@growth-labs/auth 0.5.3 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/config-store.d.ts.map +1 -1
- package/dist/config-store.js +41 -5
- package/dist/config-store.js.map +1 -1
- package/dist/middleware/auth.d.ts +1 -0
- package/dist/middleware/auth.d.ts.map +1 -1
- package/dist/middleware/auth.js +1 -0
- package/dist/middleware/auth.js.map +1 -1
- package/dist/options.d.ts +4 -4
- package/dist/options.d.ts.map +1 -1
- package/dist/options.js +21 -4
- package/dist/options.js.map +1 -1
- package/dist/runtime-bridge.d.ts +2 -0
- package/dist/runtime-bridge.d.ts.map +1 -0
- package/dist/runtime-bridge.js +11 -0
- package/dist/runtime-bridge.js.map +1 -0
- package/dist/utils/env-marker.d.ts +16 -0
- package/dist/utils/env-marker.d.ts.map +1 -0
- package/dist/utils/env-marker.js +33 -0
- package/dist/utils/env-marker.js.map +1 -0
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;
|
|
1
|
+
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAKvD,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE5D;AAED,wBAAgB,SAAS,IAAI,mBAAmB,CAa/C"}
|
package/dist/config-store.js
CHANGED
|
@@ -1,15 +1,51 @@
|
|
|
1
|
+
import { isEnvMarker, resolveEnvMarker } from './utils/env-marker.js';
|
|
1
2
|
let _config = null;
|
|
2
3
|
export function _setConfig(config) {
|
|
3
4
|
_config = config;
|
|
4
5
|
}
|
|
5
6
|
export function getConfig() {
|
|
6
7
|
const runtimeConfig = globalThis.__GL_AUTH_CONFIG__;
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
}
|
|
10
|
-
if (!_config) {
|
|
8
|
+
const base = runtimeConfig ?? _config;
|
|
9
|
+
if (!base) {
|
|
11
10
|
throw new Error('@growth-labs/auth: integration not configured. Add auth() to your astro.config.mjs integrations array.');
|
|
12
11
|
}
|
|
13
|
-
return
|
|
12
|
+
return resolveEnvMarkers(base);
|
|
13
|
+
}
|
|
14
|
+
/**
|
|
15
|
+
* Resolves any `"env:VAR_NAME"` markers on auth-tuple fields against the
|
|
16
|
+
* runtime env stashed by `src/runtime-bridge.ts`. The bridge is loaded
|
|
17
|
+
* via `middleware/auth.ts` at module-init time, so by the time any
|
|
18
|
+
* request reaches `getConfig()` the env is on globalThis. Plain string
|
|
19
|
+
* values pass through unchanged, preserving backwards compatibility.
|
|
20
|
+
*
|
|
21
|
+
* If callers exist that don't go through the auth middleware first AND
|
|
22
|
+
* the config has markers, we throw a clear error rather than silently
|
|
23
|
+
* dropping the lookup.
|
|
24
|
+
*/
|
|
25
|
+
function resolveEnvMarkers(base) {
|
|
26
|
+
const env = globalThis.__GL_AUTH_RUNTIME_ENV__;
|
|
27
|
+
if (env === undefined) {
|
|
28
|
+
if (anyMarkerPresent(base)) {
|
|
29
|
+
throw new Error('@growth-labs/auth: runtime env unavailable for "env:" marker resolution. Ensure the auth middleware ran first (it loads src/runtime-bridge.ts which stashes the env on globalThis).');
|
|
30
|
+
}
|
|
31
|
+
return base;
|
|
32
|
+
}
|
|
33
|
+
const issuer = resolveEnvMarker(base.issuer, env);
|
|
34
|
+
if (typeof issuer !== 'string') {
|
|
35
|
+
throw new Error('@growth-labs/auth: issuer must resolve to a string');
|
|
36
|
+
}
|
|
37
|
+
return {
|
|
38
|
+
...base,
|
|
39
|
+
issuer,
|
|
40
|
+
issuerInternal: resolveEnvMarker(base.issuerInternal, env),
|
|
41
|
+
clientId: resolveEnvMarker(base.clientId, env),
|
|
42
|
+
resource: resolveEnvMarker(base.resource, env),
|
|
43
|
+
};
|
|
44
|
+
}
|
|
45
|
+
function anyMarkerPresent(base) {
|
|
46
|
+
return (isEnvMarker(base.issuer) ||
|
|
47
|
+
isEnvMarker(base.issuerInternal) ||
|
|
48
|
+
isEnvMarker(base.clientId) ||
|
|
49
|
+
isEnvMarker(base.resource));
|
|
14
50
|
}
|
|
15
51
|
//# sourceMappingURL=config-store.js.map
|
package/dist/config-store.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../src/config-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAErE,IAAI,OAAO,GAA+B,IAAI,CAAA;AAE9C,MAAM,UAAU,UAAU,CAAC,MAA2B;IACrD,OAAO,GAAG,MAAM,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,SAAS;IACxB,MAAM,aAAa,GAClB,UAGA,CAAC,kBAAkB,CAAA;IACpB,MAAM,IAAI,GAAG,aAAa,IAAI,OAAO,CAAA;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,wGAAwG,CACxG,CAAA;IACF,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAA;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,iBAAiB,CAAC,IAAyB;IACnD,MAAM,GAAG,GACR,UAGA,CAAC,uBAAuB,CAAA;IACzB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACd,qLAAqL,CACrL,CAAA;QACF,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;IACtE,CAAC;IACD,OAAO;QACN,GAAG,IAAI;QACP,MAAM;QACN,cAAc,EAAE,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC;QAC1D,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;QAC9C,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;KAC9C,CAAA;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyB;IAClD,OAAO,CACN,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC1B,CAAA;AACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,sBAAsB,CAAA;AAO7B,wBAAsB,SAAS,CAC9B,OAAO,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACxE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC3B,OAAO,CAAC,QAAQ,CAAC,CAkEnB"}
|
package/dist/middleware/auth.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import { getConfig } from '../config-store.js';
|
|
2
|
+
import '../runtime-bridge.js';
|
|
2
3
|
import { resolveClientSecret } from '../utils/client-secret.js';
|
|
3
4
|
import { getCookie, setTokenCookies } from '../utils/cookies.js';
|
|
4
5
|
import { resolveInternalIssuer } from '../utils/issuer.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,sBAAsB,CAAA;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAErE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAwE,EACxE,IAA6B;IAE7B,MAAM,OAAO,GAAG,SAAS,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,8BAA8B;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IACpE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,YAAY,KAAK,CAAC,CAAA;IAErE,6BAA6B;IAC7B,IAAI,IAAI,GAAgB,IAAI,CAAA;IAC5B,IAAI,SAAS,GAA8C,IAAI,CAAA;IAE/D,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAC7D,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG;gBACN,EAAE,EAAE,QAAQ,CAAC,GAAG;gBAChB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI;aACjC,CAAA;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC9D,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/F,IAAI,SAAS,EAAE,CAAC;YACf,IAAI,GAAG;gBACN,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBACxB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK;gBAC7B,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;gBACnC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;aACzC,CAAA;QACF,CAAC;IACF,CAAC;IAED,kCAAkC;IAClC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;IAE1B,0BAA0B;IAC1B,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CACvB,GAAG,OAAO,CAAC,SAAS,aAAa,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAC3E,OAAO,CAAC,GAAG,CAAC,MAAM,CAClB,CAAA;QACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAA;IAE7B,+DAA+D;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,gBAAgB,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACpD,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACtC,CAAC,CAAA;QACF,eAAe,CAAC,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,YAAY,CAAC,CAAA;QACzF,OAAO,gBAAgB,CAAA;IACxB,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,UAAoB;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA,CAAC,6BAA6B;YACjE,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QACnC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAC,CAAA;AACH,CAAC"}
|
package/dist/options.d.ts
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import type { AuthRenderers } from './types.js';
|
|
3
3
|
export declare const authOptionsSchema: z.ZodObject<{
|
|
4
|
-
issuer: z.ZodString
|
|
5
|
-
issuerInternal: z.ZodOptional<z.ZodString
|
|
6
|
-
clientId: z.ZodOptional<z.ZodString
|
|
4
|
+
issuer: z.ZodEffects<z.ZodString, string, string>;
|
|
5
|
+
issuerInternal: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
|
|
6
|
+
clientId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
|
|
7
7
|
clientSecret: z.ZodOptional<z.ZodString>;
|
|
8
|
-
resource: z.ZodOptional<z.ZodString
|
|
8
|
+
resource: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
|
|
9
9
|
cookiePrefix: z.ZodString;
|
|
10
10
|
sessionCookieDomain: z.ZodOptional<z.ZodString>;
|
|
11
11
|
accessTokenMaxAge: z.ZodDefault<z.ZodNumber>;
|
package/dist/options.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;
|
|
1
|
+
{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAqB/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiD5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAA"}
|
package/dist/options.js
CHANGED
|
@@ -1,12 +1,29 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
+
// String accepted as either a literal URL or an "env:VAR_NAME" marker that
|
|
3
|
+
// gets resolved against the Worker runtime env at request time. See
|
|
4
|
+
// `src/utils/env-marker.ts` and `src/config-store.ts`. Bare "env:" (no
|
|
5
|
+
// binding name) is rejected — it can never resolve to anything useful.
|
|
6
|
+
const urlOrEnvMarker = z
|
|
7
|
+
.string()
|
|
8
|
+
.refine((v) => (v.startsWith('env:') && v.length > 4) || /^https?:\/\//i.test(v), {
|
|
9
|
+
message: 'Must be a URL (https?://...) or an "env:VAR_NAME" marker',
|
|
10
|
+
});
|
|
11
|
+
// String that, if shaped as an "env:VAR_NAME" marker, must include a
|
|
12
|
+
// non-empty binding name. Literal values pass through unconstrained
|
|
13
|
+
// (they can be any string, e.g. OAuth client IDs). A literal value that
|
|
14
|
+
// happens to start with the reserved "env:" prefix will be treated as a
|
|
15
|
+
// marker — pick a non-colliding name in that edge case.
|
|
16
|
+
const stringOrEnvMarker = z.string().refine((v) => !v.startsWith('env:') || v.length > 4, {
|
|
17
|
+
message: '"env:" marker must include a binding name (e.g. "env:AUTH_CLIENT_ID")',
|
|
18
|
+
});
|
|
2
19
|
export const authOptionsSchema = z.object({
|
|
3
20
|
// ─── Issuer URLs ───
|
|
4
|
-
issuer:
|
|
5
|
-
issuerInternal:
|
|
21
|
+
issuer: urlOrEnvMarker,
|
|
22
|
+
issuerInternal: urlOrEnvMarker.optional(),
|
|
6
23
|
// ─── Client identity ───
|
|
7
|
-
clientId:
|
|
24
|
+
clientId: stringOrEnvMarker.optional(),
|
|
8
25
|
clientSecret: z.string().optional(),
|
|
9
|
-
resource:
|
|
26
|
+
resource: urlOrEnvMarker.optional(),
|
|
10
27
|
// ─── Cookie configuration ───
|
|
11
28
|
cookiePrefix: z.string(),
|
|
12
29
|
sessionCookieDomain: z.string().optional(),
|
package/dist/options.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,
|
|
1
|
+
{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,2EAA2E;AAC3E,oEAAoE;AACpE,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IACjF,OAAO,EAAE,0DAA0D;CACnE,CAAC,CAAA;AAEH,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,wEAAwE;AACxE,wDAAwD;AACxD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;IACzF,OAAO,EAAE,uEAAuE;CAChF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,sBAAsB;IACtB,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;IAEzC,0BAA0B;IAC1B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IAEnC,+BAA+B;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE/C,6BAA6B;IAC7B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC1D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACnE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAChF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAEhF,oBAAoB;IACpB,SAAS,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;SACnD,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IAE/C,mCAAmC;IACnC,SAAS,EAAE,CAAC;SACV,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IAEb,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;CAChD,CAAC,CAAA"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"runtime-bridge.d.ts","sourceRoot":"","sources":["../src/runtime-bridge.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
// Side-effect module: stashes the Cloudflare Worker runtime env onto
|
|
2
|
+
// `globalThis.__GL_AUTH_RUNTIME_ENV__` so that `src/config-store.ts` can
|
|
3
|
+
// read env values without statically importing `cloudflare:workers`.
|
|
4
|
+
//
|
|
5
|
+
// Loaded by `src/middleware/auth.ts` only. The package main entry
|
|
6
|
+
// (`dist/index.js`) does NOT statically import this file, which keeps the
|
|
7
|
+
// pure-Node import gate green — `cloudflare:workers` only enters the
|
|
8
|
+
// graph through middleware/routes that already needed it.
|
|
9
|
+
import { getRuntimeEnv } from './runtime.js';
|
|
10
|
+
globalThis.__GL_AUTH_RUNTIME_ENV__ = getRuntimeEnv();
|
|
11
|
+
//# sourceMappingURL=runtime-bridge.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"runtime-bridge.js","sourceRoot":"","sources":["../src/runtime-bridge.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,qEAAqE;AACrE,0DAA0D;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAE3C;AACA,UAGA,CAAC,uBAAuB,GAAG,aAAa,EAAE,CAAA"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Pure resolver: takes an `"env:VAR_NAME"` marker and an env bag, returns
|
|
3
|
+
* the bound value or throws when the binding is missing / empty. Plain
|
|
4
|
+
* strings pass through unchanged. Kept pure (no `cloudflare:workers`
|
|
5
|
+
* import) so `src/config-store.ts` — and therefore the package main entry
|
|
6
|
+
* — stays clear of the runtime-only specifier and the pure-Node import
|
|
7
|
+
* gate stays green.
|
|
8
|
+
*
|
|
9
|
+
* The runtime env is supplied at call sites (middleware/routes) which can
|
|
10
|
+
* pull from `cloudflare:workers` themselves, OR by `src/runtime-bridge.ts`
|
|
11
|
+
* which stashes it onto `globalThis.__GL_AUTH_RUNTIME_ENV__` for
|
|
12
|
+
* `getConfig()` to read implicitly.
|
|
13
|
+
*/
|
|
14
|
+
export declare function resolveEnvMarker(value: string | undefined, env: Record<string, unknown>): string | undefined;
|
|
15
|
+
export declare function isEnvMarker(value: unknown): boolean;
|
|
16
|
+
//# sourceMappingURL=env-marker.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"env-marker.d.ts","sourceRoot":"","sources":["../../src/utils/env-marker.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1B,MAAM,GAAG,SAAS,CAgBpB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEnD"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
const ENV_MARKER_PREFIX = 'env:';
|
|
2
|
+
/**
|
|
3
|
+
* Pure resolver: takes an `"env:VAR_NAME"` marker and an env bag, returns
|
|
4
|
+
* the bound value or throws when the binding is missing / empty. Plain
|
|
5
|
+
* strings pass through unchanged. Kept pure (no `cloudflare:workers`
|
|
6
|
+
* import) so `src/config-store.ts` — and therefore the package main entry
|
|
7
|
+
* — stays clear of the runtime-only specifier and the pure-Node import
|
|
8
|
+
* gate stays green.
|
|
9
|
+
*
|
|
10
|
+
* The runtime env is supplied at call sites (middleware/routes) which can
|
|
11
|
+
* pull from `cloudflare:workers` themselves, OR by `src/runtime-bridge.ts`
|
|
12
|
+
* which stashes it onto `globalThis.__GL_AUTH_RUNTIME_ENV__` for
|
|
13
|
+
* `getConfig()` to read implicitly.
|
|
14
|
+
*/
|
|
15
|
+
export function resolveEnvMarker(value, env) {
|
|
16
|
+
if (typeof value !== 'string')
|
|
17
|
+
return value;
|
|
18
|
+
if (!value.startsWith(ENV_MARKER_PREFIX))
|
|
19
|
+
return value;
|
|
20
|
+
const name = value.slice(ENV_MARKER_PREFIX.length);
|
|
21
|
+
if (!name) {
|
|
22
|
+
throw new Error('@growth-labs/auth: "env:" marker missing binding name (expected "env:VAR_NAME")');
|
|
23
|
+
}
|
|
24
|
+
const resolved = env[name];
|
|
25
|
+
if (typeof resolved !== 'string' || resolved.length === 0) {
|
|
26
|
+
throw new Error(`@growth-labs/auth: env:${name} is not set in the Worker runtime env (declared as "env:${name}" in auth() options)`);
|
|
27
|
+
}
|
|
28
|
+
return resolved;
|
|
29
|
+
}
|
|
30
|
+
export function isEnvMarker(value) {
|
|
31
|
+
return typeof value === 'string' && value.startsWith(ENV_MARKER_PREFIX);
|
|
32
|
+
}
|
|
33
|
+
//# sourceMappingURL=env-marker.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"env-marker.js","sourceRoot":"","sources":["../../src/utils/env-marker.ts"],"names":[],"mappings":"AAAA,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEhC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAyB,EACzB,GAA4B;IAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAA;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,iFAAiF,CACjF,CAAA;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACd,0BAA0B,IAAI,2DAA2D,IAAI,sBAAsB,CACnH,CAAA;IACF,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;AACxE,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@growth-labs/auth",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"types": "./dist/index.d.ts",
|
|
6
6
|
"exports": {
|
|
@@ -57,7 +57,7 @@
|
|
|
57
57
|
"typescript": "^5.8.0",
|
|
58
58
|
"vite": "^7.3.2",
|
|
59
59
|
"vitest": "^3.0.0",
|
|
60
|
-
"@growth-labs/analytics": "0.
|
|
60
|
+
"@growth-labs/analytics": "0.3.1"
|
|
61
61
|
},
|
|
62
62
|
"scripts": {
|
|
63
63
|
"build": "tsc",
|