@growth-labs/auth 0.7.0 → 0.7.2

package/src/utils/tokens.ts

@@ -0,0 +1,128 @@
+import { createLocalJWKSet, jwtVerify } from 'jose'
+import type { TokenRefreshResult } from '../types.js'
+import { createClientSecretBasicAuthHeader } from './client-secret.js'
+
+type JWKSFunction = ReturnType<typeof createLocalJWKSet>
+
+const jwksCache = new Map<string, JWKSFunction>()
+
+async function getJWKS(issuer: string): Promise<JWKSFunction> {
+	let jwks = jwksCache.get(issuer)
+	if (jwks) return jwks
+
+	const response = await fetch(`${issuer}/.well-known/jwks.json`)
+	if (!response.ok) throw new Error(`JWKS fetch failed: ${response.status}`)
+	const data = (await response.json()) as { keys: JsonWebKey[] }
+	jwks = createLocalJWKSet(data)
+	jwksCache.set(issuer, jwks)
+	return jwks
+}
+
+export interface VerifiedClaims {
+	sub: string
+	email: string
+	name?: string | null
+	image?: string
+}
+
+export interface TokenPayloadClaims extends VerifiedClaims {
+	isNewUser: boolean
+}
+
+export function extractTokenClaims(payload: Record<string, unknown>): TokenPayloadClaims {
+	const properties = (payload.properties ?? {}) as Record<string, unknown>
+	const topLevelIsNewUser = payload.isNewUser
+
+	return {
+		sub: payload.sub as string,
+		email: (properties.email ?? payload.email) as string,
+		name: (properties.name ?? payload.name) as string | undefined,
+		image: (properties.image ?? payload.image) as string | undefined,
+		isNewUser: Boolean(properties.isNewUser ?? topLevelIsNewUser),
+	}
+}
+
+export async function verifyAccessToken(
+	issuer: string,
+	token: string,
+): Promise<VerifiedClaims | null> {
+	try {
+		const jwks = await getJWKS(issuer)
+		const { payload } = await jwtVerify(token, jwks, { issuer })
+		const claims = extractTokenClaims(payload as Record<string, unknown>)
+		return {
+			sub: claims.sub,
+			email: claims.email,
+			name: claims.name,
+			image: claims.image,
+		}
+	} catch (err) {
+		console.error('verifyAccessToken error:', err)
+		return null
+	}
+}
+
+export async function refreshTokens(
+	issuer: string,
+	refreshToken: string,
+	clientId?: string,
+	clientSecret?: string,
+	resource?: string,
+): Promise<TokenRefreshResult | null> {
+	try {
+		const params = new URLSearchParams({
+			grant_type: 'refresh_token',
+			refresh_token: refreshToken,
+		})
+		if (clientId) params.set('client_id', clientId)
+		if (resource) params.set('resource', resource)
+
+		const headers: Record<string, string> = {
+			'Content-Type': 'application/x-www-form-urlencoded',
+		}
+		if (clientId && clientSecret) {
+			headers.Authorization = createClientSecretBasicAuthHeader(clientId, clientSecret)
+		}
+
+		const response = await fetch(`${issuer}/token`, {
+			method: 'POST',
+			headers,
+			body: params.toString(),
+		})
+
+		if (!response.ok) return null
+
+		const data = (await response.json()) as {
+			access_token: string
+			refresh_token: string
+		}
+
+		const claims = extractTokenClaims(decodeJwtPayload(data.access_token))
+
+		return {
+			accessToken: data.access_token,
+			refreshToken: data.refresh_token,
+			claims: {
+				sub: claims.sub,
+				email: claims.email,
+				name: claims.name,
+				image: claims.image,
+			},
+		}
+	} catch {
+		return null
+	}
+}
+
+export function decodeJwtPayload(jwt: string): Record<string, unknown> {
+	const parts = jwt.split('.')
+	if (parts.length !== 3) return {}
+	const payload = parts[1].replace(/-/g, '+').replace(/_/g, '/')
+	const padded = payload.padEnd(payload.length + ((4 - (payload.length % 4)) % 4), '=')
+	return JSON.parse(atob(padded))
+}
+
+/** @internal Test-only helper. Not exported from @growth-labs/auth/utils. */
+export function _resetJwksCache(): void {
+	jwksCache.clear()
+}

package/src/virtual.d.ts

@@ -0,0 +1,5 @@
+declare module 'virtual:growth-labs/auth/renderers' {
+	import type { ResolvedAuthRenderers } from './types.js'
+
+	export const renderers: ResolvedAuthRenderers
+}