@inai-dev/astro 0.2.0 → 0.4.0

package/README.md

@@ -41,9 +41,12 @@ import { inaiAstroMiddleware } from "@inai-dev/astro/middleware";
 export const onRequest = inaiAstroMiddleware({
   publicRoutes: ["/", "/about", "/login"],
   signInUrl: "/login",
+  // jwksUrl: "https://apiauth.inai.dev/.well-known/jwks.json", // optional override
 });
 ```
 
+> All tokens are cryptographically verified using ES256 (ECDSA P-256). Public keys are fetched from the JWKS endpoint and cached for 5 minutes.
+
 The middleware automatically:
 - Skips public routes, `/api/*`, and `/_*` paths
 - Validates the auth token from cookies
@@ -206,6 +209,10 @@ import type { AstroCookies, AstroAPIContext } from "@inai-dev/astro/api-routes";
 import type { AuthObject, UserResource, OrganizationResource } from "@inai-dev/astro";
 ```
 
+## Questions & Support
+
+Visit [https://inai.dev](https://inai.dev) for documentation, guides, and support.
+
 ## License
 
 [MIT](../../LICENSE)

package/dist/index.js

@@ -10,11 +10,16 @@ function inaiAuth(_config = {}) {
 import {
   COOKIE_AUTH_TOKEN,
   COOKIE_REFRESH_TOKEN,
-  getClaimsFromToken,
-  isTokenExpired
+  decodeJWTHeader,
+  verifyES256,
+  isTokenExpired,
+  JWKSClient,
+  DEFAULT_API_URL
 } from "@inai-dev/shared";
 function inaiAstroMiddleware(config = {}) {
   const { publicRoutes = [], signInUrl = "/login" } = config;
+  const jwksUrl = config.jwksUrl ?? `${config.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new JWKSClient(jwksUrl);
   return async (context, next) => {
     const { pathname } = context.url;
     const isPublic = publicRoutes.some((route) => {
@@ -54,9 +59,28 @@ function inaiAstroMiddleware(config = {}) {
         `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`
       );
     }
-    const claims = getClaimsFromToken(token);
+    const header = decodeJWTHeader(token);
+    if (!header?.kid) {
+      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+    }
+    let publicKey;
+    try {
+      publicKey = await jwksClient.getKey(header.kid);
+    } catch {
+      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+    }
+    let claims = await verifyES256(token, publicKey);
     if (!claims) {
-      return context.redirect(signInUrl);
+      jwksClient.invalidate();
+      try {
+        publicKey = await jwksClient.getKey(header.kid);
+      } catch {
+        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+      }
+      claims = await verifyES256(token, publicKey);
+      if (!claims) {
+        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+      }
     }
     const roles = claims.roles ?? [];
     const permissions = claims.permissions ?? [];
@@ -85,7 +109,7 @@ function inaiAstroMiddleware(config = {}) {
 import { InAIAuthClient as InAIAuthClient2 } from "@inai-dev/backend";
 import {
   COOKIE_AUTH_TOKEN as COOKIE_AUTH_TOKEN3,
-  getClaimsFromToken as getClaimsFromToken2,
+  getClaimsFromToken,
   isTokenExpired as isTokenExpired2
 } from "@inai-dev/shared";
 
@@ -268,7 +292,7 @@ function auth(context) {
   if (existing) return existing;
   const token = context.cookies.get(COOKIE_AUTH_TOKEN3)?.value;
   if (!token || isTokenExpired2(token)) return null;
-  const claims = getClaimsFromToken2(token);
+  const claims = getClaimsFromToken(token);
   if (!claims) return null;
   const roles = claims.roles ?? [];
   const permissions = claims.permissions ?? [];

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/integration.ts","../src/middleware.ts","../src/server.ts","../src/api-routes.ts"],"sourcesContent":["import type { AstroIntegration } from \"astro\";\n\nexport interface InAIAstroConfig {}\n\nexport function inaiAuth(_config: InAIAstroConfig = {}): AstroIntegration {\n  return {\n    name: \"@inai-dev/astro\",\n    hooks: {},\n  };\n}\n","import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n","import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config?: { publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    publishableKey: config?.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport { setAuthCookies, clearAuthCookies } from \"./api-routes\";\nexport type { AstroCookies } from \"./api-routes\";\n","import type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: Record<string, unknown>): void;\n  delete(name: string, options?: Record<string, unknown>): void;\n}\n\ninterface AstroAPIContext {\n  request: Request;\n  cookies: AstroCookies;\n  params: Record<string, string | undefined>;\n  url: URL;\n}\n\nfunction setAuthCookies(\n  cookies: AstroCookies,\n  tokens: TokenPair,\n  user: UserResource,\n): void {\n  const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({\n    user,\n    expiresAt,\n    permissions: claims?.permissions ?? [],\n    orgId: claims?.org_id,\n    orgRole: claims?.org_role,\n    appId: claims?.app_id,\n    envId: claims?.env_id,\n  }), {\n    httpOnly: false,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n}\n\nfunction clearAuthCookies(cookies: AstroCookies): void {\n  cookies.delete(COOKIE_AUTH_TOKEN, { path: \"/\" });\n  cookies.delete(COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  cookies.delete(COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const client = new InAIAuthClient(config);\n\n  async function handleLogin(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return jsonResponse({\n          mfa_required: true,\n          mfa_token: result.mfa_token,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRegister(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return jsonResponse({\n          needs_email_verification: true,\n          user: result.user,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Registration failed\";\n      return jsonResponse({ error: message }, 400);\n    }\n  }\n\n  async function handleMFAChallenge(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"MFA verification failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRefresh(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n\n      if (!refreshToken) {\n        clearAuthCookies(context.cookies);\n        return jsonResponse({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ error: \"Refresh failed\" }, 401);\n    }\n  }\n\n  async function handleLogout(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    }\n  }\n\n  async function handler(context: AstroAPIContext): Promise<Response> {\n    const path = context.params.path ?? \"\";\n\n    if (context.request.method === \"POST\") {\n      switch (path) {\n        case \"login\":\n          return handleLogin(context);\n        case \"register\":\n          return handleRegister(context);\n        case \"mfa-challenge\":\n          return handleMFAChallenge(context);\n        case \"refresh\":\n          return handleRefresh(context);\n        case \"logout\":\n          return handleLogout(context);\n      }\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404);\n  }\n\n  return {\n    ALL: handler,\n    POST: handler,\n    GET: handler,\n  };\n}\n\nexport { setAuthCookies, clearAuthCookies };\nexport type { AstroCookies, AstroAPIContext };\n"],"mappings":";AAIO,SAAS,SAAS,UAA2B,CAAC,GAAqB;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AACF;;;ACPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;;;ACjGA,SAAS,kBAAAA,uBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA,sBAAAC;AAAA,EACA,kBAAAC;AAAA,OACK;;;ACLP,SAAS,sBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP,SAAS,eACP,SACA,QACA,MACM;AACN,QAAM,eAAe,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACjF,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,UAAQ,IAAID,oBAAmB,OAAO,cAAc;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,UAAQ,IAAIC,uBAAsB,OAAO,eAAe;AAAA,IACtD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED,UAAQ,IAAI,qBAAqB,KAAK,UAAU;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe,CAAC;AAAA,IACrC,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB,CAAC,GAAG;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,iBAAiB,SAA6B;AACrD,UAAQ,OAAOD,oBAAmB,EAAE,MAAM,IAAI,CAAC;AAC/C,UAAQ,OAAOC,uBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1D,UAAQ,OAAO,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACnD;AAEA,SAAS,aAAa,MAAe,SAAS,KAAe;AAC3D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,SAAS,IAAI,eAAe,MAAM;AAExC,iBAAe,YAAY,SAA6C;AACtE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,aAAa;AAAA,UAClB,cAAc;AAAA,UACd,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,eAAe,SAA6C;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,aAAa;AAAA,UAClB,0BAA0B;AAAA,UAC1B,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,mBAAmB,SAA6C;AAC7E,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,cAAc,SAA6C;AACxE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAEhE,UAAI,CAAC,cAAc;AACjB,yBAAiB,QAAQ,OAAO;AAChC,eAAO,aAAa,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,aAAa,SAA6C;AACvE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,iBAAe,QAAQ,SAA6C;AAClE,UAAM,OAAO,QAAQ,OAAO,QAAQ;AAEpC,QAAI,QAAQ,QAAQ,WAAW,QAAQ;AACrC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,YAAY,OAAO;AAAA,QAC5B,KAAK;AACH,iBAAO,eAAe,OAAO;AAAA,QAC/B,KAAK;AACH,iBAAO,mBAAmB,OAAO;AAAA,QACnC,KAAK;AACH,iBAAO,cAAc,OAAO;AAAA,QAC9B,KAAK;AACH,iBAAO,aAAa,OAAO;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO,aAAa,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;;;ADzMO,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAIC,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAASC,oBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAIF,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAIE,gBAAe;AAAA,IAChC,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["InAIAuthClient","COOKIE_AUTH_TOKEN","getClaimsFromToken","isTokenExpired","COOKIE_AUTH_TOKEN","COOKIE_REFRESH_TOKEN","COOKIE_AUTH_TOKEN","isTokenExpired","getClaimsFromToken","InAIAuthClient"]}
+{"version":3,"sources":["../src/integration.ts","../src/middleware.ts","../src/server.ts","../src/api-routes.ts"],"sourcesContent":["import type { AstroIntegration } from \"astro\";\n\nexport interface InAIAstroConfig {}\n\nexport function inaiAuth(_config: InAIAstroConfig = {}): AstroIntegration {\n  return {\n    name: \"@inai-dev/astro\",\n    hooks: {},\n  };\n}\n","import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  decodeJWTHeader,\n  verifyES256,\n  isTokenExpired,\n  JWKSClient,\n  DEFAULT_API_URL,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n  jwksUrl?: string;\n  apiUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  const jwksUrl = config.jwksUrl\n    ?? `${config.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    // Verify token signature with JWKS\n    const header = decodeJWTHeader(token);\n    if (!header?.kid) {\n      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n    }\n\n    let publicKey: CryptoKey;\n    try {\n      publicKey = await jwksClient.getKey(header.kid);\n    } catch {\n      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n    }\n\n    let claims = await verifyES256(token, publicKey);\n    if (!claims) {\n      // Signature failed with cached key — refetch once in case of key rotation\n      jwksClient.invalidate();\n      try {\n        publicKey = await jwksClient.getKey(header.kid);\n      } catch {\n        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n      }\n      claims = await verifyES256(token, publicKey);\n      if (!claims) {\n        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n      }\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n","import type { AuthObject, UserResource } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\ninterface AstroContext {\n  cookies: {\n    get(name: string): { value: string } | undefined;\n  };\n  locals: Record<string, unknown>;\n}\n\nexport function auth(context: AstroContext): AuthObject | null {\n  const existing = (context.locals as Record<string, unknown>).auth as AuthObject | undefined;\n  if (existing) return existing;\n\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const claims = getClaimsFromToken(token);\n  if (!claims) return null;\n\n  const roles = claims.roles ?? [];\n  const permissions = claims.permissions ?? [];\n\n  return {\n    userId: claims.sub,\n    tenantId: claims.tenant_id,\n    appId: claims.app_id ?? null,\n    envId: claims.env_id ?? null,\n    orgId: claims.org_id ?? null,\n    orgRole: claims.org_role ?? null,\n    sessionId: null,\n    getToken: async () => token,\n    has: (params: { role?: string; permission?: string }) => {\n      if (params.role && roles.includes(params.role)) return true;\n      if (params.permission && permissions.includes(params.permission))\n        return true;\n      return false;\n    },\n  };\n}\n\nexport async function currentUser(\n  context: AstroContext,\n  config?: { publishableKey?: string },\n): Promise<UserResource | null> {\n  const token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n  if (!token || isTokenExpired(token)) return null;\n\n  const client = new InAIAuthClient({\n    publishableKey: config?.publishableKey,\n  });\n\n  try {\n    const { data } = await client.getMe(token);\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport { setAuthCookies, clearAuthCookies } from \"./api-routes\";\nexport type { AstroCookies } from \"./api-routes\";\n","import type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: Record<string, unknown>): void;\n  delete(name: string, options?: Record<string, unknown>): void;\n}\n\ninterface AstroAPIContext {\n  request: Request;\n  cookies: AstroCookies;\n  params: Record<string, string | undefined>;\n  url: URL;\n}\n\nfunction setAuthCookies(\n  cookies: AstroCookies,\n  tokens: TokenPair,\n  user: UserResource,\n): void {\n  const isProduction = typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  cookies.set(COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  cookies.set(COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  cookies.set(COOKIE_AUTH_SESSION, JSON.stringify({\n    user,\n    expiresAt,\n    permissions: claims?.permissions ?? [],\n    orgId: claims?.org_id,\n    orgRole: claims?.org_role,\n    appId: claims?.app_id,\n    envId: claims?.env_id,\n  }), {\n    httpOnly: false,\n    secure: isProduction,\n    sameSite: \"lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n}\n\nfunction clearAuthCookies(cookies: AstroCookies): void {\n  cookies.delete(COOKIE_AUTH_TOKEN, { path: \"/\" });\n  cookies.delete(COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  cookies.delete(COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"Content-Type\": \"application/json\" },\n  });\n}\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const client = new InAIAuthClient(config);\n\n  async function handleLogin(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return jsonResponse({\n          mfa_required: true,\n          mfa_token: result.mfa_token,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRegister(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return jsonResponse({\n          needs_email_verification: true,\n          user: result.user,\n        });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const loginUser = result.user;\n      const user = loginUser ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Registration failed\";\n      return jsonResponse({ error: message }, 400);\n    }\n  }\n\n  async function handleMFAChallenge(context: AstroAPIContext): Promise<Response> {\n    try {\n      const body = await context.request.json() as Record<string, string>;\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"MFA verification failed\";\n      return jsonResponse({ error: message }, 401);\n    }\n  }\n\n  async function handleRefresh(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n\n      if (!refreshToken) {\n        clearAuthCookies(context.cookies);\n        return jsonResponse({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(context.cookies, tokens, user);\n\n      return jsonResponse({ user });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ error: \"Refresh failed\" }, 401);\n    }\n  }\n\n  async function handleLogout(context: AstroAPIContext): Promise<Response> {\n    try {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    } catch {\n      clearAuthCookies(context.cookies);\n      return jsonResponse({ success: true });\n    }\n  }\n\n  async function handler(context: AstroAPIContext): Promise<Response> {\n    const path = context.params.path ?? \"\";\n\n    if (context.request.method === \"POST\") {\n      switch (path) {\n        case \"login\":\n          return handleLogin(context);\n        case \"register\":\n          return handleRegister(context);\n        case \"mfa-challenge\":\n          return handleMFAChallenge(context);\n        case \"refresh\":\n          return handleRefresh(context);\n        case \"logout\":\n          return handleLogout(context);\n      }\n    }\n\n    return jsonResponse({ error: \"Not found\" }, 404);\n  }\n\n  return {\n    ALL: handler,\n    POST: handler,\n    GET: handler,\n  };\n}\n\nexport { setAuthCookies, clearAuthCookies };\nexport type { AstroCookies, AstroAPIContext };\n"],"mappings":";AAIO,SAAS,SAAS,UAA2B,CAAC,GAAqB;AACxE,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,CAAC;AAAA,EACV;AACF;;;ACPA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,QAAM,UAAU,OAAO,WAClB,GAAG,OAAO,UAAU,eAAe;AACxC,QAAM,aAAa,IAAI,WAAW,OAAO;AAEzC,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAGA,UAAM,SAAS,gBAAgB,KAAK;AACpC,QAAI,CAAC,QAAQ,KAAK;AAChB,aAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,IACjF;AAEA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,WAAW,OAAO,OAAO,GAAG;AAAA,IAChD,QAAQ;AACN,aAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,IACjF;AAEA,QAAI,SAAS,MAAM,YAAY,OAAO,SAAS;AAC/C,QAAI,CAAC,QAAQ;AAEX,iBAAW,WAAW;AACtB,UAAI;AACF,oBAAY,MAAM,WAAW,OAAO,OAAO,GAAG;AAAA,MAChD,QAAQ;AACN,eAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACjF;AACA,eAAS,MAAM,YAAY,OAAO,SAAS;AAC3C,UAAI,CAAC,QAAQ;AACX,eAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACjF;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;;;ACjIA,SAAS,kBAAAA,uBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA;AAAA,EACA,kBAAAC;AAAA,OACK;;;ACLP,SAAS,sBAAsB;AAC/B;AAAA,EACE,qBAAAC;AAAA,EACA,wBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAeP,SAAS,eACP,SACA,QACA,MACM;AACN,QAAM,eAAe,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AACjF,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,UAAQ,IAAID,oBAAmB,OAAO,cAAc;AAAA,IAClD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,UAAQ,IAAIC,uBAAsB,OAAO,eAAe;AAAA,IACtD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED,UAAQ,IAAI,qBAAqB,KAAK,UAAU;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,aAAa,QAAQ,eAAe,CAAC;AAAA,IACrC,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB,CAAC,GAAG;AAAA,IACF,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;AAEA,SAAS,iBAAiB,SAA6B;AACrD,UAAQ,OAAOD,oBAAmB,EAAE,MAAM,IAAI,CAAC;AAC/C,UAAQ,OAAOC,uBAAsB,EAAE,MAAM,YAAY,CAAC;AAC1D,UAAQ,OAAO,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACnD;AAEA,SAAS,aAAa,MAAe,SAAS,KAAe;AAC3D,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACH;AAEO,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,SAAS,IAAI,eAAe,MAAM;AAExC,iBAAe,YAAY,SAA6C;AACtE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,aAAa;AAAA,UAClB,cAAc;AAAA,UACd,WAAW,OAAO;AAAA,QACpB,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,eAAe,SAA6C;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,aAAa;AAAA,UAClB,0BAA0B;AAAA,UAC1B,MAAM,OAAO;AAAA,QACf,CAAC;AAAA,MACH;AAEA,YAAM,SAAS;AACf,YAAM,YAAY,OAAO;AACzB,YAAM,OAAO,cAAc,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AACpE,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,mBAAmB,SAA6C;AAC7E,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,aAAa,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,cAAc,SAA6C;AACxE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAEhE,UAAI,CAAC,cAAc;AACjB,yBAAiB,QAAQ,OAAO;AAChC,eAAO,aAAa,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MACxD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,QAAQ,SAAS,QAAQ,IAAI;AAE5C,aAAO,aAAa,EAAE,KAAK,CAAC;AAAA,IAC9B,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IACtD;AAAA,EACF;AAEA,iBAAe,aAAa,SAA6C;AACvE,QAAI;AACF,YAAM,eAAe,QAAQ,QAAQ,IAAIA,qBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC,QAAQ;AACN,uBAAiB,QAAQ,OAAO;AAChC,aAAO,aAAa,EAAE,SAAS,KAAK,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,iBAAe,QAAQ,SAA6C;AAClE,UAAM,OAAO,QAAQ,OAAO,QAAQ;AAEpC,QAAI,QAAQ,QAAQ,WAAW,QAAQ;AACrC,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO,YAAY,OAAO;AAAA,QAC5B,KAAK;AACH,iBAAO,eAAe,OAAO;AAAA,QAC/B,KAAK;AACH,iBAAO,mBAAmB,OAAO;AAAA,QACnC,KAAK;AACH,iBAAO,cAAc,OAAO;AAAA,QAC9B,KAAK;AACH,iBAAO,aAAa,OAAO;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO,aAAa,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,EACjD;AAEA,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,EACP;AACF;;;ADzMO,SAAS,KAAK,SAA0C;AAC7D,QAAM,WAAY,QAAQ,OAAmC;AAC7D,MAAI,SAAU,QAAO;AAErB,QAAM,QAAQ,QAAQ,QAAQ,IAAIC,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO,OAAO,UAAU;AAAA,IACxB,SAAS,OAAO,YAAY;AAAA,IAC5B,WAAW;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,KAAK,CAAC,WAAmD;AACvD,UAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,UAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,eAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,YACpB,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,QAAQ,IAAID,kBAAiB,GAAG;AACtD,MAAI,CAAC,SAASC,gBAAe,KAAK,EAAG,QAAO;AAE5C,QAAM,SAAS,IAAIC,gBAAe;AAAA,IAChC,gBAAgB,QAAQ;AAAA,EAC1B,CAAC;AAED,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,MAAM,KAAK;AACzC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":["InAIAuthClient","COOKIE_AUTH_TOKEN","isTokenExpired","COOKIE_AUTH_TOKEN","COOKIE_REFRESH_TOKEN","COOKIE_AUTH_TOKEN","isTokenExpired","InAIAuthClient"]}

package/dist/middleware.d.ts

@@ -3,6 +3,8 @@ import { MiddlewareHandler } from 'astro';
 interface InAIAstroMiddlewareConfig {
     publicRoutes?: string[];
     signInUrl?: string;
+    jwksUrl?: string;
+    apiUrl?: string;
 }
 declare function inaiAstroMiddleware(config?: InAIAstroMiddlewareConfig): MiddlewareHandler;
 

package/dist/middleware.js

@@ -2,11 +2,16 @@
 import {
   COOKIE_AUTH_TOKEN,
   COOKIE_REFRESH_TOKEN,
-  getClaimsFromToken,
-  isTokenExpired
+  decodeJWTHeader,
+  verifyES256,
+  isTokenExpired,
+  JWKSClient,
+  DEFAULT_API_URL
 } from "@inai-dev/shared";
 function inaiAstroMiddleware(config = {}) {
   const { publicRoutes = [], signInUrl = "/login" } = config;
+  const jwksUrl = config.jwksUrl ?? `${config.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new JWKSClient(jwksUrl);
   return async (context, next) => {
     const { pathname } = context.url;
     const isPublic = publicRoutes.some((route) => {
@@ -46,9 +51,28 @@ function inaiAstroMiddleware(config = {}) {
         `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`
       );
     }
-    const claims = getClaimsFromToken(token);
+    const header = decodeJWTHeader(token);
+    if (!header?.kid) {
+      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+    }
+    let publicKey;
+    try {
+      publicKey = await jwksClient.getKey(header.kid);
+    } catch {
+      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+    }
+    let claims = await verifyES256(token, publicKey);
     if (!claims) {
-      return context.redirect(signInUrl);
+      jwksClient.invalidate();
+      try {
+        publicKey = await jwksClient.getKey(header.kid);
+      } catch {
+        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+      }
+      claims = await verifyES256(token, publicKey);
+      if (!claims) {
+        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);
+      }
     }
     const roles = claims.roles ?? [];
     const permissions = claims.permissions ?? [];

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  getClaimsFromToken,\n  isTokenExpired,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    const claims = getClaimsFromToken(token);\n    if (!claims) {\n      return context.redirect(signInUrl);\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAEA,UAAM,SAAS,mBAAmB,KAAK;AACvC,QAAI,CAAC,QAAQ;AACX,aAAO,QAAQ,SAAS,SAAS;AAAA,IACnC;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}
+{"version":3,"sources":["../src/middleware.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"astro\";\nimport type { AuthObject } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  decodeJWTHeader,\n  verifyES256,\n  isTokenExpired,\n  JWKSClient,\n  DEFAULT_API_URL,\n} from \"@inai-dev/shared\";\n\nexport interface InAIAstroMiddlewareConfig {\n  publicRoutes?: string[];\n  signInUrl?: string;\n  jwksUrl?: string;\n  apiUrl?: string;\n}\n\nexport function inaiAstroMiddleware(\n  config: InAIAstroMiddlewareConfig = {},\n): MiddlewareHandler {\n  const { publicRoutes = [], signInUrl = \"/login\" } = config;\n\n  const jwksUrl = config.jwksUrl\n    ?? `${config.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  return async (context, next) => {\n    const { pathname } = context.url;\n\n    const isPublic =\n      publicRoutes.some((route) => {\n        if (route.endsWith(\"*\")) {\n          return pathname.startsWith(route.slice(0, -1));\n        }\n        return pathname === route;\n      }) ||\n      pathname === signInUrl ||\n      pathname.startsWith(\"/_\") ||\n      pathname.startsWith(\"/api/\");\n\n    if (isPublic) {\n      return next();\n    }\n\n    let token = context.cookies.get(COOKIE_AUTH_TOKEN)?.value;\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = context.cookies.get(COOKIE_REFRESH_TOKEN)?.value;\n      if (refreshToken) {\n        try {\n          const refreshUrl = new URL(\"/api/auth/refresh\", context.url.origin);\n          const refreshRes = await fetch(refreshUrl.toString(), {\n            method: \"POST\",\n            headers: {\n              \"Content-Type\": \"application/json\",\n              Cookie: context.request.headers.get(\"cookie\") ?? \"\",\n            },\n          });\n          if (refreshRes.ok) {\n            const setCookies = refreshRes.headers.getSetCookie?.() ?? [];\n            const response = await next();\n            for (const cookie of setCookies) {\n              response.headers.append(\"Set-Cookie\", cookie);\n            }\n            return response;\n          }\n        } catch {\n          // Refresh failed, redirect to sign-in\n        }\n      }\n\n      return context.redirect(\n        `${signInUrl}?returnTo=${encodeURIComponent(pathname)}`,\n      );\n    }\n\n    // Verify token signature with JWKS\n    const header = decodeJWTHeader(token);\n    if (!header?.kid) {\n      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n    }\n\n    let publicKey: CryptoKey;\n    try {\n      publicKey = await jwksClient.getKey(header.kid);\n    } catch {\n      return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n    }\n\n    let claims = await verifyES256(token, publicKey);\n    if (!claims) {\n      // Signature failed with cached key — refetch once in case of key rotation\n      jwksClient.invalidate();\n      try {\n        publicKey = await jwksClient.getKey(header.kid);\n      } catch {\n        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n      }\n      claims = await verifyES256(token, publicKey);\n      if (!claims) {\n        return context.redirect(`${signInUrl}?returnTo=${encodeURIComponent(pathname)}`);\n      }\n    }\n\n    const roles = claims.roles ?? [];\n    const permissions = claims.permissions ?? [];\n\n    const authObject: AuthObject = {\n      userId: claims.sub,\n      tenantId: claims.tenant_id,\n      appId: claims.app_id ?? null,\n      envId: claims.env_id ?? null,\n      orgId: claims.org_id ?? null,\n      orgRole: claims.org_role ?? null,\n      sessionId: null,\n      getToken: async () => token,\n      has: (params: { role?: string; permission?: string }) => {\n        if (params.role && roles.includes(params.role)) return true;\n        if (params.permission && permissions.includes(params.permission))\n          return true;\n        return false;\n      },\n    };\n\n    (context.locals as Record<string, unknown>).auth = authObject;\n\n    return next();\n  };\n}\n"],"mappings":";AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASA,SAAS,oBACd,SAAoC,CAAC,GAClB;AACnB,QAAM,EAAE,eAAe,CAAC,GAAG,YAAY,SAAS,IAAI;AAEpD,QAAM,UAAU,OAAO,WAClB,GAAG,OAAO,UAAU,eAAe;AACxC,QAAM,aAAa,IAAI,WAAW,OAAO;AAEzC,SAAO,OAAO,SAAS,SAAS;AAC9B,UAAM,EAAE,SAAS,IAAI,QAAQ;AAE7B,UAAM,WACJ,aAAa,KAAK,CAAC,UAAU;AAC3B,UAAI,MAAM,SAAS,GAAG,GAAG;AACvB,eAAO,SAAS,WAAW,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,MAC/C;AACA,aAAO,aAAa;AAAA,IACtB,CAAC,KACD,aAAa,aACb,SAAS,WAAW,IAAI,KACxB,SAAS,WAAW,OAAO;AAE7B,QAAI,UAAU;AACZ,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,QAAQ,QAAQ,IAAI,iBAAiB,GAAG;AAEpD,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,QAAQ,QAAQ,IAAI,oBAAoB,GAAG;AAChE,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,aAAa,IAAI,IAAI,qBAAqB,QAAQ,IAAI,MAAM;AAClE,gBAAM,aAAa,MAAM,MAAM,WAAW,SAAS,GAAG;AAAA,YACpD,QAAQ;AAAA,YACR,SAAS;AAAA,cACP,gBAAgB;AAAA,cAChB,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,YACnD;AAAA,UACF,CAAC;AACD,cAAI,WAAW,IAAI;AACjB,kBAAM,aAAa,WAAW,QAAQ,eAAe,KAAK,CAAC;AAC3D,kBAAM,WAAW,MAAM,KAAK;AAC5B,uBAAW,UAAU,YAAY;AAC/B,uBAAS,QAAQ,OAAO,cAAc,MAAM;AAAA,YAC9C;AACA,mBAAO;AAAA,UACT;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO,QAAQ;AAAA,QACb,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC;AAAA,MACvD;AAAA,IACF;AAGA,UAAM,SAAS,gBAAgB,KAAK;AACpC,QAAI,CAAC,QAAQ,KAAK;AAChB,aAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,IACjF;AAEA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,WAAW,OAAO,OAAO,GAAG;AAAA,IAChD,QAAQ;AACN,aAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,IACjF;AAEA,QAAI,SAAS,MAAM,YAAY,OAAO,SAAS;AAC/C,QAAI,CAAC,QAAQ;AAEX,iBAAW,WAAW;AACtB,UAAI;AACF,oBAAY,MAAM,WAAW,OAAO,OAAO,GAAG;AAAA,MAChD,QAAQ;AACN,eAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACjF;AACA,eAAS,MAAM,YAAY,OAAO,SAAS;AAC3C,UAAI,CAAC,QAAQ;AACX,eAAO,QAAQ,SAAS,GAAG,SAAS,aAAa,mBAAmB,QAAQ,CAAC,EAAE;AAAA,MACjF;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,SAAS,CAAC;AAC/B,UAAM,cAAc,OAAO,eAAe,CAAC;AAE3C,UAAM,aAAyB;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,OAAO,OAAO,UAAU;AAAA,MACxB,SAAS,OAAO,YAAY;AAAA,MAC5B,WAAW;AAAA,MACX,UAAU,YAAY;AAAA,MACtB,KAAK,CAAC,WAAmD;AACvD,YAAI,OAAO,QAAQ,MAAM,SAAS,OAAO,IAAI,EAAG,QAAO;AACvD,YAAI,OAAO,cAAc,YAAY,SAAS,OAAO,UAAU;AAC7D,iBAAO;AACT,eAAO;AAAA,MACT;AAAA,IACF;AAEA,IAAC,QAAQ,OAAmC,OAAO;AAEnD,WAAO,KAAK;AAAA,EACd;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inai-dev/astro",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Astro integration for InAI Auth SDK",
   "type": "module",
   "main": "./dist/index.js",
@@ -35,9 +35,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@inai-dev/types": "^1.1.0",
-    "@inai-dev/shared": "^1.1.0",
-    "@inai-dev/backend": "^1.2.0"
+    "@inai-dev/types": "^1.3.0",
+    "@inai-dev/shared": "^1.3.0",
+    "@inai-dev/backend": "^1.4.0"
   },
   "peerDependencies": {
     "astro": ">=4.0.0"