@growth-labs/auth 0.1.3 → 0.2.0

package/dist/utils/tokens.js

@@ -1,27 +1,49 @@
-import { createLocalJWKSet, jwtVerify } from 'jose';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
 const jwksCache = new Map();
-async function getJWKS(issuer) {
+function getJWKS(issuer) {
     let jwks = jwksCache.get(issuer);
     if (jwks)
         return jwks;
-    const response = await fetch(`${issuer}/.well-known/jwks.json`);
-    if (!response.ok)
-        throw new Error(`JWKS fetch failed: ${response.status}`);
-    const data = (await response.json());
-    jwks = createLocalJWKSet(data);
+    const jwksUrl = new URL('/.well-known/jwks.json', issuer);
+    jwks = createRemoteJWKSet(jwksUrl);
     jwksCache.set(issuer, jwks);
     return jwks;
 }
+/**
+ * Extract subject claims from an OpenAuth-issued JWT payload.
+ *
+ * OpenAuth places the subject payload (defined by the issuer's `subjects`
+ * schema) under `properties` in the access token. The standalone
+ * identity-platform issuer's subject contains:
+ *   - userId, email, name, image, isNewUser
+ *
+ * The JWT's top-level `sub` is `{type}:{sha1-prefix}` (an OpenAuth-internal
+ * subject hash, NOT the user ID). Always read the user ID from
+ * `properties.userId`.
+ */
+function extractClaims(payload) {
+    const propsCandidate = payload.properties;
+    const props = propsCandidate && typeof propsCandidate === 'object'
+        ? propsCandidate
+        : {};
+    const userId = typeof props.userId === 'string' ? props.userId : null;
+    const email = typeof props.email === 'string' ? props.email : null;
+    if (!userId || !email) {
+        return null;
+    }
+    return {
+        userId,
+        email,
+        name: typeof props.name === 'string' ? props.name : undefined,
+        image: typeof props.image === 'string' ? props.image : undefined,
+        isNewUser: typeof props.isNewUser === 'boolean' ? props.isNewUser : undefined,
+    };
+}
 export async function verifyAccessToken(issuer, token) {
     try {
-        const jwks = await getJWKS(issuer);
+        const jwks = getJWKS(issuer);
         const { payload } = await jwtVerify(token, jwks, { issuer });
-        return {
-            sub: payload.sub,
-            email: payload.email,
-            name: payload.name,
-            image: payload.image,
-        };
+        return extractClaims(payload);
     }
     catch (err) {
         console.error('verifyAccessToken error:', err);
@@ -36,7 +58,8 @@ export async function refreshTokens(issuer, refreshToken, clientId) {
         });
         if (clientId)
             params.set('client_id', clientId);
-        const response = await fetch(`${issuer}/token`, {
+        const tokenUrl = new URL('/token', issuer).toString();
+        const response = await fetch(tokenUrl, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: params.toString(),
@@ -44,16 +67,15 @@ export async function refreshTokens(issuer, refreshToken, clientId) {
         if (!response.ok)
             return null;
         const data = (await response.json());
-        const claims = decodeJwtPayload(data.access_token);
+        if (!data.access_token || !data.refresh_token)
+            return null;
+        const claims = extractClaims(decodeJwtPayload(data.access_token));
+        if (!claims)
+            return null;
         return {
             accessToken: data.access_token,
             refreshToken: data.refresh_token,
-            claims: {
-                sub: claims.sub,
-                email: claims.email,
-                name: claims.name,
-                image: claims.image,
-            },
+            claims,
         };
     }
     catch {
@@ -64,9 +86,17 @@ export function decodeJwtPayload(jwt) {
     const parts = jwt.split('.');
     if (parts.length !== 3)
         return {};
-    const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
-    return JSON.parse(atob(payload));
+    const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    try {
+        return JSON.parse(atob(padded));
+    }
+    catch {
+        return {};
+    }
 }
+/**
+ * Exposed for tests so cached JWKS sets can be reset between cases.
+ */
 export function _resetJwksCache() {
     jwksCache.clear();
 }

package/dist/utils/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAKnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;AAEjD,KAAK,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC9B,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACZ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,OAAO;YACN,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAA0B;YACxC,KAAK,EAAE,OAAO,CAAC,KAA2B;SAC1C,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAc,EACd,YAAoB,EACpB,QAAiB;IAEjB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC3B,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAE/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAElD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAe;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,KAAK,EAAE,MAAM,CAAC,KAA2B;aACzC;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAKpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;AAEjD,SAAS,OAAO,CAAC,MAAc;IAC9B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAClC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,OAAgC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAA;IACzC,MAAM,KAAK,GACV,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QACnD,CAAC,CAAE,cAA0C;QAC7C,CAAC,CAAC,EAAE,CAAA;IAEN,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACrE,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAElE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,OAAO;QACN,MAAM;QACN,KAAK;QACL,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChE,SAAS,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAC7E,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,OAAO,aAAa,CAAC,OAAkC,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAc,EACd,YAAoB,EACpB,QAAiB;IAEjB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC3B,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAE/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAA;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAA;QAE1D,MAAM,MAAM,GAAG,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,MAAM;SACN,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC7D,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAA4B,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}

package/package.json

@@ -1,59 +1,75 @@
 {
-	"name": "@growth-labs/auth",
-	"version": "0.1.3",
-	"type": "module",
-	"exports": {
-		".": {
-			"types": "./dist/index.d.ts",
-			"import": "./dist/index.js"
-		},
-		"./utils": {
-			"types": "./dist/utils/index.d.ts",
-			"import": "./dist/utils/index.js"
-		},
-		"./middleware/*": {
-			"types": "./dist/middleware/*.d.ts",
-			"import": "./dist/middleware/*.js"
-		},
-		"./routes/*": {
-			"types": "./dist/routes/*.d.ts",
-			"import": "./dist/routes/*.js"
-		},
-		"./types": {
-			"types": "./dist/types.d.ts",
-			"import": "./dist/types.js"
-		}
-	},
-	"files": [
-		"dist",
-		"README.md"
-	],
-	"publishConfig": {
-		"access": "public",
-		"registry": "https://registry.npmjs.org/"
-	},
-	"scripts": {
-		"build": "tsc",
-		"test": "vitest run",
-		"test:watch": "vitest"
-	},
-	"peerDependencies": {
-		"astro": "^6.0.0",
-		"@growth-labs/analytics": "^0.1.0"
-	},
-	"peerDependenciesMeta": {
-		"@growth-labs/analytics": {
-			"optional": true
-		}
-	},
-	"dependencies": {
-		"zod": "^3.23.0",
-		"jose": "^6.0.0"
-	},
-	"devDependencies": {
-		"@growth-labs/analytics": "workspace:*",
-		"astro": "^6.0.0",
-		"typescript": "^5.8.0",
-		"vitest": "^3.0.0"
-	}
-}
+  "name": "@growth-labs/auth",
+  "version": "0.2.0",
+  "description": "OpenAuth client package for Astro + Cloudflare. Verifies JWTs, manages session cookies, gates protected paths, and injects login/logout/callback routes.",
+  "keywords": [
+    "astro",
+    "astro-integration",
+    "openauth",
+    "oauth",
+    "cloudflare-workers",
+    "auth"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/growth-labs/platform.git",
+    "directory": "packages/auth"
+  },
+  "homepage": "https://github.com/growth-labs/platform/tree/main/packages/auth#readme",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./utils": {
+      "types": "./dist/utils/index.d.ts",
+      "import": "./dist/utils/index.js"
+    },
+    "./middleware/*": {
+      "types": "./dist/middleware/*.d.ts",
+      "import": "./dist/middleware/*.js"
+    },
+    "./routes/*": {
+      "types": "./dist/routes/*.d.ts",
+      "import": "./dist/routes/*.js"
+    },
+    "./types": {
+      "types": "./dist/types.d.ts",
+      "import": "./dist/types.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "astro": "^6.0.0",
+    "@growth-labs/analytics": "^0.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@growth-labs/analytics": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "zod": "^3.23.0",
+    "jose": "^6.0.0"
+  },
+  "devDependencies": {
+    "astro": "^6.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0",
+    "@growth-labs/analytics": "0.1.3"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}