@holo-js/auth-clerk 0.1.9 → 0.2.0

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AuthResult, AuthLogoutResult, AuthFieldErrors, AuthenticatedAuthUser, AuthEstablishedSession, authRuntimeInternals } from '@holo-js/auth';
+import { AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, authRuntimeInternals } from '@holo-js/auth';
 import { AuthClerkProviderConfig, NormalizedAuthClerkProviderConfig } from '@holo-js/config';
 
 interface ClerkEmailAddress {
@@ -150,7 +150,7 @@ interface ClerkAuthFacade {
     logoutWithClerk(request: ClerkRequestInput, options?: {
         readonly provider?: string;
         readonly returnTo?: string;
-    }): Promise<ClerkLogoutResult>;
+    }): Promise<Response>;
     completeClerkAuth<TUserAttributes extends ClerkUserAttributes = ClerkDefaultUserAttributes$1>(request: ClerkRequestInput, options?: {
         readonly provider?: string;
         readonly user?: (clerkUser: ClerkUserProfile) => TUserAttributes;
@@ -218,7 +218,7 @@ declare function registerWithClerk(_input: ClerkRequestInput, options?: {
 declare function logoutWithClerk(input: ClerkRequestInput, options?: {
     readonly provider?: string;
     readonly returnTo?: string;
-}): Promise<ClerkLogoutResult>;
+}): Promise<Response>;
 declare function completeClerkAuth<TUserAttributes extends ClerkUserAttributes = ClerkDefaultUserAttributes>(input: ClerkRequestInput, options?: CompleteClerkAuthOptions<TUserAttributes>): Promise<ClerkCompleteAuthResult<TUserAttributes>>;
 declare function configureClerkAuthRuntime(bindings?: ConfigureClerkAuthRuntimeOptions): void;
 declare function resetClerkAuthRuntime(): void;
@@ -245,4 +245,4 @@ declare const clerkAuthInternals: {
     resolvePrimaryEmail: typeof resolvePrimaryEmail;
 };
 
-export { type ClerkAuthBindings, ClerkAuthConflictError, type ClerkAuthFacade, type ClerkAuthenticatedUser, type ClerkAuthenticationResult, type ClerkCompleteAuthData, type ClerkCompleteAuthResult, type ClerkEmailAddress, type ClerkHostedAuthFailureFields, type ClerkLogoutData, type ClerkLogoutErrorCode, type ClerkLogoutResult, type ClerkLogoutSession, type ClerkProviderRuntime, type ClerkRequestHeaders, type ClerkRequestInput, type ClerkRequestLike, type ClerkSyncStatus, type ClerkUserAttributeValue, type ClerkUserAttributes, type ClerkUserProfile, type ClerkVerifiedSession, type ClerkVerifyRequestContext, type ClerkVerifySessionContext, type ConfigureClerkAuthRuntimeOptions, type HostedIdentityRecord, type HostedIdentityStore, authenticate, clerkAuth, clerkAuthInternals, completeClerkAuth, configureClerkAuthRuntime, loginWithClerk, logoutWithClerk, registerWithClerk, resetClerkAuthRuntime, syncIdentity, verifyRequest, verifySession };
+export { type ClerkAuthBindings, ClerkAuthConflictError, type ClerkAuthFacade, type ClerkAuthenticatedUser, type ClerkAuthenticationResult, type ClerkCompleteAuthData, type ClerkCompleteAuthResult, type ClerkEmailAddress, type ClerkHostedAuthFailureFields, type ClerkLogoutData, type ClerkLogoutErrorCode, type ClerkLogoutResult, type ClerkLogoutSession, type ClerkProviderRuntime, type ClerkRequestInput, type ClerkRequestLike, type ClerkSyncStatus, type ClerkUserAttributeValue, type ClerkUserAttributes, type ClerkUserProfile, type ClerkVerifiedSession, type ClerkVerifyRequestContext, type ClerkVerifySessionContext, type ConfigureClerkAuthRuntimeOptions, type HostedIdentityRecord, type HostedIdentityStore, authenticate, clerkAuth, clerkAuthInternals, completeClerkAuth, configureClerkAuthRuntime, loginWithClerk, logoutWithClerk, registerWithClerk, resetClerkAuthRuntime, syncIdentity, verifyRequest, verifySession };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/index.ts
-import { authRuntimeInternals, getAuthRuntime } from "@holo-js/auth";
+import { authRuntimeInternals as authRuntimeInternals3, getAuthRuntime } from "@holo-js/auth";
 import { parseCookieHeader } from "@holo-js/session";
 
 // src/contracts.ts
@@ -18,41 +18,19 @@ var ClerkAuthConflictError = class extends Error {
 };
 
 // src/jwt.ts
-import { createPublicKey, verify as verifySignature } from "crypto";
+import { authRuntimeInternals } from "@holo-js/auth";
 var CLERK_API_BASE_URL = "https://api.clerk.com";
 var clerkJwksCache = /* @__PURE__ */ new Map();
-function decodeJwtSegment(value, label) {
-  try {
-    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-  } catch {
-    throw new Error(`[@holo-js/auth-clerk] Clerk token ${label} was not valid JSON.`);
-  }
-}
 function parseJwt(token) {
-  const segments = token.split(".");
-  if (segments.length !== 3 || !segments[0] || !segments[1] || !segments[2]) {
-    throw new Error("[@holo-js/auth-clerk] Clerk token was not a valid JWT.");
-  }
-  return {
-    header: decodeJwtSegment(segments[0], "header"),
-    payload: decodeJwtSegment(segments[1], "payload"),
-    signature: Buffer.from(segments[2], "base64url"),
-    signingInput: Buffer.from(`${segments[0]}.${segments[1]}`, "utf8")
-  };
+  return authRuntimeInternals.jwt.parseJwt(token, {
+    errorPrefix: "[@holo-js/auth-clerk] Clerk token",
+    malformedMessage: "[@holo-js/auth-clerk] Clerk token was not a valid JWT."
+  });
 }
 function verifyJwtSignatureWithJwk(token, jwk) {
-  const algorithm = typeof token.header.alg === "string" ? token.header.alg : "";
-  const key = createPublicKey({ key: jwk, format: "jwk" });
-  switch (algorithm) {
-    case "RS256":
-      return verifySignature("RSA-SHA256", token.signingInput, key, token.signature);
-    case "RS384":
-      return verifySignature("RSA-SHA384", token.signingInput, key, token.signature);
-    case "RS512":
-      return verifySignature("RSA-SHA512", token.signingInput, key, token.signature);
-    default:
-      throw new Error(`[@holo-js/auth-clerk] Unsupported Clerk JWT algorithm "${algorithm || "unknown"}".`);
-  }
+  return authRuntimeInternals.jwt.verifyJwtSignatureWithJwk(token, jwk, {
+    unsupportedAlgorithmMessage: (algorithm) => `[@holo-js/auth-clerk] Unsupported Clerk JWT algorithm "${algorithm}".`
+  });
 }
 function resolveClerkJwksUrl(config) {
   const frontendApi = config.frontendApi?.trim();
@@ -63,32 +41,18 @@ function resolveClerkJwksUrl(config) {
   return `${apiUrl.replace(/\/$/, "")}/v1/jwks`;
 }
 async function fetchClerkJwks(jwksUrl, options = {}) {
-  if (options.refresh) {
-    clerkJwksCache.delete(jwksUrl);
-  }
-  const existing = clerkJwksCache.get(jwksUrl);
-  if (existing) {
-    return existing;
-  }
-  const pending = (async () => {
-    const response = await fetch(jwksUrl, {
-      headers: {
-        accept: "application/json"
-      }
-    });
-    if (!response.ok) {
-      throw new Error(`[@holo-js/auth-clerk] Failed to load Clerk JWKS from "${jwksUrl}".`);
-    }
-    const payload = await response.json();
-    return payload.keys ?? [];
-  })();
-  clerkJwksCache.set(jwksUrl, pending);
-  try {
-    return await pending;
-  } catch (error) {
-    clerkJwksCache.delete(jwksUrl);
-    throw error;
-  }
+  return authRuntimeInternals.jwt.fetchCachedJwks(jwksUrl, {
+    cache: clerkJwksCache,
+    requestUrl: jwksUrl,
+    refresh: options.refresh,
+    errorMessage: `[@holo-js/auth-clerk] Failed to load Clerk JWKS from "${jwksUrl}".`
+  });
+}
+
+// src/request.ts
+import { authRuntimeInternals as authRuntimeInternals2 } from "@holo-js/auth";
+function normalizeClerkRequest(input) {
+  return authRuntimeInternals2.normalizeRequestInput(input);
 }
 
 // src/index.ts
@@ -112,99 +76,6 @@ function getRuntimeState() {
 function throwUnconfigured() {
   throw new Error("[@holo-js/auth-clerk] Clerk auth runtime is not configured yet.");
 }
-function isPlainHeaderRecord(value) {
-  return Boolean(value) && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
-}
-function appendKnownHeaders(headers, input) {
-  for (const name of ["authorization", "cookie", "host", "x-forwarded-host", "x-forwarded-proto"]) {
-    const value = input.get?.(name);
-    if (typeof value === "string" && value) {
-      headers.set(name, value);
-    }
-  }
-}
-function hasHeaderForEach(input) {
-  return !Array.isArray(input) && "forEach" in input && typeof input.forEach === "function";
-}
-function hasHeaderEntries(input) {
-  return !Array.isArray(input) && "entries" in input && typeof input.entries === "function";
-}
-function hasHeaderGet(input) {
-  return !Array.isArray(input) && "get" in input && typeof input.get === "function";
-}
-function normalizeRequestHeaders(input) {
-  const headers = new Headers();
-  if (!input) {
-    return headers;
-  }
-  if (input instanceof Headers || Array.isArray(input)) {
-    new Headers(input).forEach((value, name) => headers.append(name, value));
-    return headers;
-  }
-  if (hasHeaderForEach(input)) {
-    input.forEach((value, name) => headers.append(name, value));
-    return headers;
-  }
-  if (hasHeaderEntries(input)) {
-    for (const [name, value] of input.entries()) {
-      headers.append(name, value);
-    }
-    return headers;
-  }
-  if (hasHeaderGet(input)) {
-    appendKnownHeaders(headers, input);
-    return headers;
-  }
-  if (isPlainHeaderRecord(input)) {
-    for (const [name, value] of Object.entries(input)) {
-      if (typeof value === "string") {
-        headers.append(name, value);
-        continue;
-      }
-      if (Array.isArray(value)) {
-        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
-        const joined = value.filter((entry) => typeof entry === "string").join(separator);
-        if (joined) {
-          headers.append(name, joined);
-        }
-      }
-    }
-  }
-  return headers;
-}
-function getRequestFromLikeInput(input) {
-  return input.request ?? input.web?.request ?? (input.req instanceof Request ? input.req : void 0);
-}
-function getRequestLikeHeaders(input) {
-  return input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers;
-}
-function getRequestLikeMethod(input) {
-  return input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
-}
-function getRequestLikeUrl(input, headers) {
-  const url = (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
-  try {
-    return new URL(url).toString();
-  } catch {
-    const protocol = headers.get("x-forwarded-proto") ?? "http";
-    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
-    return new URL(url, `${protocol}://${host}`).toString();
-  }
-}
-function normalizeClerkRequest(input) {
-  if (input instanceof Request) {
-    return input;
-  }
-  const request = getRequestFromLikeInput(input);
-  if (request) {
-    return request;
-  }
-  const headers = normalizeRequestHeaders(getRequestLikeHeaders(input));
-  return new Request(getRequestLikeUrl(input, headers), {
-    method: getRequestLikeMethod(input),
-    headers
-  });
-}
 function getBindings() {
   const clerkBindings = getRuntimeState().bindings;
   if (!clerkBindings?.identityStore) {
@@ -340,7 +211,7 @@ function createDefaultProviderRuntime(providerName, config) {
   return runtime;
 }
 function resolveConfiguredProviderName(provider) {
-  const bindings = authRuntimeInternals.getRuntimeBindings();
+  const bindings = authRuntimeInternals3.getRuntimeBindings();
   if (provider?.trim()) {
     return provider.trim();
   }
@@ -365,7 +236,7 @@ function isNormalizedClerkProviderConfig(value) {
 }
 function getConfiguredProviderConfig(provider) {
   const providerName = resolveConfiguredProviderName(provider);
-  const authBindings = authRuntimeInternals.getRuntimeBindings();
+  const authBindings = authRuntimeInternals3.getRuntimeBindings();
   const configured = authBindings.config.clerk[providerName];
   if (!isNormalizedClerkProviderConfig(configured)) {
     throw new Error(`[@holo-js/auth-clerk] Clerk provider "${providerName}" is not configured in auth.clerk.`);
@@ -455,7 +326,7 @@ function createClerkErrorResponse(error, code) {
   });
 }
 function resolveGuardAndProvider(provider) {
-  const authBindings = authRuntimeInternals.getRuntimeBindings();
+  const authBindings = authRuntimeInternals3.getRuntimeBindings();
   const providerConfig = getConfiguredProviderConfig(provider);
   const guardName = providerConfig.guard ?? authBindings.config.defaults.guard;
   const guard = authBindings.config.guards[guardName];
@@ -681,7 +552,7 @@ async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile,
   }
 }
 function isEmailVerificationRequired() {
-  return authRuntimeInternals.getRuntimeBindings().config.emailVerification.required === true;
+  return authRuntimeInternals3.getRuntimeBindings().config.emailVerification.required === true;
 }
 function createIdentityRecord(input) {
   const now = /* @__PURE__ */ new Date();
@@ -790,7 +661,7 @@ function getSetCookieHeaders(headers) {
   return combined ? splitSetCookieHeader(combined) : [];
 }
 async function appendClerkResponseCookies(headers) {
-  const append = authRuntimeInternals.getRuntimeBindings().context.appendResponseCookie;
+  const append = authRuntimeInternals3.getRuntimeBindings().context.appendResponseCookie;
   if (!append) {
     return;
   }
@@ -799,7 +670,7 @@ async function appendClerkResponseCookies(headers) {
   }
 }
 function getHoloSessionIdFromRequest(request) {
-  const cookieHeader = authRuntimeInternals.getRuntimeBindings().session.sessionCookie("");
+  const cookieHeader = authRuntimeInternals3.getRuntimeBindings().session.sessionCookie("");
   const separator = cookieHeader.indexOf("=");
   const cookieName = separator > 0 ? decodeURIComponent(cookieHeader.slice(0, separator)) : "";
   if (!cookieName) {
@@ -809,14 +680,14 @@ function getHoloSessionIdFromRequest(request) {
   return cookies[cookieName] ?? null;
 }
 async function reuseExistingHoloSession(request, authenticated) {
-  const bindings = authRuntimeInternals.getRuntimeBindings();
+  const bindings = authRuntimeInternals3.getRuntimeBindings();
   const sessionId = getHoloSessionIdFromRequest(request);
   if (!sessionId) {
     return null;
   }
   bindings.context.setSessionId(authenticated.guard, sessionId);
   const record = await bindings.session.read(sessionId);
-  const payload = authRuntimeInternals.readSessionPayload(record, authenticated.guard);
+  const payload = authRuntimeInternals3.readSessionPayload(record, authenticated.guard);
   if (!payload || payload.guard !== authenticated.guard || payload.provider !== authenticated.authProvider || String(payload.userId) !== String(authenticated.user.id)) {
     return null;
   }
@@ -893,8 +764,8 @@ async function verifyRequestWithClerkBackendSdk(request, providerConfig) {
   if (requestState.status === "handshake") {
     const redirectUrl = requestState.headers.get("location");
     if (redirectUrl && !hasClerkHandshakeAttempt(request)) {
-      await authRuntimeInternals.redirectResponse(
-        authRuntimeInternals.getRuntimeBindings(),
+      await authRuntimeInternals3.redirectResponse(
+        authRuntimeInternals3.getRuntimeBindings(),
         new URL(redirectUrl, request.url).toString(),
         307
       );
@@ -1083,7 +954,7 @@ async function authenticate(input, provider) {
     return null;
   }
   const authenticated = await syncIdentity(session, provider);
-  const authSession = await reuseExistingHoloSession(request, authenticated) ?? await authRuntimeInternals.establishSessionForUser(authenticated.user, {
+  const authSession = await reuseExistingHoloSession(request, authenticated) ?? await authRuntimeInternals3.establishSessionForUser(authenticated.user, {
     guard: authenticated.guard,
     provider: authenticated.authProvider,
     payload: createClerkSessionPayload(authenticated, session)
@@ -1132,13 +1003,13 @@ async function registerWithClerk(_input, options = {}) {
   }
 }
 async function readCurrentClerkLogoutSession(guard, providerName) {
-  const bindings = authRuntimeInternals.getRuntimeBindings();
+  const bindings = authRuntimeInternals3.getRuntimeBindings();
   const sessionId = bindings.context.getSessionId(guard);
   if (!sessionId) {
     return null;
   }
   const record = await bindings.session.read(sessionId);
-  return getClerkLogoutSession(authRuntimeInternals.readSessionPayload(record, guard), providerName);
+  return getClerkLogoutSession(authRuntimeInternals3.readSessionPayload(record, guard), providerName);
 }
 async function revokeClerkSession(config, sessionId) {
   const secretKey = config.secretKey?.trim();
@@ -1165,24 +1036,28 @@ async function logoutWithClerk(input, options = {}) {
     const { guard } = resolveGuardAndProvider(providerName);
     const requestSessionId = getHoloSessionIdFromRequest(request);
     if (requestSessionId) {
-      authRuntimeInternals.getRuntimeBindings().context.setSessionId(guard, requestSessionId);
+      authRuntimeInternals3.getRuntimeBindings().context.setSessionId(guard, requestSessionId);
     }
     const clerkSession = await readCurrentClerkLogoutSession(guard, providerName);
     if (!clerkSession) {
-      return createHostedAuthFailure(
-        "clerk_session_missing",
-        "The current Holo session was not created by Clerk.",
-        422
-      );
+      return Response.redirect(new URL("/", request.url), 303);
     }
     await revokeClerkSession(providerConfig, clerkSession.sessionId);
     const local = await getAuthRuntime().guard(guard).logout();
-    return createHostedAuthSuccess(Object.freeze({
-      url: createClerkReturnUrl(request, options.returnTo),
-      local
-    }));
+    const response = new Response(null, {
+      status: 303,
+      headers: {
+        Location: createClerkReturnUrl(request, options.returnTo)
+      }
+    });
+    for (const cookie of local.cookies) {
+      response.headers.append("Set-Cookie", cookie);
+    }
+    return response;
   } catch {
-    return createHostedAuthFailure("clerk_logout_failed", "Unable to complete Clerk logout.", 500);
+    return Response.json(createHostedAuthFailure("clerk_logout_failed", "Unable to complete Clerk logout.", 500), {
+      status: 500
+    });
   }
 }
 async function completeClerkAuth(input, options = {}) {
@@ -1209,7 +1084,7 @@ async function completeClerkAuth(input, options = {}) {
     const authenticated = await syncIdentity(session, providerConfig.name, {
       user: options.user
     });
-    const authSession = await authRuntimeInternals.establishSessionForUser(authenticated.user, {
+    const authSession = await authRuntimeInternals3.establishSessionForUser(authenticated.user, {
       guard: authenticated.guard,
       provider: authenticated.authProvider,
       payload: createClerkSessionPayload(authenticated, session)
@@ -1225,7 +1100,7 @@ async function completeClerkAuth(input, options = {}) {
       authSession
     }));
   } catch (error) {
-    if (authRuntimeInternals.isResponseInterrupt(error)) {
+    if (authRuntimeInternals3.isResponseInterrupt(error)) {
       throw error;
     }
     return createHostedAuthFailure(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-clerk",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "Holo-JS Framework - Clerk auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -24,9 +24,9 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.4.7",
-    "@holo-js/auth": "^0.1.9",
-    "@holo-js/config": "^0.1.9",
-    "@holo-js/session": "^0.1.9"
+    "@holo-js/auth": "^0.2.0",
+    "@holo-js/config": "^0.2.0",
+    "@holo-js/session": "^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",