tokenManager.ts

@@ -1,106 +0,0 @@
-import jwt from 'jsonwebtoken';
-import type ms from 'ms';
-
-export interface TokenPayload {
-	userId: string;
-	email?: string;
-	[key: string]: any;
-}
-
-export interface TokenPair {
-	accessToken: string;
-	refreshToken: string;
-}
-
-export interface TokenManagerOptions {
-	accessTokenSecret: string;
-	refreshTokenSecret: string;
-	accessTokenExpiresIn?: ms.StringValue;
-	refreshTokenExpiresIn?: ms.StringValue;
-}
-
-export interface DecodedToken extends TokenPayload {
-	iat: number;
-	exp: number;
-}
-
-export class TokenManager {
-	private accessTokenSecret: string;
-	private refreshTokenSecret: string;
-	private accessTokenExpiresIn: ms.StringValue;
-	private refreshTokenExpiresIn: ms.StringValue;
-
-	constructor(options: TokenManagerOptions) {
-		this.accessTokenSecret = options.accessTokenSecret;
-		this.refreshTokenSecret = options.refreshTokenSecret;
-		this.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';
-		this.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';
-	}
-
-	generateTokenPair(payload: TokenPayload): TokenPair {
-		const accessToken = jwt.sign(payload, this.accessTokenSecret, {
-			expiresIn: this.accessTokenExpiresIn,
-		});
-
-		const refreshToken = jwt.sign(payload, this.refreshTokenSecret, {
-			expiresIn: this.refreshTokenExpiresIn,
-		});
-
-		return {
-			accessToken,
-			refreshToken,
-		};
-	}
-
-	verifyAccessToken(token: string): DecodedToken {
-		try {
-			return jwt.verify(token, this.accessTokenSecret) as DecodedToken;
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			throw new Error(`Invalid access token: ${message}`);
-		}
-	}
-
-	verifyRefreshToken(token: string): DecodedToken {
-		try {
-			return jwt.verify(token, this.refreshTokenSecret) as DecodedToken;
-		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			throw new Error(`Invalid refresh token: ${message}`);
-		}
-	}
-
-	refreshAccessToken(refreshToken: string): string {
-		const decoded = this.verifyRefreshToken(refreshToken);
-
-		// Remove JWT specific fields before creating new token
-		const { iat, exp, ...payload } = decoded;
-
-		return jwt.sign(payload, this.accessTokenSecret, {
-			expiresIn: this.accessTokenExpiresIn,
-		});
-	}
-
-	decodeToken(token: string): DecodedToken | null {
-		try {
-			return jwt.decode(token) as DecodedToken;
-		} catch {
-			return null;
-		}
-	}
-
-	isTokenExpired(token: string): boolean {
-		const decoded = this.decodeToken(token);
-		if (!decoded) return true;
-
-		const now = Math.floor(Date.now() / 1000);
-		return decoded.exp < now;
-	}
-
-	getTokenExpiration(token: string): Date | null {
-		const decoded = this.decodeToken(token);
-		if (!decoded) return null;
-
-		return new Date(decoded.exp * 1000);
-	}
-}

package/tsconfig.json

@@ -1,10 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": true,
-    "lib": ["ES2023", "DOM"]
-  },
-  "include": ["src/**/*"]
-}

package/tsdown.config.ts

@@ -1,3 +0,0 @@
-import { defineConfig } from 'tsdown';
-
-export default defineConfig({});