@gjermundgaraba/clankerauth-dev 0.4.0 → 0.5.1

package/README.md

@@ -30,6 +30,20 @@ await issuer.close();
 
 Each call listens on a random loopback port, creates a fresh SQLite database and secret in a temporary directory, provisions the owner, the resources and the client in-process through the server's administration module, and returns. Only the returned issuer is reached over HTTP. The client is first party: once the owner is signed in, an authorization request redirects straight to the callback with a code and no consent step. `close()` drains in-flight requests, closes the database and deletes the directory. Nothing is shared between calls and nothing survives them.
 
+To develop an app behind forward auth, pass a `cookieDomain`:
+
+```ts
+const issuer = await startDisposableIssuer({
+  resources: [{ identifier: "http://app.notes.localhost:8080/api", name: "Notes", scopes: [] }],
+  client: { name: "Notes console", redirect: "http://localhost:5173/callback", resources: [] },
+  cookieDomain: "notes.localhost",
+});
+
+issuer.url; // http://auth.notes.localhost:<port>
+```
+
+The issuer then serves `/forward-auth?resource=<identifier>`, `/forward-auth/continue` and `/forward-auth/logout`, and shares its forward cookie with every host under the domain, so serve the app on one, such as `app.notes.localhost`. Browsers and Node resolve `.localhost` names to loopback without a hosts-file entry. A signed-in owner's check answers `204` with an `Authorization` header to copy upstream; without a session, a page navigation (`Sec-Fetch-Mode: navigate`) is redirected through sign-in and any other request is `401`. Node's `fetch` always sends `Sec-Fetch-Mode: cors`, so a proxy written in Node must make the check with `node:http` to relay the browser's header. Without `cookieDomain` the issuer is `http://127.0.0.1:<port>` and these routes are not served.
+
 Two optional test hooks help exercise integrations:
 
 - `cimdTransport(input, init)` replaces outbound Client ID Metadata Document retrieval and returns a `Response` or `Promise<Response>`. Its arguments match `fetch`. Use it to serve fixture metadata for HTTPS client IDs without an external server. When omitted, the issuer uses its secure metadata transport.

package/dist/THIRD_PARTY_NOTICES.txt

@@ -472,7 +472,7 @@ SOFTWARE.
 
 ---
 
-@gjermundgaraba/effect-actions@0.1.0
+@gjermundgaraba/effect-actions@0.2.0
 LICENSE
 MIT License
 
@@ -1399,33 +1399,6 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
----
-
-oauth4webapi@3.8.8
-LICENSE.md
-The MIT License (MIT)
-
-Copyright (c) 2022 Filip Skokan
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-
 ---
 
 redis@6.2.1

package/dist/index.d.ts

@@ -1,6 +1,13 @@
 export interface DisposableIssuerOptions {
   resources: Array<{ identifier: string; name: string; scopes: string[] }>;
   client: { name: string; redirect: string; resources: string[] };
+  /**
+   * Serve forward auth for apps under this domain, such as `notes.localhost`. The issuer is
+   * then `http://auth.<cookieDomain>:<port>` on the same loopback listener, and the forward
+   * cookie is shared with every host under the domain. Without it, the issuer is
+   * `http://127.0.0.1:<port>` and the forward-auth routes are not served.
+   */
+  cookieDomain?: string;
   /** Test hook replacing outbound CIMD metadata retrieval. Defaults to the secure transport. */
   cimdTransport?: (input: RequestInfo | URL, init?: RequestInit) => Response | Promise<Response>;
   /** Test hook observing incoming HTTP requests, including provisioning. No headers or bodies. */