@inai-dev/astro 0.1.1 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # @inai-dev/astro
 
-Astro integration for InAI Auth. Provides middleware, server-side helpers, and Astro components for authentication.
+Full Astro integration for InAI Auth. Includes middleware with automatic token refresh, API route handlers, and server-side helpers.
 
 ## Installation
 
@@ -8,6 +8,13 @@ Astro integration for InAI Auth. Provides middleware, server-side helpers, and A
 npm install @inai-dev/astro
 ```
 
+## Environment Variables
+
+```env
+# Required — your publishable key
+INAI_PUBLISHABLE_KEY=pk_live_...
+```
+
 ## Setup
 
 ### 1. Add Integration
@@ -15,46 +22,193 @@ npm install @inai-dev/astro
 ```ts
 // astro.config.mjs
 import { defineConfig } from "astro/config";
-import inaiAuth from "@inai-dev/astro";
+import { inaiAuth } from "@inai-dev/astro";
 
 export default defineConfig({
-  integrations: [
-    inaiAuth({
-      publishableKey: import.meta.env.INAI_PUBLISHABLE_KEY,
-    }),
-  ],
+  output: "server", // Required — SSR mode for auth
+  integrations: [inaiAuth()],
+});
+```
+
+> **Note:** Auth requires `output: "server"` (or `"hybrid"`) since middleware and API routes run on the server.
+
+### 2. Middleware
+
+```ts
+// src/middleware.ts
+import { inaiAstroMiddleware } from "@inai-dev/astro/middleware";
+
+export const onRequest = inaiAstroMiddleware({
+  publicRoutes: ["/", "/about", "/login"],
+  signInUrl: "/login",
+});
+```
+
+The middleware automatically:
+- Skips public routes, `/api/*`, and `/_*` paths
+- Validates the auth token from cookies
+- Refreshes expired tokens via `/api/auth/refresh` when a refresh token exists
+- Sets `Astro.locals.auth` with the `AuthObject` for authenticated requests
+- Redirects to sign-in for unauthenticated requests on protected routes
+
+### 3. API Routes
+
+Auth uses standard Astro API routes (not Astro Actions). This is intentional: the middleware refreshes tokens via self-fetch to `/api/auth/refresh`, which requires a real HTTP endpoint. API routes also allow direct cookie manipulation and standard REST semantics for auth flows.
+
+```ts
+// src/pages/api/auth/[path].ts
+import { createAuthRoutes } from "@inai-dev/astro/api-routes";
+
+const routes = createAuthRoutes({
+  publishableKey: process.env.INAI_PUBLISHABLE_KEY,
+});
+
+export const ALL = routes.ALL;
+```
+
+Handles the following endpoints automatically:
+- `POST /api/auth/login` — User login (returns `{ user }` or `{ mfa_required, mfa_token }`)
+- `POST /api/auth/register` — User registration
+- `POST /api/auth/mfa-challenge` — MFA verification
+- `POST /api/auth/refresh` — Token refresh (also called automatically by middleware)
+- `POST /api/auth/logout` — User logout
+
+#### Calling from the client
+
+```ts
+// Login
+const res = await fetch("/api/auth/login", {
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ email, password }),
 });
+const { user, mfa_required, mfa_token } = await res.json();
+
+// MFA (if required)
+const res = await fetch("/api/auth/mfa-challenge", {
+  method: "POST",
+  headers: { "Content-Type": "application/json" },
+  body: JSON.stringify({ mfa_token, code }),
+});
+
+// Logout
+await fetch("/api/auth/logout", { method: "POST" });
 ```
 
-### 2. Use in Pages
+### 4. Server-Side Auth
+
+#### `auth()`
+
+Returns the `AuthObject` from the current request context (populated by middleware).
+
+```astro
+---
+import { auth } from "@inai-dev/astro/server";
+
+const authObj = auth(Astro);
+if (!authObj?.userId) {
+  return Astro.redirect("/login");
+}
+
+// Check roles/permissions
+if (authObj.has({ role: "admin" })) {
+  // admin-only logic
+}
+---
+<p>User: {authObj.userId}</p>
+```
+
+**`AuthObject`:**
+
+| Property | Type | Description |
+|---|---|---|
+| `userId` | `string \| null` | Current user ID |
+| `tenantId` | `string \| null` | Tenant ID |
+| `appId` | `string \| null` | Application ID |
+| `envId` | `string \| null` | Environment ID |
+| `orgId` | `string \| null` | Active organization ID |
+| `orgRole` | `string \| null` | Role in active organization |
+| `sessionId` | `string \| null` | Session ID |
+| `getToken()` | `() => Promise<string \| null>` | Get the access token |
+| `has(params)` | `({ role?, permission? }) => boolean` | Check role or permission |
+
+#### `currentUser()`
+
+Fetches the full `UserResource` from the API.
 
 ```astro
 ---
-// src/pages/dashboard.astro
-const auth = Astro.locals.auth;
-if (!auth?.userId) return Astro.redirect("/sign-in");
+import { currentUser } from "@inai-dev/astro/server";
+
+const user = await currentUser(Astro);
+if (!user) return Astro.redirect("/login");
 ---
-<p>Welcome {auth.user.email}</p>
+<p>{user.email}</p>
 ```
 
-### 3. API Endpoints
+#### Cookie Helpers
+
+For advanced use cases (custom auth flows, manual token management):
 
 ```ts
-// src/pages/api/auth/[...path].ts
-import { handleAuthRoutes } from "@inai-dev/astro/server";
-export const ALL = handleAuthRoutes();
+import { setAuthCookies, clearAuthCookies } from "@inai-dev/astro/server";
+
+// Set auth cookies after manual authentication
+setAuthCookies(Astro.cookies, tokens, user);
+
+// Clear all auth cookies (manual logout)
+clearAuthCookies(Astro.cookies);
 ```
 
-## Exports
+## Exports Reference
+
+### `@inai-dev/astro`
+
+| Export | Kind | Description |
+|---|---|---|
+| `inaiAuth` | Function | Astro integration |
+| `inaiAstroMiddleware` | Function | Auth middleware |
+| `auth` | Function | Get `AuthObject` from context |
+| `currentUser` | Function | Get current user from API |
+| `setAuthCookies` | Function | Set auth cookies |
+| `clearAuthCookies` | Function | Clear auth cookies |
+| `createAuthRoutes` | Function | API route handlers |
+
+### `@inai-dev/astro/middleware`
+
+| Export | Kind | Description |
+|---|---|---|
+| `inaiAstroMiddleware` | Function | Auth middleware with token refresh |
 
-- `@inai-dev/astro` — Astro integration function
-- `@inai-dev/astro/middleware` — Auth middleware
-- `@inai-dev/astro/server` — Server-side helpers and API route handlers
+### `@inai-dev/astro/server`
+
+| Export | Kind | Description |
+|---|---|---|
+| `auth` | Function | Get `AuthObject` from context |
+| `currentUser` | Function | Get current user |
+| `setAuthCookies` | Function | Set auth cookies |
+| `clearAuthCookies` | Function | Clear auth cookies |
+
+### `@inai-dev/astro/api-routes`
+
+| Export | Kind | Description |
+|---|---|---|
+| `createAuthRoutes` | Function | Create API route handlers |
+| `setAuthCookies` | Function | Set auth cookies |
+| `clearAuthCookies` | Function | Clear auth cookies |
+
+## Exported Types
+
+```ts
+import type { InAIAstroConfig } from "@inai-dev/astro";
+import type { InAIAstroMiddlewareConfig } from "@inai-dev/astro/middleware";
+import type { AstroCookies, AstroAPIContext } from "@inai-dev/astro/api-routes";
+import type { AuthObject, UserResource, OrganizationResource } from "@inai-dev/astro";
+```
 
-## Documentation
+## Questions & Support
 
-- [Astro Integration](https://github.com/inai-dev/sdk/blob/main/docs/astro-integration.md)
-- [API Reference](https://github.com/inai-dev/sdk/blob/main/docs/api-reference.md)
+Visit [https://inai.dev](https://inai.dev) for documentation, guides, and support.
 
 ## License
 

package/dist/api-routes.d.ts

@@ -0,0 +1,24 @@
+import { InAIAuthConfig, TokenPair, UserResource } from '@inai-dev/types';
+
+interface AstroCookies {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options?: Record<string, unknown>): void;
+    delete(name: string, options?: Record<string, unknown>): void;
+}
+interface AstroAPIContext {
+    request: Request;
+    cookies: AstroCookies;
+    params: Record<string, string | undefined>;
+    url: URL;
+}
+declare function setAuthCookies(cookies: AstroCookies, tokens: TokenPair, user: UserResource): void;
+declare function clearAuthCookies(cookies: AstroCookies): void;
+declare function createAuthRoutes(config?: InAIAuthConfig): {
+    ALL: (context: AstroAPIContext) => Promise<Response>;
+    POST: (context: AstroAPIContext) => Promise<Response>;
+    GET: (context: AstroAPIContext) => Promise<Response>;
+};
+
+export { type AstroAPIContext, type AstroCookies, clearAuthCookies, createAuthRoutes, setAuthCookies };

package/dist/api-routes.js

@@ -0,0 +1,178 @@
+// src/api-routes.ts
+import { InAIAuthClient } from "@inai-dev/backend";
+import {
+  COOKIE_AUTH_TOKEN,
+  COOKIE_REFRESH_TOKEN,
+  COOKIE_AUTH_SESSION,
+  decodeJWTPayload
+} from "@inai-dev/shared";
+function setAuthCookies(cookies, tokens, user) {
+  const isProduction = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  const claims = decodeJWTPayload(tokens.access_token);
+  const expiresAt = claims ? new Date(claims.exp * 1e3).toISOString() : new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
+  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "strict",
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60
+  });
+  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({
+    user,
+    expiresAt,
+    permissions: claims?.permissions ?? [],
+    orgId: claims?.org_id,
+    orgRole: claims?.org_role,
+    appId: claims?.app_id,
+    envId: claims?.env_id
+  }), {
+    httpOnly: false,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+}
+function clearAuthCookies(cookies) {
+  cookies.delete(COOKIE_AUTH_TOKEN, { path: "/" });
+  cookies.delete(COOKIE_REFRESH_TOKEN, { path: "/api/auth" });
+  cookies.delete(COOKIE_AUTH_SESSION, { path: "/" });
+}
+function jsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function createAuthRoutes(config = {}) {
+  const client = new InAIAuthClient(config);
+  async function handleLogin(context) {
+    try {
+      const body = await context.request.json();
+      const result = await client.login({
+        email: body.email,
+        password: body.password
+      });
+      if (result.mfa_required) {
+        return jsonResponse({
+          mfa_required: true,
+          mfa_token: result.mfa_token
+        });
+      }
+      const tokens = result;
+      const loginUser = result.user;
+      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Login failed";
+      return jsonResponse({ error: message }, 401);
+    }
+  }
+  async function handleRegister(context) {
+    try {
+      const body = await context.request.json();
+      const result = await client.register({
+        email: body.email,
+        password: body.password,
+        firstName: body.firstName,
+        lastName: body.lastName
+      });
+      if (!result.access_token) {
+        return jsonResponse({
+          needs_email_verification: true,
+          user: result.user
+        });
+      }
+      const tokens = result;
+      const loginUser = result.user;
+      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Registration failed";
+      return jsonResponse({ error: message }, 400);
+    }
+  }
+  async function handleMFAChallenge(context) {
+    try {
+      const body = await context.request.json();
+      const tokens = await client.mfaChallenge({
+        mfa_token: body.mfa_token,
+        code: body.code
+      });
+      const { data: user } = await client.getMe(tokens.access_token);
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "MFA verification failed";
+      return jsonResponse({ error: message }, 401);
+    }
+  }
+  async function handleRefresh(context) {
+    try {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;
+      if (!refreshToken) {
+        clearAuthCookies(context.cookies);
+        return jsonResponse({ error: "No refresh token" }, 401);
+      }
+      const tokens = await client.refresh(refreshToken);
+      const { data: user } = await client.getMe(tokens.access_token);
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch {
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ error: "Refresh failed" }, 401);
+    }
+  }
+  async function handleLogout(context) {
+    try {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;
+      if (refreshToken) {
+        await client.logout(refreshToken).catch(() => {
+        });
+      }
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ success: true });
+    } catch {
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ success: true });
+    }
+  }
+  async function handler(context) {
+    const path = context.params.path ?? "";
+    if (context.request.method === "POST") {
+      switch (path) {
+        case "login":
+          return handleLogin(context);
+        case "register":
+          return handleRegister(context);
+        case "mfa-challenge":
+          return handleMFAChallenge(context);
+        case "refresh":
+          return handleRefresh(context);
+        case "logout":
+          return handleLogout(context);
+      }
+    }
+    return jsonResponse({ error: "Not found" }, 404);
+  }
+  return {
+    ALL: handler,
+    POST: handler,
+    GET: handler
+  };
+}
+export {
+  clearAuthCookies,
+  createAuthRoutes,
+  setAuthCookies
+};
+//# sourceMappingURL=api-routes.js.map

package/dist/api-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-routes.ts"],"sourcesContent":["import type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: Record<string, unknown>): void;\n  delete(name: string, options?: Record<string, unknown>): void;\n}\n\ninterface AstroAPIContext {\n  request: Request;\n  cookies: AstroCookies;\n  params: Record<string, string | undefined>;\n  url: URL;\n}\n\nfunction setAuthCookies(\n  cookies: AstroCookies,\n  tokens: TokenPair,\n  user: UserResource,\n): void {\n  const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({\n    user,\n    expiresAt,\n    permissions: claims?.permissions ?? [],\n    orgId: claims?.org_id,\n    orgRole: claims?.org_role,\n    appId: claims?.app_id,\n    envId: claims?.env_id,\n  }), {\n    httpOnly: false,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n}\n\nfunction clearAuthCookies(cookies: AstroCookies): void {\n  cookies.delete(COOKIE_AUTH_TOKEN, { path: \"/\" });\n  cookies.delete(COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  cookies.delete(COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const client = new InAIAuthClient(config);\n\n  async function handleLogin(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return jsonResponse({\n          mfa_required: true,\n          mfa_token: result.mfa_token,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRegister(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return jsonResponse({\n          needs_email_verification: true,\n          user: result.user,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Registration failed\";\n      return jsonResponse({ error: message }, 400);\n    }\n  }\n\n  async function handleMFAChallenge(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"MFA verification failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRefresh(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n\n      if (!refreshToken) {\n        clearAuthCookies(context.cookies);\n        return jsonResponse({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ error: \"Refresh failed\" }, 401);\n    }\n  }\n\n  async function handleLogout(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    }\n  }\n\n  async function handler(context: AstroAPIContext): Promise<Response> {\n    const path = context.params.path ?? \"\";\n\n    if (context.request.method === \"POST\") {\n      switch (path) {\n        case \"login\":\n          return handleLogin(context);\n        case \"register\":\n          return handleRegister(context);\n        case \"mfa-challenge\":\n          return handleMFAChallenge(context);\n        case \"refresh\":\n          return handleRefresh(context);\n        case \"logout\":\n          return handleLogout(context);\n      }\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404);\n  }\n\n  return {\n    ALL: handler,\n    POST: handler,\n    GET: handler,\n  };\n}\n\nexport { setAuthCookies, clearAuthCookies };\nexport type { AstroCookies, AstroAPIContext };\n"],"mappings":";AACA,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP,SAAS,eACP,SACA,QACA,MACM;AACN,QAAM,eAAe,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACjF,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,UAAQ,IAAI,mBAAmB,OAAO,cAAc;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,UAAQ,IAAI,sBAAsB,OAAO,eAAe;AAAA,IACtD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED,UAAQ,IAAI,qBAAqB,KAAK,UAAU;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe,CAAC;AAAA,IACrC,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB,CAAC,GAAG;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,iBAAiB,SAA6B;AACrD,UAAQ,OAAO,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC/C,UAAQ,OAAO,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1D,UAAQ,OAAO,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACnD;AAEA,SAAS,aAAa,MAAe,SAAS,KAAe;AAC3D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,SAAS,IAAI,eAAe,MAAM;AAExC,iBAAe,YAAY,SAA6C;AACtE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,aAAa;AAAA,UAClB,cAAc;AAAA,UACd,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,eAAe,SAA6C;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,aAAa;AAAA,UAClB,0BAA0B;AAAA,UAC1B,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,mBAAmB,SAA6C;AAC7E,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,cAAc,SAA6C;AACxE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAEhE,UAAI,CAAC,cAAc;AACjB,yBAAiB,QAAQ,OAAO;AAChC,eAAO,aAAa,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,aAAa,SAA6C;AACvE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,iBAAe,QAAQ,SAA6C;AAClE,UAAM,OAAO,QAAQ,OAAO,QAAQ;AAEpC,QAAI,QAAQ,QAAQ,WAAW,QAAQ;AACrC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,YAAY,OAAO;AAAA,QAC5B,KAAK;AACH,iBAAO,eAAe,OAAO;AAAA,QAC/B,KAAK;AACH,iBAAO,mBAAmB,OAAO;AAAA,QACnC,KAAK;AACH,iBAAO,cAAc,OAAO;AAAA,QAC9B,KAAK;AACH,iBAAO,aAAa,OAAO;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO,aAAa,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,12 +1,11 @@
 import { AstroIntegration } from 'astro';
 export { InAIAstroMiddlewareConfig, inaiAstroMiddleware } from './middleware.js';
 export { auth, currentUser } from './server.js';
+export { AstroAPIContext, AstroCookies, clearAuthCookies, createAuthRoutes, setAuthCookies } from './api-routes.js';
 export { AuthObject, OrganizationResource, UserResource } from '@inai-dev/types';
 
 interface InAIAstroConfig {
-    apiUrl: string;
-    publishableKey?: string;
 }
-declare function inaiAuth(config: InAIAstroConfig): AstroIntegration;
+declare function inaiAuth(_config?: InAIAstroConfig): AstroIntegration;
 
 export { type InAIAstroConfig, inaiAuth };

package/dist/index.js

@@ -1,27 +1,15 @@
 // src/integration.ts
-function inaiAuth(config) {
+function inaiAuth(_config = {}) {
   return {
     name: "@inai-dev/astro",
-    hooks: {
-      "astro:config:setup": ({ updateConfig }) => {
-        updateConfig({
-          vite: {
-            define: {
-              "import.meta.env.INAI_API_URL": JSON.stringify(config.apiUrl),
-              "import.meta.env.INAI_PUBLISHABLE_KEY": JSON.stringify(
-                config.publishableKey ?? ""
-              )
-            }
-          }
-        });
-      }
-    }
+    hooks: {}
   };
 }
 
 // src/middleware.ts
 import {
   COOKIE_AUTH_TOKEN,
+  COOKIE_REFRESH_TOKEN,
   getClaimsFromToken,
   isTokenExpired
 } from "@inai-dev/shared";
@@ -38,8 +26,30 @@ function inaiAstroMiddleware(config = {}) {
     if (isPublic) {
       return next();
     }
-    const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
+    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
     if (!token || isTokenExpired(token)) {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;
+      if (refreshToken) {
+        try {
+          const refreshUrl = new URL("/api/auth/refresh", context.url.origin);
+          const refreshRes = await fetch(refreshUrl.toString(), {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Cookie: context.request.headers.get("cookie") ?? ""
+            }
+          });
+          if (refreshRes.ok) {
+            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];
+            const response = await next();
+            for (const cookie of setCookies) {
+              response.headers.append("Set-Cookie", cookie);
+            }
+            return response;
+          }
+        } catch {
+        }
+      }
       return context.redirect(
         `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`
       );
@@ -72,16 +82,191 @@ function inaiAstroMiddleware(config = {}) {
 }
 
 // src/server.ts
-import { InAIAuthClient } from "@inai-dev/backend";
+import { InAIAuthClient as InAIAuthClient2 } from "@inai-dev/backend";
 import {
-  COOKIE_AUTH_TOKEN as COOKIE_AUTH_TOKEN2,
+  COOKIE_AUTH_TOKEN as COOKIE_AUTH_TOKEN3,
   getClaimsFromToken as getClaimsFromToken2,
   isTokenExpired as isTokenExpired2
 } from "@inai-dev/shared";
+
+// src/api-routes.ts
+import { InAIAuthClient } from "@inai-dev/backend";
+import {
+  COOKIE_AUTH_TOKEN as COOKIE_AUTH_TOKEN2,
+  COOKIE_REFRESH_TOKEN as COOKIE_REFRESH_TOKEN2,
+  COOKIE_AUTH_SESSION,
+  decodeJWTPayload
+} from "@inai-dev/shared";
+function setAuthCookies(cookies, tokens, user) {
+  const isProduction = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  const claims = decodeJWTPayload(tokens.access_token);
+  const expiresAt = claims ? new Date(claims.exp * 1e3).toISOString() : new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
+  cookies.set(COOKIE_AUTH_TOKEN2, tokens.access_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+  cookies.set(COOKIE_REFRESH_TOKEN2, tokens.refresh_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "strict",
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60
+  });
+  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({
+    user,
+    expiresAt,
+    permissions: claims?.permissions ?? [],
+    orgId: claims?.org_id,
+    orgRole: claims?.org_role,
+    appId: claims?.app_id,
+    envId: claims?.env_id
+  }), {
+    httpOnly: false,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+}
+function clearAuthCookies(cookies) {
+  cookies.delete(COOKIE_AUTH_TOKEN2, { path: "/" });
+  cookies.delete(COOKIE_REFRESH_TOKEN2, { path: "/api/auth" });
+  cookies.delete(COOKIE_AUTH_SESSION, { path: "/" });
+}
+function jsonResponse(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function createAuthRoutes(config = {}) {
+  const client = new InAIAuthClient(config);
+  async function handleLogin(context) {
+    try {
+      const body = await context.request.json();
+      const result = await client.login({
+        email: body.email,
+        password: body.password
+      });
+      if (result.mfa_required) {
+        return jsonResponse({
+          mfa_required: true,
+          mfa_token: result.mfa_token
+        });
+      }
+      const tokens = result;
+      const loginUser = result.user;
+      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Login failed";
+      return jsonResponse({ error: message }, 401);
+    }
+  }
+  async function handleRegister(context) {
+    try {
+      const body = await context.request.json();
+      const result = await client.register({
+        email: body.email,
+        password: body.password,
+        firstName: body.firstName,
+        lastName: body.lastName
+      });
+      if (!result.access_token) {
+        return jsonResponse({
+          needs_email_verification: true,
+          user: result.user
+        });
+      }
+      const tokens = result;
+      const loginUser = result.user;
+      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Registration failed";
+      return jsonResponse({ error: message }, 400);
+    }
+  }
+  async function handleMFAChallenge(context) {
+    try {
+      const body = await context.request.json();
+      const tokens = await client.mfaChallenge({
+        mfa_token: body.mfa_token,
+        code: body.code
+      });
+      const { data: user } = await client.getMe(tokens.access_token);
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "MFA verification failed";
+      return jsonResponse({ error: message }, 401);
+    }
+  }
+  async function handleRefresh(context) {
+    try {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN2)?.value;
+      if (!refreshToken) {
+        clearAuthCookies(context.cookies);
+        return jsonResponse({ error: "No refresh token" }, 401);
+      }
+      const tokens = await client.refresh(refreshToken);
+      const { data: user } = await client.getMe(tokens.access_token);
+      setAuthCookies(context.cookies, tokens, user);
+      return jsonResponse({ user });
+    } catch {
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ error: "Refresh failed" }, 401);
+    }
+  }
+  async function handleLogout(context) {
+    try {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN2)?.value;
+      if (refreshToken) {
+        await client.logout(refreshToken).catch(() => {
+        });
+      }
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ success: true });
+    } catch {
+      clearAuthCookies(context.cookies);
+      return jsonResponse({ success: true });
+    }
+  }
+  async function handler(context) {
+    const path = context.params.path ?? "";
+    if (context.request.method === "POST") {
+      switch (path) {
+        case "login":
+          return handleLogin(context);
+        case "register":
+          return handleRegister(context);
+        case "mfa-challenge":
+          return handleMFAChallenge(context);
+        case "refresh":
+          return handleRefresh(context);
+        case "logout":
+          return handleLogout(context);
+      }
+    }
+    return jsonResponse({ error: "Not found" }, 404);
+  }
+  return {
+    ALL: handler,
+    POST: handler,
+    GET: handler
+  };
+}
+
+// src/server.ts
 function auth(context) {
   const existing = context.locals.auth;
   if (existing) return existing;
-  const token = context.cookies.get(COOKIE_AUTH_TOKEN2)?.value;
+  const token = context.cookies.get(COOKIE_AUTH_TOKEN3)?.value;
   if (!token || isTokenExpired2(token)) return null;
   const claims = getClaimsFromToken2(token);
   if (!claims) return null;
@@ -105,11 +290,10 @@ function auth(context) {
   };
 }
 async function currentUser(context, config) {
-  const token = context.cookies.get(COOKIE_AUTH_TOKEN2)?.value;
+  const token = context.cookies.get(COOKIE_AUTH_TOKEN3)?.value;
   if (!token || isTokenExpired2(token)) return null;
-  const client = new InAIAuthClient({
-    apiUrl: config.apiUrl,
-    publishableKey: config.publishableKey
+  const client = new InAIAuthClient2({
+    publishableKey: config?.publishableKey
   });
   try {
     const { data } = await client.getMe(token);
@@ -120,8 +304,11 @@ async function currentUser(context, config) {
 }
 export {
   auth,
+  clearAuthCookies,
+  createAuthRoutes,
   currentUser,
   inaiAstroMiddleware,
-  inaiAuth
+  inaiAuth,
+  setAuthCookies
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/integration.ts","../src/middleware.ts","../src/server.ts"],"sourcesContent":["import type { AstroIntegration } from \"astro\";\n\nexport interface InAIAstroConfig {\n  apiUrl: string;\n  publishableKey?: string;\n}\n\nexport function inaiAuth(config: InAIAstroConfig): AstroIntegration {\n  return {\n    name: \"@inai-dev/astro\",\n    hooks: {\n      \"astro:config:setup\": ({ updateConfig }) => {\n        updateConfig({\n          vite: {\n            define: {\n              \"import.meta.env.INAI_API_URL\": JSON.stringify(config.apiUrl),\n              \"import.meta.env.INAI_PUBLISHABLE_KEY\": JSON.stringify(\n                config.publishableKey ?? \"\",\n              ),\n            },\n          },\n        });\n      },\n    },\n  };\n}\n","import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n","import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config: { apiUrl: string; publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    apiUrl: config.apiUrl,\n    publishableKey: config.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAOO,SAAS,SAAS,QAA2C;AAClE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,MACL,sBAAsB,CAAC,EAAE,aAAa,MAAM;AAC1C,qBAAa;AAAA,UACX,MAAM;AAAA,YACJ,QAAQ;AAAA,cACN,gCAAgC,KAAK,UAAU,OAAO,MAAM;AAAA,cAC5D,wCAAwC,KAAK;AAAA,gBAC3C,OAAO,kBAAkB;AAAA,cAC3B;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;;;ACvBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEtD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;;;ACxEA,SAAS,sBAAsB;AAC/B;AAAA,EACE,qBAAAA;AAAA,EACA,sBAAAC;AAAA,EACA,kBAAAC;AAAA,OACK;AASA,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAIF,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASE,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAASD,oBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAID,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASE,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,EACzB,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["COOKIE_AUTH_TOKEN","getClaimsFromToken","isTokenExpired"]}
+{"version":3,"sources":["../src/integration.ts","../src/middleware.ts","../src/server.ts","../src/api-routes.ts"],"sourcesContent":["import type { AstroIntegration } from \"astro\";\n\nexport interface InAIAstroConfig {}\n\nexport function inaiAuth(_config: InAIAstroConfig = {}): AstroIntegration {\n  return {\n    name: \"@inai-dev/astro\",\n    hooks: {},\n  };\n}\n","import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n","import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config?: { publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    publishableKey: config?.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport { setAuthCookies, clearAuthCookies } from \"./api-routes\";\nexport type { AstroCookies } from \"./api-routes\";\n","import type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: Record<string, unknown>): void;\n  delete(name: string, options?: Record<string, unknown>): void;\n}\n\ninterface AstroAPIContext {\n  request: Request;\n  cookies: AstroCookies;\n  params: Record<string, string | undefined>;\n  url: URL;\n}\n\nfunction setAuthCookies(\n  cookies: AstroCookies,\n  tokens: TokenPair,\n  user: UserResource,\n): void {\n  const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({\n    user,\n    expiresAt,\n    permissions: claims?.permissions ?? [],\n    orgId: claims?.org_id,\n    orgRole: claims?.org_role,\n    appId: claims?.app_id,\n    envId: claims?.env_id,\n  }), {\n    httpOnly: false,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n}\n\nfunction clearAuthCookies(cookies: AstroCookies): void {\n  cookies.delete(COOKIE_AUTH_TOKEN, { path: \"/\" });\n  cookies.delete(COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  cookies.delete(COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const client = new InAIAuthClient(config);\n\n  async function handleLogin(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return jsonResponse({\n          mfa_required: true,\n          mfa_token: result.mfa_token,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRegister(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return jsonResponse({\n          needs_email_verification: true,\n          user: result.user,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Registration failed\";\n      return jsonResponse({ error: message }, 400);\n    }\n  }\n\n  async function handleMFAChallenge(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"MFA verification failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRefresh(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n\n      if (!refreshToken) {\n        clearAuthCookies(context.cookies);\n        return jsonResponse({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ error: \"Refresh failed\" }, 401);\n    }\n  }\n\n  async function handleLogout(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    }\n  }\n\n  async function handler(context: AstroAPIContext): Promise<Response> {\n    const path = context.params.path ?? \"\";\n\n    if (context.request.method === \"POST\") {\n      switch (path) {\n        case \"login\":\n          return handleLogin(context);\n        case \"register\":\n          return handleRegister(context);\n        case \"mfa-challenge\":\n          return handleMFAChallenge(context);\n        case \"refresh\":\n          return handleRefresh(context);\n        case \"logout\":\n          return handleLogout(context);\n      }\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404);\n  }\n\n  return {\n    ALL: handler,\n    POST: handler,\n    GET: handler,\n  };\n}\n\nexport { setAuthCookies, clearAuthCookies };\nexport type { AstroCookies, AstroAPIContext };\n"],"mappings":";AAIO,SAAS,SAAS,UAA2B,CAAC,GAAqB;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AACF;;;ACPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;;;ACjGA,SAAS,kBAAAA,uBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA,sBAAAC;AAAA,EACA,kBAAAC;AAAA,OACK;;;ACLP,SAAS,sBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP,SAAS,eACP,SACA,QACA,MACM;AACN,QAAM,eAAe,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACjF,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,UAAQ,IAAID,oBAAmB,OAAO,cAAc;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,UAAQ,IAAIC,uBAAsB,OAAO,eAAe;AAAA,IACtD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED,UAAQ,IAAI,qBAAqB,KAAK,UAAU;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe,CAAC;AAAA,IACrC,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB,CAAC,GAAG;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,iBAAiB,SAA6B;AACrD,UAAQ,OAAOD,oBAAmB,EAAE,MAAM,IAAI,CAAC;AAC/C,UAAQ,OAAOC,uBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1D,UAAQ,OAAO,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACnD;AAEA,SAAS,aAAa,MAAe,SAAS,KAAe;AAC3D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,SAAS,IAAI,eAAe,MAAM;AAExC,iBAAe,YAAY,SAA6C;AACtE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,aAAa;AAAA,UAClB,cAAc;AAAA,UACd,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,eAAe,SAA6C;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,aAAa;AAAA,UAClB,0BAA0B;AAAA,UAC1B,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,mBAAmB,SAA6C;AAC7E,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,cAAc,SAA6C;AACxE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAEhE,UAAI,CAAC,cAAc;AACjB,yBAAiB,QAAQ,OAAO;AAChC,eAAO,aAAa,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,aAAa,SAA6C;AACvE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,iBAAe,QAAQ,SAA6C;AAClE,UAAM,OAAO,QAAQ,OAAO,QAAQ;AAEpC,QAAI,QAAQ,QAAQ,WAAW,QAAQ;AACrC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,YAAY,OAAO;AAAA,QAC5B,KAAK;AACH,iBAAO,eAAe,OAAO;AAAA,QAC/B,KAAK;AACH,iBAAO,mBAAmB,OAAO;AAAA,QACnC,KAAK;AACH,iBAAO,cAAc,OAAO;AAAA,QAC9B,KAAK;AACH,iBAAO,aAAa,OAAO;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO,aAAa,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;;;ADzMO,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAIC,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAASC,oBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAIF,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAIE,gBAAe;AAAA,IAChC,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["InAIAuthClient","COOKIE_AUTH_TOKEN","getClaimsFromToken","isTokenExpired","COOKIE_AUTH_TOKEN","COOKIE_REFRESH_TOKEN","COOKIE_AUTH_TOKEN","isTokenExpired","getClaimsFromToken","InAIAuthClient"]}

package/dist/middleware.js

@@ -1,6 +1,7 @@
 // src/middleware.ts
 import {
   COOKIE_AUTH_TOKEN,
+  COOKIE_REFRESH_TOKEN,
   getClaimsFromToken,
   isTokenExpired
 } from "@inai-dev/shared";
@@ -17,8 +18,30 @@ function inaiAstroMiddleware(config = {}) {
     if (isPublic) {
       return next();
     }
-    const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
+    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
     if (!token || isTokenExpired(token)) {
+      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;
+      if (refreshToken) {
+        try {
+          const refreshUrl = new URL("/api/auth/refresh", context.url.origin);
+          const refreshRes = await fetch(refreshUrl.toString(), {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Cookie: context.request.headers.get("cookie") ?? ""
+            }
+          });
+          if (refreshRes.ok) {
+            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];
+            const response = await next();
+            for (const cookie of setCookies) {
+              response.headers.append("Set-Cookie", cookie);
+            }
+            return response;
+          }
+        } catch {
+        }
+      }
       return context.redirect(
         `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`
       );

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEtD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}
+{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}

package/dist/server.d.ts

@@ -1,4 +1,5 @@
 import { AuthObject, UserResource } from '@inai-dev/types';
+export { AstroCookies, clearAuthCookies, setAuthCookies } from './api-routes.js';
 
 interface AstroContext {
     cookies: {
@@ -9,8 +10,7 @@ interface AstroContext {
     locals: Record<string, unknown>;
 }
 declare function auth(context: AstroContext): AuthObject | null;
-declare function currentUser(context: AstroContext, config: {
-    apiUrl: string;
+declare function currentUser(context: AstroContext, config?: {
     publishableKey?: string;
 }): Promise<UserResource | null>;
 

package/dist/server.js

@@ -1,14 +1,64 @@
 // src/server.ts
-import { InAIAuthClient } from "@inai-dev/backend";
+import { InAIAuthClient as InAIAuthClient2 } from "@inai-dev/backend";
 import {
-  COOKIE_AUTH_TOKEN,
+  COOKIE_AUTH_TOKEN as COOKIE_AUTH_TOKEN2,
   getClaimsFromToken,
   isTokenExpired
 } from "@inai-dev/shared";
+
+// src/api-routes.ts
+import { InAIAuthClient } from "@inai-dev/backend";
+import {
+  COOKIE_AUTH_TOKEN,
+  COOKIE_REFRESH_TOKEN,
+  COOKIE_AUTH_SESSION,
+  decodeJWTPayload
+} from "@inai-dev/shared";
+function setAuthCookies(cookies, tokens, user) {
+  const isProduction = typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+  const claims = decodeJWTPayload(tokens.access_token);
+  const expiresAt = claims ? new Date(claims.exp * 1e3).toISOString() : new Date(Date.now() + tokens.expires_in * 1e3).toISOString();
+  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {
+    httpOnly: true,
+    secure: isProduction,
+    sameSite: "strict",
+    path: "/api/auth",
+    maxAge: 7 * 24 * 60 * 60
+  });
+  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({
+    user,
+    expiresAt,
+    permissions: claims?.permissions ?? [],
+    orgId: claims?.org_id,
+    orgRole: claims?.org_role,
+    appId: claims?.app_id,
+    envId: claims?.env_id
+  }), {
+    httpOnly: false,
+    secure: isProduction,
+    sameSite: "lax",
+    path: "/",
+    maxAge: tokens.expires_in
+  });
+}
+function clearAuthCookies(cookies) {
+  cookies.delete(COOKIE_AUTH_TOKEN, { path: "/" });
+  cookies.delete(COOKIE_REFRESH_TOKEN, { path: "/api/auth" });
+  cookies.delete(COOKIE_AUTH_SESSION, { path: "/" });
+}
+
+// src/server.ts
 function auth(context) {
   const existing = context.locals.auth;
   if (existing) return existing;
-  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
+  const token = context.cookies.get(COOKIE_AUTH_TOKEN2)?.value;
   if (!token || isTokenExpired(token)) return null;
   const claims = getClaimsFromToken(token);
   if (!claims) return null;
@@ -32,11 +82,10 @@ function auth(context) {
   };
 }
 async function currentUser(context, config) {
-  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;
+  const token = context.cookies.get(COOKIE_AUTH_TOKEN2)?.value;
   if (!token || isTokenExpired(token)) return null;
-  const client = new InAIAuthClient({
-    apiUrl: config.apiUrl,
-    publishableKey: config.publishableKey
+  const client = new InAIAuthClient2({
+    publishableKey: config?.publishableKey
   });
   try {
     const { data } = await client.getMe(token);
@@ -47,6 +96,8 @@ async function currentUser(context, config) {
 }
 export {
   auth,
-  currentUser
+  clearAuthCookies,
+  currentUser,
+  setAuthCookies
 };
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server.ts"],"sourcesContent":["import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config: { apiUrl: string; publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    apiUrl: config.apiUrl,\n    publishableKey: config.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AACA,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AACtD,MAAI,CAAC,SAAS,eAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AACtD,MAAI,CAAC,SAAS,eAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAI,eAAe;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,EACzB,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/server.ts","../src/api-routes.ts"],"sourcesContent":["import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config?: { publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    publishableKey: config?.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport { setAuthCookies, clearAuthCookies } from \"./api-routes\";\nexport type { AstroCookies } from \"./api-routes\";\n","import type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: Record<string, unknown>): void;\n  delete(name: string, options?: Record<string, unknown>): void;\n}\n\ninterface AstroAPIContext {\n  request: Request;\n  cookies: AstroCookies;\n  params: Record<string, string | undefined>;\n  url: URL;\n}\n\nfunction setAuthCookies(\n  cookies: AstroCookies,\n  tokens: TokenPair,\n  user: UserResource,\n): void {\n  const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({\n    user,\n    expiresAt,\n    permissions: claims?.permissions ?? [],\n    orgId: claims?.org_id,\n    orgRole: claims?.org_role,\n    appId: claims?.app_id,\n    envId: claims?.env_id,\n  }), {\n    httpOnly: false,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n}\n\nfunction clearAuthCookies(cookies: AstroCookies): void {\n  cookies.delete(COOKIE_AUTH_TOKEN, { path: \"/\" });\n  cookies.delete(COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  cookies.delete(COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const client = new InAIAuthClient(config);\n\n  async function handleLogin(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return jsonResponse({\n          mfa_required: true,\n          mfa_token: result.mfa_token,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRegister(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return jsonResponse({\n          needs_email_verification: true,\n          user: result.user,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Registration failed\";\n      return jsonResponse({ error: message }, 400);\n    }\n  }\n\n  async function handleMFAChallenge(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"MFA verification failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRefresh(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n\n      if (!refreshToken) {\n        clearAuthCookies(context.cookies);\n        return jsonResponse({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ error: \"Refresh failed\" }, 401);\n    }\n  }\n\n  async function handleLogout(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    }\n  }\n\n  async function handler(context: AstroAPIContext): Promise<Response> {\n    const path = context.params.path ?? \"\";\n\n    if (context.request.method === \"POST\") {\n      switch (path) {\n        case \"login\":\n          return handleLogin(context);\n        case \"register\":\n          return handleRegister(context);\n        case \"mfa-challenge\":\n          return handleMFAChallenge(context);\n        case \"refresh\":\n          return handleRefresh(context);\n        case \"logout\":\n          return handleLogout(context);\n      }\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404);\n  }\n\n  return {\n    ALL: handler,\n    POST: handler,\n    GET: handler,\n  };\n}\n\nexport { setAuthCookies, clearAuthCookies };\nexport type { AstroCookies, AstroAPIContext };\n"],"mappings":";AACA,SAAS,kBAAAA,uBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACLP,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP,SAAS,eACP,SACA,QACA,MACM;AACN,QAAM,eAAe,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACjF,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,UAAQ,IAAI,mBAAmB,OAAO,cAAc;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,UAAQ,IAAI,sBAAsB,OAAO,eAAe;AAAA,IACtD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED,UAAQ,IAAI,qBAAqB,KAAK,UAAU;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe,CAAC;AAAA,IACrC,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB,CAAC,GAAG;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,iBAAiB,SAA6B;AACrD,UAAQ,OAAO,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAC/C,UAAQ,OAAO,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1D,UAAQ,OAAO,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACnD;;;ADvDO,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAIC,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAAS,eAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAIA,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAAS,eAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAIC,gBAAe;AAAA,IAChC,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["InAIAuthClient","COOKIE_AUTH_TOKEN","COOKIE_AUTH_TOKEN","InAIAuthClient"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inai-dev/astro",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Astro integration for InAI Auth SDK",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,11 +17,15 @@
     "./server": {
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js"
+    },
+    "./api-routes": {
+      "types": "./dist/api-routes.d.ts",
+      "import": "./dist/api-routes.js"
     }
   },
+  "sideEffects": false,
   "files": [
-    "dist",
-    "src/components"
+    "dist"
   ],
   "scripts": {
     "build": "tsup",
@@ -31,9 +35,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@inai-dev/types": "^1.0.0",
-    "@inai-dev/shared": "^1.0.0",
-    "@inai-dev/backend": "^1.0.0"
+    "@inai-dev/types": "^1.2.0",
+    "@inai-dev/shared": "^1.2.0",
+    "@inai-dev/backend": "^1.3.0"
   },
   "peerDependencies": {
     "astro": ">=4.0.0"

package/src/components/signed-in.astro

@@ -1,6 +0,0 @@
----
-const auth = Astro.locals.auth;
-const isSignedIn = !!auth?.userId;
----
-
-{isSignedIn && <slot />}

package/src/components/signed-out.astro

@@ -1,6 +0,0 @@
----
-const auth = Astro.locals.auth;
-const isSignedIn = !!auth?.userId;
----
-
-{!isSignedIn && <slot />}