@lunora/cloudflare-access 1.0.0-alpha.2 → 1.0.0-alpha.21

package/LICENSE.md

@@ -103,3 +103,129 @@ Unless required by applicable law or agreed to in writing, software distributed
 under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 CONDITIONS OF ANY KIND, either express or implied. See the License for the
 specific language governing permissions and limitations under the License.
+
+<!-- DEPENDENCIES -->
+<!-- /DEPENDENCIES -->
+
+<!-- TYPE_DEPENDENCIES -->
+
+# Licenses of bundled types
+The published @lunora/cloudflare-access artifact additionally contains code with the following licenses:
+FSL-1.1-Apache-2.0
+
+# Bundled types:
+## @lunora/server
+License: FSL-1.1-Apache-2.0
+By: Daniel Bannert
+Repository: git+https://github.com/anolilab/lunora.git
+
+> # Functional Source License, Version 1.1, Apache 2.0 Future License
+>
+> ## Abbreviation
+>
+> FSL-1.1-Apache-2.0
+>
+> ## Notice
+>
+> Copyright 2026 anolilab and contributors
+>
+> ## Terms and Conditions
+>
+> ### Licensor ("We")
+>
+> The party offering the Software under these Terms and Conditions.
+>
+> ### The Software
+>
+> The "Software" is each version of the software that we make available under
+> these Terms and Conditions, as indicated by our inclusion of these Terms and
+> Conditions with the Software.
+>
+> ### License Grant
+>
+> Subject to your compliance with this License Grant and the Patents,
+> Redistribution and Trademark clauses below, we hereby grant you the right to
+> use, copy, modify, create derivative works, publicly perform, publicly display
+> and redistribute the Software for any Permitted Purpose identified below.
+>
+> ### Permitted Purpose
+>
+> A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+> means making the Software available to others in a commercial product or service
+> that:
+>
+> 1. substitutes for the Software;
+>
+> 2. substitutes for any other product or service we offer using the Software that
+>    exists as of the date we make the Software available; or
+>
+> 3. offers the same or substantially similar functionality as the Software.
+>
+> Permitted Purposes specifically include using the Software:
+>
+> 1. for your internal use and access;
+>
+> 2. for non-commercial education;
+>
+> 3. for non-commercial research; and
+>
+> 4. in connection with professional services that you provide to a licensee using
+>    the Software in accordance with these Terms and Conditions.
+>
+> ### Patents
+>
+> To the extent your use for a Permitted Purpose would necessarily infringe our
+> patents, the license grant above includes a license under our patents. If you
+> make a claim against any party that the Software infringes or contributes to the
+> infringement of any patent, then your patent license to the Software ends
+> immediately.
+>
+> ### Redistribution
+>
+> The Terms and Conditions apply to all copies, modifications and derivatives of
+> the Software.
+>
+> If you redistribute any copies, modifications or derivatives of the Software,
+> you must include a copy of or a link to these Terms and Conditions and not
+> remove any copyright notices provided in or with the Software.
+>
+> ### Disclaimer
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+> PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+>
+> IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+> SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN
+> IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+>
+> ### Trademarks
+>
+> Except for displaying the License Details and identifying us as the origin of
+> the Software, you have no right under these Terms and Conditions to use our
+> trademarks, trade names, service marks or product names.
+>
+> ## Grant of Future License
+>
+> We hereby irrevocably grant you an additional license to use the Software under
+> the Apache License, Version 2.0 that is effective on the second anniversary of
+> the date we make the Software available. On or after that date, you may use the
+> Software under the Apache License, Version 2.0, in which case the following will
+> apply:
+>
+> Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+> this file except in compliance with the License.
+>
+> You may obtain a copy of the License at
+>
+> http://www.apache.org/licenses/LICENSE-2.0
+>
+> Unless required by applicable law or agreed to in writing, software distributed
+> under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+> CONDITIONS OF ANY KIND, either express or implied. See the License for the
+> specific language governing permissions and limitations under the License.
+>
+> <!-- DEPENDENCIES -->
+> <!-- /DEPENDENCIES -->
+
+<!-- /TYPE_DEPENDENCIES -->

package/dist/admin.mjs

@@ -1,8 +1,11 @@
-import { verifyRequest } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+import { assertVerifyOptions, verifyRequest } from './packem_shared/accessIssuer-C69kkiYc.mjs';
 
-const accessAdminGate = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? false : options.isAdmin(claims);
+const accessAdminGate = (options) => {
+  assertVerifyOptions(options);
+  return async (request) => {
+    const claims = await verifyRequest(request, options);
+    return claims === void 0 ? false : options.isAdmin(claims);
+  };
 };
 
 export { accessAdminGate };

package/dist/context.d.mts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.mjs";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.d.ts

@@ -1,5 +1,6 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
 import { A as AccessClaims } from "./packem_shared/types.d-BO8d74KI.js";
+import '@lunora/errors';
 import 'jose';
 /**
 * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.mjs

@@ -1,4 +1,5 @@
-const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
+
 const stringClaim = (value) => typeof value === "string" ? value : void 0;
 const ANONYMOUS_FACADE = {
   authenticated: false,
@@ -15,7 +16,7 @@ const facadeFor = (identity, userId) => {
     return ANONYMOUS_FACADE;
   }
   const claims = raw;
-  const groups = stringList(identity["groups"] ?? claims.groups);
+  const groups = readIdentityGroups(identity) ?? [];
   return {
     authenticated: true,
     claims,

package/dist/index.d.mts

@@ -40,6 +40,17 @@ declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => Res
 * bare name with no dot is expanded to the `cloudflareaccess.com` host.
 */
 declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Eagerly validate the static, construction-time verify options so a misconfigured
+* deployment fails fast at factory build time instead of degrading to
+* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
+* call this once when built: `teamDomain` must resolve to a valid Access issuer
+* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
+* then covers only genuine token-verification failures, not config mistakes — a
+* broken deployment throws here at startup rather than resolving every caller to
+* anonymous with zero signal.
+*/
+
 /**
 * Verify a Cloudflare Access JWT and return its claims.
 *

package/dist/index.d.ts

@@ -40,6 +40,17 @@ declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => Res
 * bare name with no dot is expanded to the `cloudflareaccess.com` host.
 */
 declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Eagerly validate the static, construction-time verify options so a misconfigured
+* deployment fails fast at factory build time instead of degrading to
+* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
+* call this once when built: `teamDomain` must resolve to a valid Access issuer
+* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
+* then covers only genuine token-verification failures, not config mistakes — a
+* broken deployment throws here at startup rather than resolving every caller to
+* anonymous with zero signal.
+*/
+
 /**
 * Verify a Cloudflare Access JWT and return its claims.
 *

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-C_7T5dDj.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-DhKaNoyU.mjs';
+export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BlVswT75.mjs';
+export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-C69kkiYc.mjs';

package/dist/packem_shared/{accessIssuer-DhKaNoyU.mjs → accessIssuer-C69kkiYc.mjs}

@@ -1,3 +1,4 @@
+import { LunoraError } from '@lunora/errors';
 import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 const DEFAULT_HEADER = "cf-access-jwt-assertion";
@@ -36,7 +37,7 @@ const stripTrailingSlashes = (value) => {
 const accessIssuer = (teamDomain) => {
   const trimmed = stripTrailingSlashes(teamDomain.trim().replace(SCHEME_PREFIX, ""));
   if (trimmed.length === 0) {
-    throw new Error('@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
+    throw new LunoraError("INTERNAL", '@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
   }
   const candidate = trimmed.includes(".") ? `https://${trimmed}` : `https://${trimmed}.cloudflareaccess.com`;
   const host = new URL(candidate).host.toLowerCase();
@@ -51,16 +52,23 @@ const remoteJwks = (issuer) => {
   }
   return getter;
 };
-const verifyAccessJwt = async (token, options) => {
-  const issuer = accessIssuer(options.teamDomain);
-  const audiences = (Array.isArray(options.aud) ? options.aud : [options.aud]).filter(
-    (entry) => typeof entry === "string" && entry.length > 0
-  );
+const normalizeAudiences = (aud) => {
+  const audiences = (Array.isArray(aud) ? aud : [aud]).filter((entry) => typeof entry === "string" && entry.length > 0);
   if (audiences.length === 0) {
-    throw new Error(
+    throw new LunoraError(
+      "INTERNAL",
       "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
     );
   }
+  return audiences;
+};
+const assertVerifyOptions = (options) => {
+  accessIssuer(options.teamDomain);
+  normalizeAudiences(options.aud);
+};
+const verifyAccessJwt = async (token, options) => {
+  const issuer = accessIssuer(options.teamDomain);
+  const audiences = normalizeAudiences(options.aud);
   const keySet = options.keySet ?? remoteJwks(issuer);
   const { payload } = await jwtVerify(token, keySet, {
     algorithms: ["RS256"],
@@ -88,4 +96,4 @@ const verifyRequest = async (request, options) => {
   }
 };
 
-export { accessIssuer, verifyAccessJwt, verifyRequest };
+export { accessIssuer, assertVerifyOptions, verifyAccessJwt, verifyRequest };

package/dist/packem_shared/{composeResolvers-C_7T5dDj.mjs → composeResolvers-BlVswT75.mjs}

@@ -1,13 +1,11 @@
-import { verifyRequest } from './accessIssuer-DhKaNoyU.mjs';
+import { assertVerifyOptions, verifyRequest } from './accessIssuer-C69kkiYc.mjs';
 
 const ANONYMOUS = null;
-const deriveUserId = (claims) => {
-  const sub = typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : void 0;
-  return sub ?? claims.email ?? claims.common_name;
-};
+const nonEmpty = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+const deriveUserId = (claims) => nonEmpty(claims.sub) ?? nonEmpty(claims.email) ?? nonEmpty(claims.common_name);
 const toIdentity = (claims, mapClaims) => {
   const overrides = mapClaims?.(claims) ?? {};
-  const userId = typeof overrides.userId === "string" ? overrides.userId : deriveUserId(claims);
+  const userId = nonEmpty(overrides.userId) ?? deriveUserId(claims);
   if (userId === void 0) {
     return ANONYMOUS;
   }
@@ -21,9 +19,12 @@ const toIdentity = (claims, mapClaims) => {
     userId
   };
 };
-const createAccessResolver = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
+const createAccessResolver = (options) => {
+  assertVerifyOptions(options);
+  return async (request) => {
+    const claims = await verifyRequest(request, options);
+    return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
+  };
 };
 const composeResolvers = (...resolvers) => async (request, env) => {
   for (const resolve of resolvers) {

package/dist/packem_shared/identity-groups-CONuLY61.mjs

@@ -0,0 +1,8 @@
+const readIdentityGroups = (identity) => {
+  const { access } = identity;
+  const nested = typeof access === "object" && access !== null ? access.groups : void 0;
+  const groups = identity["groups"] ?? nested;
+  return Array.isArray(groups) ? groups.filter((group) => typeof group === "string") : void 0;
+};
+
+export { readIdentityGroups as r };

package/dist/packem_shared/{index.d-C7lOF4ZA.d.mts → index.d-ByAnpUzP.d.mts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/packem_shared/{index.d-C7lOF4ZA.d.ts → index.d-ByAnpUzP.d.ts}

@@ -1,3 +1,4 @@
+import '@lunora/errors';
 /**
 * `next()` advances the middleware chain. Called with no argument it forwards
 * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/roles.d.mts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.mjs";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.mjs";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.d.ts

@@ -1,4 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-C7lOF4ZA.js";
+import { M as Middleware } from "./packem_shared/index.d-ByAnpUzP.js";
+import '@lunora/errors';
 /**
 * The slice of context {@link accessRoles} reads and augments: the `auth` facade
 * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.mjs

@@ -1,9 +1,5 @@
-const defaultReadGroups = (identity) => {
-  const { access } = identity;
-  const nested = typeof access === "object" && access !== null ? access.groups : void 0;
-  const groups = identity["groups"] ?? nested;
-  return Array.isArray(groups) ? groups.filter((group) => typeof group === "string") : void 0;
-};
+import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
+
 const rolesForGroup = (group, map) => {
   if (map === void 0) {
     return [group];
@@ -15,7 +11,7 @@ const rolesForGroup = (group, map) => {
   return Array.isArray(resolved) ? resolved : [resolved];
 };
 const accessRoles = (options = {}) => {
-  const readGroups = options.readGroups ?? defaultReadGroups;
+  const readGroups = options.readGroups ?? readIdentityGroups;
   return async ({ ctx, next }) => {
     const identity = await ctx.auth?.getIdentity?.() ?? void 0;
     const groups = identity ? readGroups(identity) : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.2",
+  "version": "1.0.0-alpha.21",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -54,10 +54,11 @@
     "access": "public"
   },
   "dependencies": {
-    "jose": "^6.1.0"
+    "@lunora/errors": "1.0.0-alpha.4",
+    "jose": "^6.2.3"
   },
   "peerDependencies": {
-    "@lunora/server": "1.0.0-alpha.8"
+    "@lunora/server": "1.0.0-alpha.23"
   },
   "peerDependenciesMeta": {
     "@lunora/server": {