@growth-labs/auth 0.1.3

package/dist/utils/pkce.js

@@ -0,0 +1,10 @@
+import { base64url } from './encoding.js';
+export async function generatePKCE() {
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    const verifier = base64url(array);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    const challenge = base64url(new Uint8Array(digest));
+    return { verifier, challenge };
+}
+//# sourceMappingURL=pkce.js.map

package/dist/utils/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/utils/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,MAAM,CAAC,KAAK,UAAU,YAAY;IACjC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;IAEjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAEnD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAA;AAC/B,CAAC"}

package/dist/utils/state.d.ts

@@ -0,0 +1,3 @@
+export declare function generateState(): string;
+export declare function verifyState(returned: string, stored: string): boolean;
+//# sourceMappingURL=state.d.ts.map

package/dist/utils/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/utils/state.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,IAAI,MAAM,CAItC;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWrE"}

package/dist/utils/state.js

@@ -0,0 +1,20 @@
+import { base64url } from './encoding.js';
+export function generateState() {
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    return base64url(array);
+}
+export function verifyState(returned, stored) {
+    if (!returned || !stored)
+        return false;
+    if (returned.length !== stored.length)
+        return false;
+    const a = new TextEncoder().encode(returned);
+    const b = new TextEncoder().encode(stored);
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=state.js.map

package/dist/utils/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/utils/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,MAAM,UAAU,aAAa;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEnD,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AAClB,CAAC"}

package/dist/utils/tokens.d.ts

@@ -0,0 +1,12 @@
+import type { TokenRefreshResult } from '../types.js';
+export interface VerifiedClaims {
+    sub: string;
+    email: string;
+    name?: string;
+    image?: string;
+}
+export declare function verifyAccessToken(issuer: string, token: string): Promise<VerifiedClaims | null>;
+export declare function refreshTokens(issuer: string, refreshToken: string, clientId?: string): Promise<TokenRefreshResult | null>;
+export declare function decodeJwtPayload(jwt: string): Record<string, unknown>;
+export declare function _resetJwksCache(): void;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/utils/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAkBrD,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACd;AAED,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAchC;AAED,wBAAsB,aAAa,CAClC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAoCpC;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKrE;AAED,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/utils/tokens.js

@@ -0,0 +1,73 @@
+import { createLocalJWKSet, jwtVerify } from 'jose';
+const jwksCache = new Map();
+async function getJWKS(issuer) {
+    let jwks = jwksCache.get(issuer);
+    if (jwks)
+        return jwks;
+    const response = await fetch(`${issuer}/.well-known/jwks.json`);
+    if (!response.ok)
+        throw new Error(`JWKS fetch failed: ${response.status}`);
+    const data = (await response.json());
+    jwks = createLocalJWKSet(data);
+    jwksCache.set(issuer, jwks);
+    return jwks;
+}
+export async function verifyAccessToken(issuer, token) {
+    try {
+        const jwks = await getJWKS(issuer);
+        const { payload } = await jwtVerify(token, jwks, { issuer });
+        return {
+            sub: payload.sub,
+            email: payload.email,
+            name: payload.name,
+            image: payload.image,
+        };
+    }
+    catch (err) {
+        console.error('verifyAccessToken error:', err);
+        return null;
+    }
+}
+export async function refreshTokens(issuer, refreshToken, clientId) {
+    try {
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        });
+        if (clientId)
+            params.set('client_id', clientId);
+        const response = await fetch(`${issuer}/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params.toString(),
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
+        const claims = decodeJwtPayload(data.access_token);
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            claims: {
+                sub: claims.sub,
+                email: claims.email,
+                name: claims.name,
+                image: claims.image,
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function decodeJwtPayload(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return {};
+    const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    return JSON.parse(atob(payload));
+}
+export function _resetJwksCache() {
+    jwksCache.clear();
+}
+//# sourceMappingURL=tokens.js.map

package/dist/utils/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/utils/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAKnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAA;AAEjD,KAAK,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,wBAAwB,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC9B,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAA;AACZ,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAc,EACd,KAAa;IAEb,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAC5D,OAAO;YACN,GAAG,EAAE,OAAO,CAAC,GAAa;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAe;YAC9B,IAAI,EAAE,OAAO,CAAC,IAA0B;YACxC,KAAK,EAAE,OAAO,CAAC,KAA2B;SAC1C,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAA;QAC9C,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,MAAc,EACd,YAAoB,EACpB,QAAiB;IAEjB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;SAC3B,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;QAE/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,QAAQ,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAA;QAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAA;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAElD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,MAAM,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,GAAa;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAe;gBAC7B,IAAI,EAAE,MAAM,CAAC,IAA0B;gBACvC,KAAK,EAAE,MAAM,CAAC,KAA2B;aACzC;SACD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,SAAS,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}

package/package.json

@@ -0,0 +1,59 @@
+{
+	"name": "@growth-labs/auth",
+	"version": "0.1.3",
+	"type": "module",
+	"exports": {
+		".": {
+			"types": "./dist/index.d.ts",
+			"import": "./dist/index.js"
+		},
+		"./utils": {
+			"types": "./dist/utils/index.d.ts",
+			"import": "./dist/utils/index.js"
+		},
+		"./middleware/*": {
+			"types": "./dist/middleware/*.d.ts",
+			"import": "./dist/middleware/*.js"
+		},
+		"./routes/*": {
+			"types": "./dist/routes/*.d.ts",
+			"import": "./dist/routes/*.js"
+		},
+		"./types": {
+			"types": "./dist/types.d.ts",
+			"import": "./dist/types.js"
+		}
+	},
+	"files": [
+		"dist",
+		"README.md"
+	],
+	"publishConfig": {
+		"access": "public",
+		"registry": "https://registry.npmjs.org/"
+	},
+	"scripts": {
+		"build": "tsc",
+		"test": "vitest run",
+		"test:watch": "vitest"
+	},
+	"peerDependencies": {
+		"astro": "^6.0.0",
+		"@growth-labs/analytics": "^0.1.0"
+	},
+	"peerDependenciesMeta": {
+		"@growth-labs/analytics": {
+			"optional": true
+		}
+	},
+	"dependencies": {
+		"zod": "^3.23.0",
+		"jose": "^6.0.0"
+	},
+	"devDependencies": {
+		"@growth-labs/analytics": "workspace:*",
+		"astro": "^6.0.0",
+		"typescript": "^5.8.0",
+		"vitest": "^3.0.0"
+	}
+}