@lunora/cloudflare-access 1.0.0-alpha.20 → 1.0.0-alpha.22

package/dist/admin.mjs

@@ -1,8 +1,11 @@
-import { verifyRequest } from './packem_shared/accessIssuer-83KYwaCp.mjs';
+import { assertVerifyOptions, verifyRequest } from './packem_shared/accessIssuer-C69kkiYc.mjs';
 
-const accessAdminGate = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? false : options.isAdmin(claims);
+const accessAdminGate = (options) => {
+  assertVerifyOptions(options);
+  return async (request) => {
+    const claims = await verifyRequest(request, options);
+    return claims === void 0 ? false : options.isAdmin(claims);
+  };
 };
 
 export { accessAdminGate };

package/dist/context.mjs

@@ -1,4 +1,5 @@
-const stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
+
 const stringClaim = (value) => typeof value === "string" ? value : void 0;
 const ANONYMOUS_FACADE = {
   authenticated: false,
@@ -15,7 +16,7 @@ const facadeFor = (identity, userId) => {
     return ANONYMOUS_FACADE;
   }
   const claims = raw;
-  const groups = stringList(identity["groups"] ?? claims.groups);
+  const groups = readIdentityGroups(identity) ?? [];
   return {
     authenticated: true,
     claims,

package/dist/index.d.mts

@@ -40,6 +40,17 @@ declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => Res
 * bare name with no dot is expanded to the `cloudflareaccess.com` host.
 */
 declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Eagerly validate the static, construction-time verify options so a misconfigured
+* deployment fails fast at factory build time instead of degrading to
+* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
+* call this once when built: `teamDomain` must resolve to a valid Access issuer
+* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
+* then covers only genuine token-verification failures, not config mistakes — a
+* broken deployment throws here at startup rather than resolving every caller to
+* anonymous with zero signal.
+*/
+
 /**
 * Verify a Cloudflare Access JWT and return its claims.
 *

package/dist/index.d.ts

@@ -40,6 +40,17 @@ declare const composeResolvers: (...resolvers: ResolveIdentityFunction[]) => Res
 * bare name with no dot is expanded to the `cloudflareaccess.com` host.
 */
 declare const accessIssuer: (teamDomain: string) => string;
+/**
+* Eagerly validate the static, construction-time verify options so a misconfigured
+* deployment fails fast at factory build time instead of degrading to
+* silent-anonymous on every request. `createAccessResolver` / `accessAdminGate`
+* call this once when built: `teamDomain` must resolve to a valid Access issuer
+* and `aud` must be a non-empty tag. The per-request catch in {@link verifyRequest}
+* then covers only genuine token-verification failures, not config mistakes — a
+* broken deployment throws here at startup rather than resolving every caller to
+* anonymous with zero signal.
+*/
+
 /**
 * Verify a Cloudflare Access JWT and return its claims.
 *

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BI3envaN.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-83KYwaCp.mjs';
+export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BlVswT75.mjs';
+export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-C69kkiYc.mjs';

package/dist/packem_shared/{accessIssuer-83KYwaCp.mjs → accessIssuer-C69kkiYc.mjs}

@@ -52,17 +52,23 @@ const remoteJwks = (issuer) => {
   }
   return getter;
 };
-const verifyAccessJwt = async (token, options) => {
-  const issuer = accessIssuer(options.teamDomain);
-  const audiences = (Array.isArray(options.aud) ? options.aud : [options.aud]).filter(
-    (entry) => typeof entry === "string" && entry.length > 0
-  );
+const normalizeAudiences = (aud) => {
+  const audiences = (Array.isArray(aud) ? aud : [aud]).filter((entry) => typeof entry === "string" && entry.length > 0);
   if (audiences.length === 0) {
     throw new LunoraError(
       "INTERNAL",
       "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
     );
   }
+  return audiences;
+};
+const assertVerifyOptions = (options) => {
+  accessIssuer(options.teamDomain);
+  normalizeAudiences(options.aud);
+};
+const verifyAccessJwt = async (token, options) => {
+  const issuer = accessIssuer(options.teamDomain);
+  const audiences = normalizeAudiences(options.aud);
   const keySet = options.keySet ?? remoteJwks(issuer);
   const { payload } = await jwtVerify(token, keySet, {
     algorithms: ["RS256"],
@@ -90,4 +96,4 @@ const verifyRequest = async (request, options) => {
   }
 };
 
-export { accessIssuer, verifyAccessJwt, verifyRequest };
+export { accessIssuer, assertVerifyOptions, verifyAccessJwt, verifyRequest };

package/dist/packem_shared/{composeResolvers-BI3envaN.mjs → composeResolvers-BlVswT75.mjs}

@@ -1,13 +1,11 @@
-import { verifyRequest } from './accessIssuer-83KYwaCp.mjs';
+import { assertVerifyOptions, verifyRequest } from './accessIssuer-C69kkiYc.mjs';
 
 const ANONYMOUS = null;
-const deriveUserId = (claims) => {
-  const sub = typeof claims.sub === "string" && claims.sub.length > 0 ? claims.sub : void 0;
-  return sub ?? claims.email ?? claims.common_name;
-};
+const nonEmpty = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+const deriveUserId = (claims) => nonEmpty(claims.sub) ?? nonEmpty(claims.email) ?? nonEmpty(claims.common_name);
 const toIdentity = (claims, mapClaims) => {
   const overrides = mapClaims?.(claims) ?? {};
-  const userId = typeof overrides.userId === "string" ? overrides.userId : deriveUserId(claims);
+  const userId = nonEmpty(overrides.userId) ?? deriveUserId(claims);
   if (userId === void 0) {
     return ANONYMOUS;
   }
@@ -21,9 +19,12 @@ const toIdentity = (claims, mapClaims) => {
     userId
   };
 };
-const createAccessResolver = (options) => async (request) => {
-  const claims = await verifyRequest(request, options);
-  return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
+const createAccessResolver = (options) => {
+  assertVerifyOptions(options);
+  return async (request) => {
+    const claims = await verifyRequest(request, options);
+    return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
+  };
 };
 const composeResolvers = (...resolvers) => async (request, env) => {
   for (const resolve of resolvers) {

package/dist/packem_shared/identity-groups-CONuLY61.mjs

@@ -0,0 +1,8 @@
+const readIdentityGroups = (identity) => {
+  const { access } = identity;
+  const nested = typeof access === "object" && access !== null ? access.groups : void 0;
+  const groups = identity["groups"] ?? nested;
+  return Array.isArray(groups) ? groups.filter((group) => typeof group === "string") : void 0;
+};
+
+export { readIdentityGroups as r };

package/dist/roles.mjs

@@ -1,9 +1,5 @@
-const defaultReadGroups = (identity) => {
-  const { access } = identity;
-  const nested = typeof access === "object" && access !== null ? access.groups : void 0;
-  const groups = identity["groups"] ?? nested;
-  return Array.isArray(groups) ? groups.filter((group) => typeof group === "string") : void 0;
-};
+import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
+
 const rolesForGroup = (group, map) => {
   if (map === void 0) {
     return [group];
@@ -15,7 +11,7 @@ const rolesForGroup = (group, map) => {
   return Array.isArray(resolved) ? resolved : [resolved];
 };
 const accessRoles = (options = {}) => {
-  const readGroups = options.readGroups ?? defaultReadGroups;
+  const readGroups = options.readGroups ?? readIdentityGroups;
   return async ({ ctx, next }) => {
     const identity = await ctx.auth?.getIdentity?.() ?? void 0;
     const groups = identity ? readGroups(identity) : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.20",
+  "version": "1.0.0-alpha.22",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -54,11 +54,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@lunora/errors": "1.0.0-alpha.3",
+    "@lunora/errors": "1.0.0-alpha.4",
     "jose": "^6.2.3"
   },
   "peerDependencies": {
-    "@lunora/server": "1.0.0-alpha.22"
+    "@lunora/server": "1.0.0-alpha.24"
   },
   "peerDependenciesMeta": {
     "@lunora/server": {