@holo-js/auth-workos 0.1.9 → 0.2.1

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AuthResult, AuthLogoutResult, AuthFieldErrors, AuthenticatedAuthUser, AuthEstablishedSession, authRuntimeInternals } from '@holo-js/auth';
+import { AuthResult, AuthenticatedAuthUser, AuthEstablishedSession, AuthFieldErrors, AuthLogoutResult, authRuntimeInternals } from '@holo-js/auth';
 import { NormalizedAuthWorkosProviderConfig } from '@holo-js/config';
 
 type WorkosJsonValue = string | number | boolean | null | readonly WorkosJsonValue[] | {
@@ -99,16 +99,7 @@ interface HostedIdentityStore {
     save(record: HostedIdentityRecord): Promise<void>;
 }
 type WorkosSyncStatus = 'created' | 'updated' | 'linked' | 'relinked';
-interface WorkosAuthenticationResult<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> {
-    readonly provider: string;
-    readonly guard: string;
-    readonly authProvider: string;
-    readonly status: WorkosSyncStatus;
-    readonly user: WorkosAuthenticatedUser<TUserAttributes>;
-    readonly identity: HostedIdentityRecord;
-    readonly session: WorkosVerifiedSession;
-    readonly authSession?: AuthEstablishedSession;
-}
+type WorkosAuthenticationResult<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes> = WorkosCompleteAuthData<TUserAttributes>;
 interface WorkosAuthBindings {
     readonly providers: Readonly<Record<string, WorkosProviderRuntime>>;
     readonly identityStore: HostedIdentityStore;
@@ -127,7 +118,7 @@ interface WorkosAuthFacade {
     logoutWithWorkos(request: Request, options?: {
         readonly provider?: string;
         readonly returnTo?: string;
-    }): Promise<WorkosLogoutResult>;
+    }): Promise<Response>;
     completeWorkosAuth<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(request: Request, options?: WorkosCompleteAuthOptions<TUserAttributes>): Promise<WorkosCompleteAuthResult<TUserAttributes>>;
     verifyRequest(request: Request, provider?: string): Promise<WorkosVerifiedSession | null>;
     verifySession(token: string, provider?: string): Promise<WorkosVerifiedSession | null>;
@@ -203,7 +194,7 @@ declare function registerWithWorkos(input: WorkosRequestInput, options?: {
 declare function logoutWithWorkos(input: WorkosRequestInput, options?: {
     readonly provider?: string;
     readonly returnTo?: string;
-}): Promise<WorkosLogoutResult>;
+}): Promise<Response>;
 declare function completeWorkosAuth<TUserAttributes extends WorkosUserAttributes = WorkosDefaultUserAttributes>(input: WorkosRequestInput, options?: WorkosCompleteAuthOptions<TUserAttributes>): Promise<WorkosCompleteAuthResult<TUserAttributes>>;
 declare function configureWorkosAuthRuntime(bindings?: ConfigureWorkosAuthRuntimeOptions): void;
 declare function resetWorkosAuthRuntime(): void;

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/index.ts
-import { createPublicKey, randomBytes, verify as verifySignature } from "crypto";
+import { randomBytes } from "crypto";
 import { authRuntimeInternals, getAuthRuntime } from "@holo-js/auth";
 import { cookie, parseCookieHeader } from "@holo-js/session";
 
@@ -43,98 +43,8 @@ function getRuntimeState() {
 function throwUnconfigured() {
   throw new Error("[@holo-js/auth-workos] WorkOS auth runtime is not configured yet.");
 }
-function isPlainHeaderRecord(value) {
-  return Boolean(value) && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
-}
-function appendKnownHeaders(headers, input) {
-  for (const name of ["authorization", "cookie", "host", "x-forwarded-host", "x-forwarded-proto"]) {
-    const value = input.get?.(name);
-    if (typeof value === "string" && value) {
-      headers.set(name, value);
-    }
-  }
-}
-function hasHeaderForEach(input) {
-  return !Array.isArray(input) && "forEach" in input && typeof input.forEach === "function";
-}
-function hasHeaderEntries(input) {
-  return !Array.isArray(input) && "entries" in input && typeof input.entries === "function";
-}
-function hasHeaderGet(input) {
-  return !Array.isArray(input) && "get" in input && typeof input.get === "function";
-}
-function normalizeRequestHeaders(input) {
-  const headers = new Headers();
-  if (!input) {
-    return headers;
-  }
-  if (input instanceof Headers || Array.isArray(input)) {
-    new Headers(input).forEach((value, name) => headers.append(name, value));
-    return headers;
-  }
-  if (hasHeaderForEach(input)) {
-    input.forEach((value, name) => headers.append(name, value));
-    return headers;
-  }
-  if (hasHeaderEntries(input)) {
-    for (const [name, value] of input.entries()) {
-      headers.append(name, value);
-    }
-    return headers;
-  }
-  if (hasHeaderGet(input)) {
-    appendKnownHeaders(headers, input);
-    return headers;
-  }
-  if (isPlainHeaderRecord(input)) {
-    for (const [name, value] of Object.entries(input)) {
-      if (typeof value === "string") {
-        headers.append(name, value);
-        continue;
-      }
-      if (Array.isArray(value)) {
-        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
-        const joined = value.filter((entry) => typeof entry === "string").join(separator);
-        if (joined) {
-          headers.append(name, joined);
-        }
-      }
-    }
-  }
-  return headers;
-}
-function getRequestFromLikeInput(input) {
-  return input.request ?? input.web?.request ?? (input.req instanceof Request ? input.req : void 0);
-}
-function getRequestLikeHeaders(input) {
-  return input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers;
-}
-function getRequestLikeMethod(input) {
-  return input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
-}
-function getRequestLikeUrl(input, headers) {
-  const url = (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
-  try {
-    return new URL(url).toString();
-  } catch {
-    const protocol = headers.get("x-forwarded-proto") ?? "http";
-    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
-    return new URL(url, `${protocol}://${host}`).toString();
-  }
-}
 function normalizeWorkosRequest(input) {
-  if (input instanceof Request) {
-    return input;
-  }
-  const request = getRequestFromLikeInput(input);
-  if (request) {
-    return request;
-  }
-  const headers = normalizeRequestHeaders(getRequestLikeHeaders(input));
-  return new Request(getRequestLikeUrl(input, headers), {
-    method: getRequestLikeMethod(input),
-    headers
-  });
+  return authRuntimeInternals.normalizeRequestInput(input);
 }
 function getBindings() {
   const workosBindings = getRuntimeState().bindings;
@@ -146,75 +56,31 @@ function getBindings() {
     identityStore: workosBindings.identityStore
   };
 }
-function decodeJwtSegment(value, label) {
-  try {
-    return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-  } catch {
-    throw new Error(`[@holo-js/auth-workos] WorkOS token ${label} was not valid JSON.`);
-  }
-}
 function parseJwt(token) {
-  const segments = token.split(".");
-  if (segments.length !== 3 || !segments[0] || !segments[1] || !segments[2]) {
-    throw new Error("[@holo-js/auth-workos] WorkOS token was not a valid JWT.");
-  }
-  return {
-    header: decodeJwtSegment(segments[0], "header"),
-    payload: decodeJwtSegment(segments[1], "payload"),
-    signature: Buffer.from(segments[2], "base64url"),
-    signingInput: Buffer.from(`${segments[0]}.${segments[1]}`, "utf8")
-  };
+  return authRuntimeInternals.jwt.parseJwt(token, {
+    errorPrefix: "[@holo-js/auth-workos] WorkOS token",
+    malformedMessage: "[@holo-js/auth-workos] WorkOS token was not a valid JWT."
+  });
 }
 function getJwtStringClaim(token, claim) {
-  try {
-    const value = parseJwt(token).payload[claim];
-    return typeof value === "string" && value.trim() ? value : void 0;
-  } catch {
-    return void 0;
-  }
+  return authRuntimeInternals.jwt.getJwtStringClaim(token, claim, {
+    errorPrefix: "[@holo-js/auth-workos] WorkOS token",
+    malformedMessage: "[@holo-js/auth-workos] WorkOS token was not a valid JWT."
+  });
 }
 function verifyJwtSignatureWithJwk(token, jwk) {
-  const algorithm = typeof token.header.alg === "string" ? token.header.alg : "";
-  const key = createPublicKey({ key: jwk, format: "jwk" });
-  switch (algorithm) {
-    case "RS256":
-      return verifySignature("RSA-SHA256", token.signingInput, key, token.signature);
-    case "RS384":
-      return verifySignature("RSA-SHA384", token.signingInput, key, token.signature);
-    case "RS512":
-      return verifySignature("RSA-SHA512", token.signingInput, key, token.signature);
-    default:
-      throw new Error(`[@holo-js/auth-workos] Unsupported WorkOS JWT algorithm "${algorithm || "unknown"}".`);
-  }
+  return authRuntimeInternals.jwt.verifyJwtSignatureWithJwk(token, jwk, {
+    unsupportedAlgorithmMessage: (algorithm) => `[@holo-js/auth-workos] Unsupported WorkOS JWT algorithm "${algorithm}".`
+  });
 }
 async function fetchWorkosJwks(clientId, options = {}) {
   const normalizedClientId = clientId.trim();
-  if (options.refresh) {
-    workosJwksCache.delete(normalizedClientId);
-  }
-  const existing = workosJwksCache.get(normalizedClientId);
-  if (existing) {
-    return existing;
-  }
-  const pending = (async () => {
-    const response = await fetch(`${WORKOS_API_BASE_URL}/sso/jwks/${encodeURIComponent(normalizedClientId)}`, {
-      headers: {
-        accept: "application/json"
-      }
-    });
-    if (!response.ok) {
-      throw new Error(`[@holo-js/auth-workos] Failed to load WorkOS JWKS for "${normalizedClientId}".`);
-    }
-    const payload = await response.json();
-    return payload.keys ?? [];
-  })();
-  workosJwksCache.set(normalizedClientId, pending);
-  try {
-    return await pending;
-  } catch (error) {
-    workosJwksCache.delete(normalizedClientId);
-    throw error;
-  }
+  return authRuntimeInternals.jwt.fetchCachedJwks(normalizedClientId, {
+    cache: workosJwksCache,
+    requestUrl: `${WORKOS_API_BASE_URL}/sso/jwks/${encodeURIComponent(normalizedClientId)}`,
+    refresh: options.refresh,
+    errorMessage: `[@holo-js/auth-workos] Failed to load WorkOS JWKS for "${normalizedClientId}".`
+  });
 }
 async function verifyWorkosSessionToken(token, config) {
   const clientId = config.clientId?.trim();
@@ -1014,21 +880,18 @@ function createHostedAuthFailure(code, message, status) {
   });
 }
 async function loginWithWorkos(input, options = {}) {
-  try {
-    const request = normalizeWorkosRequest(input);
-    const providerConfig = getConfiguredProviderConfig(options.provider);
-    return createWorkosRedirect(request, providerConfig, "sign-in");
-  } catch (error) {
-    return createWorkosErrorResponse(error, "workos_login_failed");
-  }
+  return createWorkosHostedAuthRedirect(input, options.provider, "sign-in", "workos_login_failed");
 }
 async function registerWithWorkos(input, options = {}) {
+  return createWorkosHostedAuthRedirect(input, options.provider, "sign-up", "workos_register_failed");
+}
+function createWorkosHostedAuthRedirect(input, provider, screenHint, failureCode) {
   try {
     const request = normalizeWorkosRequest(input);
-    const providerConfig = getConfiguredProviderConfig(options.provider);
-    return createWorkosRedirect(request, providerConfig, "sign-up");
+    const providerConfig = getConfiguredProviderConfig(provider);
+    return createWorkosRedirect(request, providerConfig, screenHint);
   } catch (error) {
-    return createWorkosErrorResponse(error, "workos_register_failed");
+    return createWorkosErrorResponse(error, failureCode);
   }
 }
 async function readCurrentWorkosLogoutSession(guard, providerName) {
@@ -1052,19 +915,23 @@ async function logoutWithWorkos(input, options = {}) {
     }
     const workosSession = await readCurrentWorkosLogoutSession(guard, providerName);
     if (!workosSession) {
-      return createHostedAuthFailure(
-        "workos_session_missing",
-        "The current Holo session was not created by WorkOS.",
-        422
-      );
+      return Response.redirect(new URL("/", request.url), 303);
     }
     const local = await getAuthRuntime().guard(guard).logout();
-    return createHostedAuthSuccess(Object.freeze({
-      url: createLogoutUrl(workosSession.sessionId, request, options.returnTo),
-      local
-    }));
+    const response = new Response(null, {
+      status: 303,
+      headers: {
+        Location: createLogoutUrl(workosSession.sessionId, request, options.returnTo)
+      }
+    });
+    for (const cookie2 of local.cookies) {
+      response.headers.append("Set-Cookie", cookie2);
+    }
+    return response;
   } catch {
-    return createHostedAuthFailure("workos_logout_failed", "Unable to complete WorkOS logout.", 500);
+    return Response.json(createHostedAuthFailure("workos_logout_failed", "Unable to complete WorkOS logout.", 500), {
+      status: 500
+    });
   }
 }
 async function completeWorkosAuth(input, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-workos",
-  "version": "0.1.9",
+  "version": "0.2.1",
   "description": "Holo-JS Framework - WorkOS auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -23,9 +23,9 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/auth": "^0.1.9",
-    "@holo-js/config": "^0.1.9",
-    "@holo-js/session": "^0.1.9"
+    "@holo-js/auth": "^0.2.1",
+    "@holo-js/config": "^0.2.1",
+    "@holo-js/session": "^0.2.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",