@inai-dev/hono 1.0.0 → 1.2.0

package/README.md

@@ -0,0 +1,318 @@
+# @inai-dev/hono
+
+Full Hono integration for InAI Auth. Includes middleware with automatic token refresh, route protection with RBAC, and API route handlers. Works on Cloudflare Workers, Node.js, Deno, and Bun.
+
+## Installation
+
+```bash
+npm install @inai-dev/hono
+```
+
+## Environment Variables
+
+```env
+# Required — your publishable key
+INAI_PUBLISHABLE_KEY=pk_live_...
+```
+
+> On Cloudflare Workers, set this as a secret: `wrangler secret put INAI_PUBLISHABLE_KEY`
+
+## Setup
+
+### 1. Middleware
+
+```ts
+import { Hono } from "hono";
+import { inaiAuthMiddleware } from "@inai-dev/hono/middleware";
+
+const app = new Hono();
+
+app.use(
+  "*",
+  inaiAuthMiddleware({
+    publicRoutes: ["/", "/health", "/api/public/*"],
+  })
+);
+```
+
+The middleware automatically:
+- Skips public routes (supports glob patterns with `*`)
+- Validates the auth token from `Authorization: Bearer <token>` header or cookies
+- Refreshes expired tokens when a refresh token exists in cookies
+- Sets `c.get("inaiAuth")` with the `AuthObject` for authenticated requests
+- Returns `401 Unauthorized` for unauthenticated requests on protected routes
+- Uses `hono/cookie` for cookie parsing (works across all runtimes)
+
+#### Configuration
+
+```ts
+inaiAuthMiddleware({
+  // Auth mode: "app" (default) or "platform" (admin panel auth)
+  authMode: "app",
+
+  // Routes that don't require authentication
+  publicRoutes: ["/", "/health", "/api/public/*"],
+  // Or use a function for dynamic matching
+  publicRoutes: (path) => path.startsWith("/public"),
+
+  // Custom unauthorized handler (default: 401 JSON response)
+  onUnauthorized: (c) => c.json({ error: "Please sign in" }, 401),
+
+  // JWKS endpoint for ES256 token verification (optional)
+  jwksUrl: "https://apiauth.inai.dev/.well-known/jwks.json",
+
+  // InAIAuthClient config (optional if using env vars)
+  publishableKey: "pk_live_...",
+});
+```
+
+> All tokens are cryptographically verified using ES256 (ECDSA P-256). Public keys are fetched from the JWKS endpoint and cached for 5 minutes.
+
+### 2. Route Protection (RBAC)
+
+```ts
+import { requireAuth } from "@inai-dev/hono/middleware";
+
+// Require any authenticated user
+app.get("/api/profile", requireAuth(), (c) => {
+  const auth = c.get("inaiAuth");
+  return c.json({ userId: auth!.userId });
+});
+
+// Require a specific role
+app.get("/api/admin", requireAuth({ role: "admin" }), (c) => {
+  return c.json({ message: "Admin area" });
+});
+
+// Require a specific permission
+app.post("/api/posts", requireAuth({ permission: "posts:write" }), (c) => {
+  return c.json({ message: "Post created" });
+});
+```
+
+`requireAuth()` returns:
+- `401` if no auth or no `userId`
+- `403` if the user lacks the required `role` or `permission`
+
+### 3. API Routes
+
+```ts
+import { createAuthRoutes } from "@inai-dev/hono/api-routes";
+
+const authApp = createAuthRoutes({
+  publishableKey: "pk_live_...",
+});
+
+app.route("/api/auth", authApp);
+```
+
+Handles the following endpoints automatically:
+- `POST /api/auth/login` — User login (returns `{ user }` or `{ mfa_required, mfa_token }`)
+- `POST /api/auth/register` — User registration
+- `POST /api/auth/mfa-challenge` — MFA verification
+- `POST /api/auth/refresh` — Token refresh
+- `POST /api/auth/logout` — User logout
+
+### 4. Auth Helpers
+
+#### `getAuth(c)`
+
+Returns the `AuthObject` from the context (populated by middleware).
+
+```ts
+import { getAuth } from "@inai-dev/hono";
+
+app.get("/api/me", (c) => {
+  const auth = getAuth(c);
+  if (!auth?.userId) {
+    return c.json({ error: "Not signed in" }, 401);
+  }
+  return c.json({ userId: auth.userId, orgId: auth.orgId });
+});
+```
+
+**`AuthObject`:**
+
+| Property | Type | Description |
+|---|---|---|
+| `userId` | `string \| null` | Current user ID |
+| `tenantId` | `string \| null` | Tenant ID |
+| `appId` | `string \| null` | Application ID |
+| `envId` | `string \| null` | Environment ID |
+| `orgId` | `string \| null` | Active organization ID |
+| `orgRole` | `string \| null` | Role in active organization |
+| `sessionId` | `string \| null` | Session ID |
+| `getToken()` | `() => Promise<string \| null>` | Get the access token |
+| `has(params)` | `({ role?, permission? }) => boolean` | Check role or permission |
+
+#### Cookie Helpers
+
+For advanced use cases (custom auth flows, manual token management):
+
+```ts
+import { setAuthCookies, clearAuthCookies } from "@inai-dev/hono";
+
+// Set auth cookies after manual authentication
+setAuthCookies(c, tokens, user);
+
+// Clear all auth cookies (manual logout)
+clearAuthCookies(c);
+```
+
+#### Token Extraction
+
+```ts
+import { getTokenFromContext, getRefreshTokenFromContext } from "@inai-dev/hono";
+
+// Get access token from Authorization header or cookies
+const token = getTokenFromContext(c);
+
+// Get refresh token from cookies
+const refreshToken = getRefreshTokenFromContext(c);
+```
+
+## Full Example
+
+```ts
+import { Hono } from "hono";
+import {
+  inaiAuthMiddleware,
+  requireAuth,
+  createAuthRoutes,
+  getAuth,
+} from "@inai-dev/hono";
+
+const app = new Hono();
+
+// Auth middleware — protects all routes except public ones
+app.use(
+  "*",
+  inaiAuthMiddleware({
+    publicRoutes: ["/", "/health", "/api/auth/*"],
+  })
+);
+
+// Auth API routes
+app.route("/api/auth", createAuthRoutes());
+
+// Public route
+app.get("/health", (c) => c.json({ status: "ok" }));
+
+// Protected route — any authenticated user
+app.get("/api/profile", (c) => {
+  const auth = getAuth(c);
+  return c.json({ userId: auth?.userId });
+});
+
+// Protected route — admin only
+app.get("/api/admin", requireAuth({ role: "admin" }), (c) => {
+  return c.json({ message: "Welcome, admin" });
+});
+
+export default app;
+```
+
+### Cloudflare Workers
+
+```ts
+// src/index.ts
+import { Hono } from "hono";
+import { inaiAuthMiddleware, createAuthRoutes } from "@inai-dev/hono";
+
+const app = new Hono();
+
+app.use(
+  "*",
+  inaiAuthMiddleware({
+    publicRoutes: ["/", "/api/auth/*"],
+    publishableKey: "pk_live_...",
+  })
+);
+
+app.route("/api/auth", createAuthRoutes());
+
+app.get("/api/hello", (c) => {
+  const auth = c.get("inaiAuth");
+  return c.json({ userId: auth?.userId });
+});
+
+export default app;
+```
+
+## Platform Mode (Admin Panel)
+
+For admin panels that authenticate against the InAI platform API:
+
+```ts
+app.use(
+  "*",
+  inaiAuthMiddleware({
+    authMode: "platform",
+    publicRoutes: ["/login"],
+  })
+);
+```
+
+In platform mode, the middleware uses `platformRefresh()` and `platformGetMe()` for token refresh, targeting the platform auth endpoints instead of app user endpoints.
+
+## Type Augmentation
+
+The package augments Hono's `ContextVariableMap` so `c.get("inaiAuth")` is fully typed:
+
+```ts
+// Automatic — just import the package
+import "@inai-dev/hono";
+
+// c.get("inaiAuth") is typed as AuthObject | null
+```
+
+## Exports Reference
+
+### `@inai-dev/hono`
+
+| Export | Kind | Description |
+|---|---|---|
+| `inaiAuthMiddleware` | Function | Auth middleware |
+| `requireAuth` | Function | RBAC route guard |
+| `createAuthRoutes` | Function | Auth API route handlers |
+| `getAuth` | Function | Get `AuthObject` from context |
+| `setAuthCookies` | Function | Set auth cookies |
+| `clearAuthCookies` | Function | Clear auth cookies |
+| `getTokenFromContext` | Function | Extract access token |
+| `getRefreshTokenFromContext` | Function | Extract refresh token |
+
+### `@inai-dev/hono/middleware`
+
+| Export | Kind | Description |
+|---|---|---|
+| `inaiAuthMiddleware` | Function | Auth middleware with token refresh |
+| `requireAuth` | Function | RBAC route guard |
+
+### `@inai-dev/hono/api-routes`
+
+| Export | Kind | Description |
+|---|---|---|
+| `createAuthRoutes` | Function | Create Hono sub-app with auth endpoints |
+
+## Exported Types
+
+```ts
+import type {
+  InAIHonoMiddlewareConfig,
+  RequireAuthConfig,
+} from "@inai-dev/hono";
+
+import type {
+  AuthObject,
+  UserResource,
+  OrganizationResource,
+} from "@inai-dev/hono";
+```
+
+## Questions & Support
+
+Visit [https://inai.dev](https://inai.dev) for documentation, guides, and support.
+
+## License
+
+[MIT](../../LICENSE)

package/dist/index.cjs

@@ -118,6 +118,8 @@ function inaiAuthMiddleware(config = {}) {
   } = config;
   const client = new import_backend.InAIAuthClient(authClientConfig);
   const isPlatform = authMode === "platform";
+  const jwksUrl = authClientConfig.jwksUrl ?? `${authClientConfig.apiUrl ?? import_shared2.DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new import_shared2.JWKSClient(jwksUrl);
   const defaultUnauthorized = (c) => c.json({ error: "Unauthorized" }, 401);
   const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;
   return async function middleware(c, next) {
@@ -135,7 +137,7 @@ function inaiAuthMiddleware(config = {}) {
           const tokens = isPlatform ? await client.platformRefresh(refreshToken) : await client.refresh(refreshToken);
           const { data: user } = isPlatform ? await client.platformGetMe(tokens.access_token) : await client.getMe(tokens.access_token);
           setAuthCookies(c, tokens, user);
-          const authObj2 = (0, import_backend.buildAuthObjectFromToken)(tokens.access_token);
+          const authObj2 = await (0, import_backend.buildAuthObjectFromToken)(tokens.access_token, jwksClient);
           c.set("inaiAuth", authObj2);
           await next();
           return;
@@ -146,7 +148,7 @@ function inaiAuthMiddleware(config = {}) {
       }
       return handleUnauthorized(c);
     }
-    const authObj = (0, import_backend.buildAuthObjectFromToken)(token);
+    const authObj = await (0, import_backend.buildAuthObjectFromToken)(token, jwksClient);
     if (!authObj) {
       return handleUnauthorized(c);
     }

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/helpers.ts","../src/api-routes.ts"],"sourcesContent":["import \"./types\";\n\nexport { inaiAuthMiddleware, requireAuth } from \"./middleware\";\nexport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\n\nexport {\n  getAuth,\n  setAuthCookies,\n  clearAuthCookies,\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport { createAuthRoutes } from \"./api-routes\";\n\nexport type {\n  AuthObject,\n  UserResource,\n  OrganizationResource,\n} from \"@inai-dev/types\";\n","import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = buildAuthObjectFromToken(tokens.access_token);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = buildAuthObjectFromToken(token);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n","import { Hono } from \"hono\";\nimport type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  setAuthCookies,\n  clearAuthCookies,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const app = new Hono();\n  const client = new InAIAuthClient(config);\n\n  app.post(\"/login\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return c.json({ mfa_required: true, mfa_token: result.mfa_token });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/register\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return c.json({ needs_email_verification: true, user: result.user });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Registration failed\";\n      return c.json({ error: message }, 400);\n    }\n  });\n\n  app.post(\"/mfa-challenge\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"MFA verification failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/refresh\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (!refreshToken) {\n        clearAuthCookies(c);\n        return c.json({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ error: \"Refresh failed\" }, 401);\n    }\n  });\n\n  app.post(\"/logout\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    }\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEA,qBAAyD;AACzD,IAAAA,iBAA+B;;;ACF/B,oBAAmD;AAEnD,oBAKO;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,aAAO,yBAAU,GAAG,+BAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,aAAO,yBAAU,GAAG,kCAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,aAAS,gCAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,+BAAU,GAAG,iCAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,+BAAU,GAAG,oCAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,kCAAa,GAAG,iCAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,kCAAa,GAAG,oCAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,kCAAa,GAAG,mCAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,8BAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,aAAS,+BAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMC,eAAU,yCAAyB,OAAO,YAAY;AAC5D,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,cAAU,yCAAyB,KAAK;AAC9C,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;;;AErHA,kBAAqB;AAErB,IAAAC,kBAA+B;AAOxB,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,MAAM,IAAI,iBAAK;AACrB,QAAM,SAAS,IAAI,+BAAe,MAAM;AAExC,MAAI,KAAK,UAAU,OAAO,MAAM;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,EAAE,KAAK,EAAE,cAAc,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,MACnE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa,OAAO,MAAM;AACjC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,EAAE,KAAK,EAAE,0BAA0B,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,MACrE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,kBAAkB,OAAO,MAAM;AACtC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,CAAC,cAAc;AACjB,yBAAiB,CAAC;AAClB,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MAClD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IAChD;AAAA,EACF,CAAC;AAED,MAAI,KAAK,WAAW,OAAO,MAAM;AAC/B,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AACjD,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":["import_shared","authObj","import_backend"]}
+{"version":3,"sources":["../src/index.ts","../src/middleware.ts","../src/helpers.ts","../src/api-routes.ts"],"sourcesContent":["import \"./types\";\n\nexport { inaiAuthMiddleware, requireAuth } from \"./middleware\";\nexport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\n\nexport {\n  getAuth,\n  setAuthCookies,\n  clearAuthCookies,\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport { createAuthRoutes } from \"./api-routes\";\n\nexport type {\n  AuthObject,\n  UserResource,\n  OrganizationResource,\n} from \"@inai-dev/types\";\n","import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired, JWKSClient, DEFAULT_API_URL } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const jwksUrl = authClientConfig.jwksUrl\n    ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = await buildAuthObjectFromToken(tokens.access_token, jwksClient);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = await buildAuthObjectFromToken(token, jwksClient);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n","import { Hono } from \"hono\";\nimport type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  setAuthCookies,\n  clearAuthCookies,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const app = new Hono();\n  const client = new InAIAuthClient(config);\n\n  app.post(\"/login\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return c.json({ mfa_required: true, mfa_token: result.mfa_token });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/register\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return c.json({ needs_email_verification: true, user: result.user });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Registration failed\";\n      return c.json({ error: message }, 400);\n    }\n  });\n\n  app.post(\"/mfa-challenge\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"MFA verification failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/refresh\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (!refreshToken) {\n        clearAuthCookies(c);\n        return c.json({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ error: \"Refresh failed\" }, 401);\n    }\n  });\n\n  app.post(\"/logout\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    }\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEA,qBAAyD;AACzD,IAAAA,iBAA4D;;;ACF5D,oBAAmD;AAEnD,oBAKO;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,aAAO,yBAAU,GAAG,+BAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,aAAO,yBAAU,GAAG,kCAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,aAAS,gCAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,+BAAU,GAAG,iCAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,+BAAU,GAAG,oCAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,kCAAa,GAAG,iCAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,kCAAa,GAAG,oCAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,kCAAa,GAAG,mCAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,8BAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAU,iBAAiB,WAC5B,GAAG,iBAAiB,UAAU,8BAAe;AAClD,QAAM,aAAa,IAAI,0BAAW,OAAO;AAEzC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,aAAS,+BAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMC,WAAU,UAAM,yCAAyB,OAAO,cAAc,UAAU;AAC9E,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,UAAM,yCAAyB,OAAO,UAAU;AAChE,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;;;AEzHA,kBAAqB;AAErB,IAAAC,kBAA+B;AAOxB,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,MAAM,IAAI,iBAAK;AACrB,QAAM,SAAS,IAAI,+BAAe,MAAM;AAExC,MAAI,KAAK,UAAU,OAAO,MAAM;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,EAAE,KAAK,EAAE,cAAc,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,MACnE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa,OAAO,MAAM;AACjC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,EAAE,KAAK,EAAE,0BAA0B,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,MACrE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,kBAAkB,OAAO,MAAM;AACtC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,CAAC,cAAc;AACjB,yBAAiB,CAAC;AAClB,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MAClD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IAChD;AAAA,EACF,CAAC;AAED,MAAI,KAAK,WAAW,OAAO,MAAM;AAC/B,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AACjD,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":["import_shared","authObj","import_backend"]}

package/dist/index.js

@@ -1,6 +1,6 @@
 // src/middleware.ts
 import { InAIAuthClient, buildAuthObjectFromToken } from "@inai-dev/backend";
-import { isTokenExpired } from "@inai-dev/shared";
+import { isTokenExpired, JWKSClient, DEFAULT_API_URL } from "@inai-dev/shared";
 
 // src/helpers.ts
 import { getCookie, setCookie, deleteCookie } from "hono/cookie";
@@ -90,6 +90,8 @@ function inaiAuthMiddleware(config = {}) {
   } = config;
   const client = new InAIAuthClient(authClientConfig);
   const isPlatform = authMode === "platform";
+  const jwksUrl = authClientConfig.jwksUrl ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new JWKSClient(jwksUrl);
   const defaultUnauthorized = (c) => c.json({ error: "Unauthorized" }, 401);
   const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;
   return async function middleware(c, next) {
@@ -107,7 +109,7 @@ function inaiAuthMiddleware(config = {}) {
           const tokens = isPlatform ? await client.platformRefresh(refreshToken) : await client.refresh(refreshToken);
           const { data: user } = isPlatform ? await client.platformGetMe(tokens.access_token) : await client.getMe(tokens.access_token);
           setAuthCookies(c, tokens, user);
-          const authObj2 = buildAuthObjectFromToken(tokens.access_token);
+          const authObj2 = await buildAuthObjectFromToken(tokens.access_token, jwksClient);
           c.set("inaiAuth", authObj2);
           await next();
           return;
@@ -118,7 +120,7 @@ function inaiAuthMiddleware(config = {}) {
       }
       return handleUnauthorized(c);
     }
-    const authObj = buildAuthObjectFromToken(token);
+    const authObj = await buildAuthObjectFromToken(token, jwksClient);
     if (!authObj) {
       return handleUnauthorized(c);
     }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts","../src/api-routes.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = buildAuthObjectFromToken(tokens.access_token);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = buildAuthObjectFromToken(token);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n","import { Hono } from \"hono\";\nimport type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  setAuthCookies,\n  clearAuthCookies,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const app = new Hono();\n  const client = new InAIAuthClient(config);\n\n  app.post(\"/login\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return c.json({ mfa_required: true, mfa_token: result.mfa_token });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/register\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return c.json({ needs_email_verification: true, user: result.user });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Registration failed\";\n      return c.json({ error: message }, 400);\n    }\n  });\n\n  app.post(\"/mfa-challenge\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"MFA verification failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/refresh\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (!refreshToken) {\n        clearAuthCookies(c);\n        return c.json({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ error: \"Refresh failed\" }, 401);\n    }\n  });\n\n  app.post(\"/logout\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    }\n  });\n\n  return app;\n}\n"],"mappings":";AAEA,SAAS,gBAAgB,gCAAgC;AACzD,SAAS,sBAAsB;;;ACF/B,SAAS,WAAW,WAAW,oBAAoB;AAEnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,SAAO,UAAU,GAAG,iBAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,SAAO,UAAU,GAAG,oBAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,YAAU,GAAG,mBAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,YAAU,GAAG,sBAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,eAAa,GAAG,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,eAAa,GAAG,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,eAAa,GAAG,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,eAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMA,WAAU,yBAAyB,OAAO,YAAY;AAC5D,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,yBAAyB,KAAK;AAC9C,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;;;AErHA,SAAS,YAAY;AAErB,SAAS,kBAAAC,uBAAsB;AAOxB,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,MAAM,IAAI,KAAK;AACrB,QAAM,SAAS,IAAIC,gBAAe,MAAM;AAExC,MAAI,KAAK,UAAU,OAAO,MAAM;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,EAAE,KAAK,EAAE,cAAc,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,MACnE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa,OAAO,MAAM;AACjC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,EAAE,KAAK,EAAE,0BAA0B,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,MACrE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,kBAAkB,OAAO,MAAM;AACtC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,CAAC,cAAc;AACjB,yBAAiB,CAAC;AAClB,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MAClD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IAChD;AAAA,EACF,CAAC;AAED,MAAI,KAAK,WAAW,OAAO,MAAM;AAC/B,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AACjD,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":["authObj","InAIAuthClient","InAIAuthClient"]}
+{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts","../src/api-routes.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired, JWKSClient, DEFAULT_API_URL } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const jwksUrl = authClientConfig.jwksUrl\n    ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = await buildAuthObjectFromToken(tokens.access_token, jwksClient);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = await buildAuthObjectFromToken(token, jwksClient);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n","import { Hono } from \"hono\";\nimport type { InAIAuthConfig, TokenPair, UserResource, LoginResult } from \"@inai-dev/types\";\nimport { InAIAuthClient } from \"@inai-dev/backend\";\nimport {\n  setAuthCookies,\n  clearAuthCookies,\n  getRefreshTokenFromContext,\n} from \"./helpers\";\n\nexport function createAuthRoutes(config: InAIAuthConfig = {}) {\n  const app = new Hono();\n  const client = new InAIAuthClient(config);\n\n  app.post(\"/login\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.login({\n        email: body.email,\n        password: body.password,\n      }) as LoginResult & { user?: UserResource };\n\n      if (result.mfa_required) {\n        return c.json({ mfa_required: true, mfa_token: result.mfa_token });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Login failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/register\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const result = await client.register({\n        email: body.email,\n        password: body.password,\n        firstName: body.firstName,\n        lastName: body.lastName,\n      });\n\n      if (!result.access_token) {\n        return c.json({ needs_email_verification: true, user: result.user });\n      }\n\n      const tokens = result as unknown as TokenPair;\n      const user =\n        result.user ?? (await client.getMe(tokens.access_token)).data;\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Registration failed\";\n      return c.json({ error: message }, 400);\n    }\n  });\n\n  app.post(\"/mfa-challenge\", async (c) => {\n    try {\n      const body = await c.req.json<Record<string, string>>();\n      const tokens = await client.mfaChallenge({\n        mfa_token: body.mfa_token,\n        code: body.code,\n      });\n\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"MFA verification failed\";\n      return c.json({ error: message }, 401);\n    }\n  });\n\n  app.post(\"/refresh\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (!refreshToken) {\n        clearAuthCookies(c);\n        return c.json({ error: \"No refresh token\" }, 401);\n      }\n\n      const tokens = await client.refresh(refreshToken);\n      const { data: user } = await client.getMe(tokens.access_token);\n      setAuthCookies(c, tokens, user);\n\n      return c.json({ user });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ error: \"Refresh failed\" }, 401);\n    }\n  });\n\n  app.post(\"/logout\", async (c) => {\n    try {\n      const refreshToken = getRefreshTokenFromContext(c);\n      if (refreshToken) {\n        await client.logout(refreshToken).catch(() => {});\n      }\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    } catch {\n      clearAuthCookies(c);\n      return c.json({ success: true });\n    }\n  });\n\n  return app;\n}\n"],"mappings":";AAEA,SAAS,gBAAgB,gCAAgC;AACzD,SAAS,gBAAgB,YAAY,uBAAuB;;;ACF5D,SAAS,WAAW,WAAW,oBAAoB;AAEnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,SAAO,UAAU,GAAG,iBAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,SAAO,UAAU,GAAG,oBAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,YAAU,GAAG,mBAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,YAAU,GAAG,sBAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,eAAa,GAAG,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,eAAa,GAAG,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,eAAa,GAAG,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,eAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAU,iBAAiB,WAC5B,GAAG,iBAAiB,UAAU,eAAe;AAClD,QAAM,aAAa,IAAI,WAAW,OAAO;AAEzC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMA,WAAU,MAAM,yBAAyB,OAAO,cAAc,UAAU;AAC9E,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,MAAM,yBAAyB,OAAO,UAAU;AAChE,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;;;AEzHA,SAAS,YAAY;AAErB,SAAS,kBAAAC,uBAAsB;AAOxB,SAAS,iBAAiB,SAAyB,CAAC,GAAG;AAC5D,QAAM,MAAM,IAAI,KAAK;AACrB,QAAM,SAAS,IAAIC,gBAAe,MAAM;AAExC,MAAI,KAAK,UAAU,OAAO,MAAM;AAC9B,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,OAAO,cAAc;AACvB,eAAO,EAAE,KAAK,EAAE,cAAc,MAAM,WAAW,OAAO,UAAU,CAAC;AAAA,MACnE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa,OAAO,MAAM;AACjC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,SAAS;AAAA,QACnC,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,WAAW,KAAK;AAAA,QAChB,UAAU,KAAK;AAAA,MACjB,CAAC;AAED,UAAI,CAAC,OAAO,cAAc;AACxB,eAAO,EAAE,KAAK,EAAE,0BAA0B,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,MACrE;AAEA,YAAM,SAAS;AACf,YAAM,OACJ,OAAO,SAAS,MAAM,OAAO,MAAM,OAAO,YAAY,GAAG;AAC3D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,kBAAkB,OAAO,MAAM;AACtC,QAAI;AACF,YAAM,OAAO,MAAM,EAAE,IAAI,KAA6B;AACtD,YAAM,SAAS,MAAM,OAAO,aAAa;AAAA,QACvC,WAAW,KAAK;AAAA,QAChB,MAAM,KAAK;AAAA,MACb,CAAC;AAED,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,SAAS,KAAK;AACZ,YAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,aAAO,EAAE,KAAK,EAAE,OAAO,QAAQ,GAAG,GAAG;AAAA,IACvC;AAAA,EACF,CAAC;AAED,MAAI,KAAK,YAAY,OAAO,MAAM;AAChC,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,CAAC,cAAc;AACjB,yBAAiB,CAAC;AAClB,eAAO,EAAE,KAAK,EAAE,OAAO,mBAAmB,GAAG,GAAG;AAAA,MAClD;AAEA,YAAM,SAAS,MAAM,OAAO,QAAQ,YAAY;AAChD,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,OAAO,MAAM,OAAO,YAAY;AAC7D,qBAAe,GAAG,QAAQ,IAAI;AAE9B,aAAO,EAAE,KAAK,EAAE,KAAK,CAAC;AAAA,IACxB,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG;AAAA,IAChD;AAAA,EACF,CAAC;AAED,MAAI,KAAK,WAAW,OAAO,MAAM;AAC/B,QAAI;AACF,YAAM,eAAe,2BAA2B,CAAC;AACjD,UAAI,cAAc;AAChB,cAAM,OAAO,OAAO,YAAY,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAClD;AACA,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC,QAAQ;AACN,uBAAiB,CAAC;AAClB,aAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;AAAA,IACjC;AAAA,EACF,CAAC;AAED,SAAO;AACT;","names":["authObj","InAIAuthClient","InAIAuthClient"]}

package/dist/middleware.cjs

@@ -110,6 +110,8 @@ function inaiAuthMiddleware(config = {}) {
   } = config;
   const client = new import_backend.InAIAuthClient(authClientConfig);
   const isPlatform = authMode === "platform";
+  const jwksUrl = authClientConfig.jwksUrl ?? `${authClientConfig.apiUrl ?? import_shared2.DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new import_shared2.JWKSClient(jwksUrl);
   const defaultUnauthorized = (c) => c.json({ error: "Unauthorized" }, 401);
   const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;
   return async function middleware(c, next) {
@@ -127,7 +129,7 @@ function inaiAuthMiddleware(config = {}) {
           const tokens = isPlatform ? await client.platformRefresh(refreshToken) : await client.refresh(refreshToken);
           const { data: user } = isPlatform ? await client.platformGetMe(tokens.access_token) : await client.getMe(tokens.access_token);
           setAuthCookies(c, tokens, user);
-          const authObj2 = (0, import_backend.buildAuthObjectFromToken)(tokens.access_token);
+          const authObj2 = await (0, import_backend.buildAuthObjectFromToken)(tokens.access_token, jwksClient);
           c.set("inaiAuth", authObj2);
           await next();
           return;
@@ -138,7 +140,7 @@ function inaiAuthMiddleware(config = {}) {
       }
       return handleUnauthorized(c);
     }
-    const authObj = (0, import_backend.buildAuthObjectFromToken)(token);
+    const authObj = await (0, import_backend.buildAuthObjectFromToken)(token, jwksClient);
     if (!authObj) {
       return handleUnauthorized(c);
     }

package/dist/middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = buildAuthObjectFromToken(tokens.access_token);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = buildAuthObjectFromToken(token);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAyD;AACzD,IAAAA,iBAA+B;;;ACF/B,oBAAmD;AAEnD,oBAKO;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,aAAO,yBAAU,GAAG,+BAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,aAAO,yBAAU,GAAG,kCAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,aAAS,gCAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,+BAAU,GAAG,iCAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,+BAAU,GAAG,oCAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,kCAAa,GAAG,iCAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,kCAAa,GAAG,oCAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,kCAAa,GAAG,mCAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,8BAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,aAAS,+BAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMC,eAAU,yCAAyB,OAAO,YAAY;AAC5D,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,cAAU,yCAAyB,KAAK;AAC9C,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":["import_shared","authObj"]}
+{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired, JWKSClient, DEFAULT_API_URL } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const jwksUrl = authClientConfig.jwksUrl\n    ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = await buildAuthObjectFromToken(tokens.access_token, jwksClient);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = await buildAuthObjectFromToken(token, jwksClient);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAAyD;AACzD,IAAAA,iBAA4D;;;ACF5D,oBAAmD;AAEnD,oBAKO;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,aAAO,yBAAU,GAAG,+BAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,aAAO,yBAAU,GAAG,kCAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,aAAS,gCAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,+BAAU,GAAG,iCAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,+BAAU,GAAG,oCAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,kCAAa,GAAG,iCAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,kCAAa,GAAG,oCAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,kCAAa,GAAG,mCAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,8BAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAU,iBAAiB,WAC5B,GAAG,iBAAiB,UAAU,8BAAe;AAClD,QAAM,aAAa,IAAI,0BAAW,OAAO;AAEzC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,aAAS,+BAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMC,WAAU,UAAM,yCAAyB,OAAO,cAAc,UAAU;AAC9E,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,UAAM,yCAAyB,OAAO,UAAU;AAChE,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":["import_shared","authObj"]}

package/dist/middleware.js

@@ -1,6 +1,6 @@
 // src/middleware.ts
 import { InAIAuthClient, buildAuthObjectFromToken } from "@inai-dev/backend";
-import { isTokenExpired } from "@inai-dev/shared";
+import { isTokenExpired, JWKSClient, DEFAULT_API_URL } from "@inai-dev/shared";
 
 // src/helpers.ts
 import { getCookie, setCookie, deleteCookie } from "hono/cookie";
@@ -90,6 +90,8 @@ function inaiAuthMiddleware(config = {}) {
   } = config;
   const client = new InAIAuthClient(authClientConfig);
   const isPlatform = authMode === "platform";
+  const jwksUrl = authClientConfig.jwksUrl ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;
+  const jwksClient = new JWKSClient(jwksUrl);
   const defaultUnauthorized = (c) => c.json({ error: "Unauthorized" }, 401);
   const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;
   return async function middleware(c, next) {
@@ -107,7 +109,7 @@ function inaiAuthMiddleware(config = {}) {
           const tokens = isPlatform ? await client.platformRefresh(refreshToken) : await client.refresh(refreshToken);
           const { data: user } = isPlatform ? await client.platformGetMe(tokens.access_token) : await client.getMe(tokens.access_token);
           setAuthCookies(c, tokens, user);
-          const authObj2 = buildAuthObjectFromToken(tokens.access_token);
+          const authObj2 = await buildAuthObjectFromToken(tokens.access_token, jwksClient);
           c.set("inaiAuth", authObj2);
           await next();
           return;
@@ -118,7 +120,7 @@ function inaiAuthMiddleware(config = {}) {
       }
       return handleUnauthorized(c);
     }
-    const authObj = buildAuthObjectFromToken(token);
+    const authObj = await buildAuthObjectFromToken(token, jwksClient);
     if (!authObj) {
       return handleUnauthorized(c);
     }

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = buildAuthObjectFromToken(tokens.access_token);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = buildAuthObjectFromToken(token);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n"],"mappings":";AAEA,SAAS,gBAAgB,gCAAgC;AACzD,SAAS,sBAAsB;;;ACF/B,SAAS,WAAW,WAAW,oBAAoB;AAEnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,SAAO,UAAU,GAAG,iBAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,SAAO,UAAU,GAAG,oBAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,YAAU,GAAG,mBAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,YAAU,GAAG,sBAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,eAAa,GAAG,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,eAAa,GAAG,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,eAAa,GAAG,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,eAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMA,WAAU,yBAAyB,OAAO,YAAY;AAC5D,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,yBAAyB,KAAK;AAC9C,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":["authObj"]}
+{"version":3,"sources":["../src/middleware.ts","../src/helpers.ts"],"sourcesContent":["import type { MiddlewareHandler } from \"hono\";\nimport type { InAIAuthConfig } from \"@inai-dev/types\";\nimport { InAIAuthClient, buildAuthObjectFromToken } from \"@inai-dev/backend\";\nimport { isTokenExpired, JWKSClient, DEFAULT_API_URL } from \"@inai-dev/shared\";\nimport type { InAIHonoMiddlewareConfig, RequireAuthConfig } from \"./types\";\nimport {\n  getTokenFromContext,\n  getRefreshTokenFromContext,\n  setAuthCookies,\n  clearAuthCookies,\n  getAuth,\n} from \"./helpers\";\n\nfunction matchesRoute(pathname: string, patterns: string[]): boolean {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return pathname.startsWith(pattern.slice(0, -1));\n    }\n    return pathname === pattern;\n  });\n}\n\nfunction isPublicRoute(\n  path: string,\n  publicRoutes: string[] | ((path: string) => boolean),\n): boolean {\n  if (typeof publicRoutes === \"function\") return publicRoutes(path);\n  return matchesRoute(path, publicRoutes);\n}\n\nexport function inaiAuthMiddleware(\n  config: InAIHonoMiddlewareConfig & InAIAuthConfig = {},\n): MiddlewareHandler {\n  const {\n    authMode = \"app\",\n    publicRoutes = [],\n    onUnauthorized,\n    ...authClientConfig\n  } = config;\n\n  const client = new InAIAuthClient(authClientConfig);\n  const isPlatform = authMode === \"platform\";\n\n  const jwksUrl = authClientConfig.jwksUrl\n    ?? `${authClientConfig.apiUrl ?? DEFAULT_API_URL}/.well-known/jwks.json`;\n  const jwksClient = new JWKSClient(jwksUrl);\n\n  const defaultUnauthorized = (c: Parameters<MiddlewareHandler>[0]) =>\n    c.json({ error: \"Unauthorized\" }, 401);\n\n  const handleUnauthorized = onUnauthorized ?? defaultUnauthorized;\n\n  return async function middleware(c, next) {\n    const path = new URL(c.req.url).pathname;\n\n    if (isPublicRoute(path, publicRoutes)) {\n      c.set(\"inaiAuth\", null);\n      await next();\n      return;\n    }\n\n    const token = getTokenFromContext(c);\n\n    if (!token || isTokenExpired(token)) {\n      const refreshToken = getRefreshTokenFromContext(c);\n\n      if (refreshToken) {\n        try {\n          const tokens = isPlatform\n            ? await client.platformRefresh(refreshToken)\n            : await client.refresh(refreshToken);\n          const { data: user } = isPlatform\n            ? await client.platformGetMe(tokens.access_token)\n            : await client.getMe(tokens.access_token);\n          setAuthCookies(c, tokens, user);\n\n          const authObj = await buildAuthObjectFromToken(tokens.access_token, jwksClient);\n          c.set(\"inaiAuth\", authObj);\n\n          await next();\n          return;\n        } catch {\n          clearAuthCookies(c);\n          return handleUnauthorized(c);\n        }\n      }\n\n      return handleUnauthorized(c);\n    }\n\n    const authObj = await buildAuthObjectFromToken(token, jwksClient);\n    if (!authObj) {\n      return handleUnauthorized(c);\n    }\n\n    c.set(\"inaiAuth\", authObj);\n    await next();\n  };\n}\n\nexport function requireAuth(config: RequireAuthConfig = {}): MiddlewareHandler {\n  return async function middleware(c, next) {\n    const auth = getAuth(c);\n\n    if (!auth?.userId) {\n      return c.json({ error: \"Unauthorized\" }, 401);\n    }\n\n    if (config.role || config.permission) {\n      const hasAccess = auth.has({\n        role: config.role,\n        permission: config.permission,\n      });\n\n      if (!hasAccess) {\n        return c.json({ error: \"Forbidden\" }, 403);\n      }\n    }\n\n    await next();\n  };\n}\n","import type { Context } from \"hono\";\nimport { getCookie, setCookie, deleteCookie } from \"hono/cookie\";\nimport type { AuthObject, TokenPair, UserResource, PlatformUserResource } from \"@inai-dev/types\";\nimport {\n  COOKIE_AUTH_TOKEN,\n  COOKIE_REFRESH_TOKEN,\n  COOKIE_AUTH_SESSION,\n  decodeJWTPayload,\n} from \"@inai-dev/shared\";\n\nexport function getAuth(c: Context): AuthObject | null {\n  return c.get(\"inaiAuth\") ?? null;\n}\n\nexport function getTokenFromContext(c: Context): string | null {\n  const authHeader = c.req.header(\"Authorization\");\n  if (authHeader?.startsWith(\"Bearer \")) {\n    return authHeader.slice(7);\n  }\n\n  return getCookie(c, COOKIE_AUTH_TOKEN) ?? null;\n}\n\nexport function getRefreshTokenFromContext(c: Context): string | null {\n  return getCookie(c, COOKIE_REFRESH_TOKEN) ?? null;\n}\n\nexport function setAuthCookies(\n  c: Context,\n  tokens: TokenPair,\n  user: UserResource | PlatformUserResource,\n): void {\n  const isProduction =\n    typeof process !== \"undefined\" && process.env?.NODE_ENV === \"production\";\n  const claims = decodeJWTPayload(tokens.access_token);\n  const expiresAt = claims\n    ? new Date(claims.exp * 1000).toISOString()\n    : new Date(Date.now() + tokens.expires_in * 1000).toISOString();\n\n  setCookie(c, COOKIE_AUTH_TOKEN, tokens.access_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Lax\",\n    path: \"/\",\n    maxAge: tokens.expires_in,\n  });\n\n  setCookie(c, COOKIE_REFRESH_TOKEN, tokens.refresh_token, {\n    httpOnly: true,\n    secure: isProduction,\n    sameSite: \"Strict\",\n    path: \"/api/auth\",\n    maxAge: 7 * 24 * 60 * 60,\n  });\n\n  setCookie(\n    c,\n    COOKIE_AUTH_SESSION,\n    JSON.stringify({\n      user,\n      expiresAt,\n      permissions: claims?.permissions ?? [],\n      orgId: claims?.org_id,\n      orgRole: claims?.org_role,\n      appId: claims?.app_id,\n      envId: claims?.env_id,\n    }),\n    {\n      httpOnly: false,\n      secure: isProduction,\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: tokens.expires_in,\n    },\n  );\n}\n\nexport function clearAuthCookies(c: Context): void {\n  deleteCookie(c, COOKIE_AUTH_TOKEN, { path: \"/\" });\n  deleteCookie(c, COOKIE_REFRESH_TOKEN, { path: \"/api/auth\" });\n  deleteCookie(c, COOKIE_AUTH_SESSION, { path: \"/\" });\n}\n"],"mappings":";AAEA,SAAS,gBAAgB,gCAAgC;AACzD,SAAS,gBAAgB,YAAY,uBAAuB;;;ACF5D,SAAS,WAAW,WAAW,oBAAoB;AAEnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,SAAS,QAAQ,GAA+B;AACrD,SAAO,EAAE,IAAI,UAAU,KAAK;AAC9B;AAEO,SAAS,oBAAoB,GAA2B;AAC7D,QAAM,aAAa,EAAE,IAAI,OAAO,eAAe;AAC/C,MAAI,YAAY,WAAW,SAAS,GAAG;AACrC,WAAO,WAAW,MAAM,CAAC;AAAA,EAC3B;AAEA,SAAO,UAAU,GAAG,iBAAiB,KAAK;AAC5C;AAEO,SAAS,2BAA2B,GAA2B;AACpE,SAAO,UAAU,GAAG,oBAAoB,KAAK;AAC/C;AAEO,SAAS,eACd,GACA,QACA,MACM;AACN,QAAM,eACJ,OAAO,YAAY,eAAe,QAAQ,KAAK,aAAa;AAC9D,QAAM,SAAS,iBAAiB,OAAO,YAAY;AACnD,QAAM,YAAY,SACd,IAAI,KAAK,OAAO,MAAM,GAAI,EAAE,YAAY,IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,aAAa,GAAI,EAAE,YAAY;AAEhE,YAAU,GAAG,mBAAmB,OAAO,cAAc;AAAA,IACnD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,EACjB,CAAC;AAED,YAAU,GAAG,sBAAsB,OAAO,eAAe;AAAA,IACvD,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ,IAAI,KAAK,KAAK;AAAA,EACxB,CAAC;AAED;AAAA,IACE;AAAA,IACA;AAAA,IACA,KAAK,UAAU;AAAA,MACb;AAAA,MACA;AAAA,MACA,aAAa,QAAQ,eAAe,CAAC;AAAA,MACrC,OAAO,QAAQ;AAAA,MACf,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,IACD;AAAA,MACE,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ,OAAO;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,GAAkB;AACjD,eAAa,GAAG,mBAAmB,EAAE,MAAM,IAAI,CAAC;AAChD,eAAa,GAAG,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC3D,eAAa,GAAG,qBAAqB,EAAE,MAAM,IAAI,CAAC;AACpD;;;ADpEA,SAAS,aAAa,UAAkB,UAA6B;AACnE,SAAO,SAAS,KAAK,CAAC,YAAY;AAChC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,aAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;AAAA,IACjD;AACA,WAAO,aAAa;AAAA,EACtB,CAAC;AACH;AAEA,SAAS,cACP,MACA,cACS;AACT,MAAI,OAAO,iBAAiB,WAAY,QAAO,aAAa,IAAI;AAChE,SAAO,aAAa,MAAM,YAAY;AACxC;AAEO,SAAS,mBACd,SAAoD,CAAC,GAClC;AACnB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,SAAS,IAAI,eAAe,gBAAgB;AAClD,QAAM,aAAa,aAAa;AAEhC,QAAM,UAAU,iBAAiB,WAC5B,GAAG,iBAAiB,UAAU,eAAe;AAClD,QAAM,aAAa,IAAI,WAAW,OAAO;AAEzC,QAAM,sBAAsB,CAAC,MAC3B,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAEvC,QAAM,qBAAqB,kBAAkB;AAE7C,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AAEhC,QAAI,cAAc,MAAM,YAAY,GAAG;AACrC,QAAE,IAAI,YAAY,IAAI;AACtB,YAAM,KAAK;AACX;AAAA,IACF;AAEA,UAAM,QAAQ,oBAAoB,CAAC;AAEnC,QAAI,CAAC,SAAS,eAAe,KAAK,GAAG;AACnC,YAAM,eAAe,2BAA2B,CAAC;AAEjD,UAAI,cAAc;AAChB,YAAI;AACF,gBAAM,SAAS,aACX,MAAM,OAAO,gBAAgB,YAAY,IACzC,MAAM,OAAO,QAAQ,YAAY;AACrC,gBAAM,EAAE,MAAM,KAAK,IAAI,aACnB,MAAM,OAAO,cAAc,OAAO,YAAY,IAC9C,MAAM,OAAO,MAAM,OAAO,YAAY;AAC1C,yBAAe,GAAG,QAAQ,IAAI;AAE9B,gBAAMA,WAAU,MAAM,yBAAyB,OAAO,cAAc,UAAU;AAC9E,YAAE,IAAI,YAAYA,QAAO;AAEzB,gBAAM,KAAK;AACX;AAAA,QACF,QAAQ;AACN,2BAAiB,CAAC;AAClB,iBAAO,mBAAmB,CAAC;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,UAAM,UAAU,MAAM,yBAAyB,OAAO,UAAU;AAChE,QAAI,CAAC,SAAS;AACZ,aAAO,mBAAmB,CAAC;AAAA,IAC7B;AAEA,MAAE,IAAI,YAAY,OAAO;AACzB,UAAM,KAAK;AAAA,EACb;AACF;AAEO,SAAS,YAAY,SAA4B,CAAC,GAAsB;AAC7E,SAAO,eAAe,WAAW,GAAG,MAAM;AACxC,UAAM,OAAO,QAAQ,CAAC;AAEtB,QAAI,CAAC,MAAM,QAAQ;AACjB,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC9C;AAEA,QAAI,OAAO,QAAQ,OAAO,YAAY;AACpC,YAAM,YAAY,KAAK,IAAI;AAAA,QACzB,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,eAAO,EAAE,KAAK,EAAE,OAAO,YAAY,GAAG,GAAG;AAAA,MAC3C;AAAA,IACF;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":["authObj"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inai-dev/hono",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Hono integration for InAI Auth SDK",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -35,9 +35,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@inai-dev/types": "^1.1.0",
-    "@inai-dev/shared": "^1.1.0",
-    "@inai-dev/backend": "^1.2.0"
+    "@inai-dev/types": "^1.3.0",
+    "@inai-dev/shared": "^1.3.0",
+    "@inai-dev/backend": "^1.4.0"
   },
   "peerDependencies": {
     "hono": ">=4.0.0"