@lunora/cloudflare-access 1.0.0-alpha.29 → 1.0.0-alpha.30

package/dist/admin.mjs

@@ -1,11 +1 @@
-import { assertVerifyOptions, verifyRequest } from './packem_shared/accessIssuer-C69kkiYc.mjs';
-
-const accessAdminGate = (options) => {
-  assertVerifyOptions(options);
-  return async (request) => {
-    const claims = await verifyRequest(request, options);
-    return claims === void 0 ? false : options.isAdmin(claims);
-  };
-};
-
-export { accessAdminGate };
+import{assertVerifyOptions as i,verifyRequest as e}from"./packem_shared/accessIssuer-BdF2LQuC.mjs";const r=s=>(i(s),async t=>{const a=await e(t,s);return a===void 0?!1:s.isAdmin(a)});export{r as accessAdminGate};

package/dist/context.mjs

@@ -1,37 +1 @@
-import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
-
-const stringClaim = (value) => typeof value === "string" ? value : void 0;
-const ANONYMOUS_FACADE = {
-  authenticated: false,
-  claims: void 0,
-  commonName: void 0,
-  email: void 0,
-  groups: [],
-  hasGroup: () => false,
-  userId: void 0
-};
-const facadeFor = (identity, userId) => {
-  const raw = identity["access"];
-  if (typeof raw !== "object" || raw === null) {
-    return ANONYMOUS_FACADE;
-  }
-  const claims = raw;
-  const groups = readIdentityGroups(identity) ?? [];
-  return {
-    authenticated: true,
-    claims,
-    commonName: stringClaim(identity["commonName"]) ?? stringClaim(claims.common_name),
-    email: stringClaim(identity["email"]) ?? stringClaim(claims.email),
-    groups,
-    hasGroup: (group) => groups.includes(group),
-    userId
-  };
-};
-const accessFacade = (identity, userId) => identity ? facadeFor(identity, userId ?? void 0) : ANONYMOUS_FACADE;
-const accessContext = () => async ({ ctx, next }) => {
-  const identity = await ctx.auth?.getIdentity?.();
-  const access = accessFacade(identity, ctx.auth?.userId);
-  return next({ ctx: { access } });
-};
-
-export { accessContext, accessFacade };
+import{t as m}from"./packem_shared/identity-groups-lzvxGu3k.mjs";const e=t=>typeof t=="string"?t:void 0,i={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},r=(t,a)=>{const o=t.access;if(typeof o!="object"||o===null)return i;const s=o,c=m(t)??[];return{authenticated:!0,claims:s,commonName:e(t.commonName)??e(s.common_name),email:e(t.email)??e(s.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(t,a)=>t?r(t,a??void 0):i,l=()=>async({ctx:t,next:a})=>{const o=await t.auth?.getIdentity?.(),s=u(o,t.auth?.userId);return a({ctx:{access:s}})};export{l as accessContext,u as accessFacade};

package/dist/index.mjs

@@ -1,2 +1 @@
-export { composeResolvers, createAccessResolver } from './packem_shared/composeResolvers-BlVswT75.mjs';
-export { accessIssuer, verifyAccessJwt } from './packem_shared/accessIssuer-C69kkiYc.mjs';
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-BZQFvmWK.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-BdF2LQuC.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/accessIssuer-BdF2LQuC.mjs

@@ -0,0 +1 @@
+import{LunoraError as l}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as d}from"jose";const h="cf-access-jwt-assertion",p="CF_Authorization",g=(t,e,r)=>{const o=t.headers.get(e);if(o!==null&&o.length>0)return o;const s=t.headers.get("cookie");if(s!==null)for(const c of s.split(";")){const a=c.indexOf("=");if(a!==-1&&c.slice(0,a).trim()===r){const n=c.slice(a+1).trim();return n.length>0?n:void 0}}},w="/cdn-cgi/access/certs",y=/^https?:\/\//i,A=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},u=t=>{const e=A(t.trim().replace(y,""));if(e.length===0)throw new l("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},i=new Map,R=t=>{let e=i.get(t);return e===void 0&&(e=d(new URL(`${t}${w}`)),i.set(t,e)),e},f=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new l("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},N=t=>{u(t.teamDomain),f(t.aud)},L=async(t,e)=>{const r=u(e.teamDomain),o=f(e.aud),s=e.keySet??R(r),{payload:c}=await m(t,s,{algorithms:["RS256"],audience:o,clockTolerance:e.clockToleranceSec,issuer:r});return c},$=async(t,e)=>{const r=(e.headerName??h).toLowerCase(),o=e.cookieName??p,s=g(t,r,o);if(s!==void 0)try{return await L(s,e)}catch(c){try{e.onError?.(c,t)}catch{}return}};export{u as accessIssuer,N as assertVerifyOptions,L as verifyAccessJwt,$ as verifyRequest};

package/dist/packem_shared/composeResolvers-BZQFvmWK.mjs

@@ -0,0 +1 @@
+import{assertVerifyOptions as t,verifyRequest as c}from"./accessIssuer-BdF2LQuC.mjs";const i=null,a=o=>typeof o=="string"&&o.length>0?o:void 0,e=o=>a(o.sub)??a(o.email)??a(o.common_name),u=(o,n)=>{const s=n?.(o)??{},r=a(s.userId)??e(o);return r===void 0?i:{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...s,userId:r}},l=o=>(t(o),async n=>{const s=await c(n,o);return s===void 0?i:u(s,o.mapClaims)}),v=(...o)=>async(n,s)=>{for(const r of o){const m=await r(n,s);if(m)return m}return i};export{v as composeResolvers,l as createAccessResolver};

package/dist/packem_shared/identity-groups-lzvxGu3k.mjs

@@ -0,0 +1 @@
+const n=r=>{const{access:o}=r,s=typeof o=="object"&&o!==null?o.groups:void 0,t=r.groups??s;return Array.isArray(t)?t.filter(e=>typeof e=="string"):void 0};export{n as t};

package/dist/roles.mjs

@@ -1,31 +1 @@
-import { r as readIdentityGroups } from './packem_shared/identity-groups-CONuLY61.mjs';
-
-const rolesForGroup = (group, map) => {
-  if (map === void 0) {
-    return [group];
-  }
-  const resolved = typeof map === "function" ? map(group) : map[group];
-  if (resolved === void 0) {
-    return [];
-  }
-  return Array.isArray(resolved) ? resolved : [resolved];
-};
-const accessRoles = (options = {}) => {
-  const readGroups = options.readGroups ?? readIdentityGroups;
-  return async ({ ctx, next }) => {
-    const identity = await ctx.auth?.getIdentity?.() ?? void 0;
-    const groups = identity ? readGroups(identity) : void 0;
-    if (groups === void 0 || groups.length === 0) {
-      return next();
-    }
-    const roles = new Set(ctx.auth?.roles);
-    for (const group of groups) {
-      for (const role of rolesForGroup(group, options.map)) {
-        roles.add(role);
-      }
-    }
-    return next({ ctx: { auth: { ...ctx.auth, roles: [...roles] } } });
-  };
-};
-
-export { accessRoles };
+import{t as u}from"./packem_shared/identity-groups-lzvxGu3k.mjs";const d=(o,r)=>{if(r===void 0)return[o];const t=typeof r=="function"?r(o):r[o];return t===void 0?[]:Array.isArray(t)?t:[t]},h=(o={})=>{const r=o.readGroups??u;return async({ctx:t,next:n})=>{const a=await t.auth?.getIdentity?.()??void 0,e=a?r(a):void 0;if(e===void 0||e.length===0)return n();const s=new Set(t.auth?.roles);for(const c of e)for(const i of d(c,o.map))s.add(i);return n({ctx:{auth:{...t.auth,roles:[...s]}}})}};export{h as accessRoles};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.29",
+  "version": "1.0.0-alpha.30",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",

package/dist/packem_shared/accessIssuer-C69kkiYc.mjs

@@ -1,99 +0,0 @@
-import { LunoraError } from '@lunora/errors';
-import { jwtVerify, createRemoteJWKSet } from 'jose';
-
-const DEFAULT_HEADER = "cf-access-jwt-assertion";
-const DEFAULT_COOKIE = "CF_Authorization";
-const readToken = (request, headerName, cookieName) => {
-  const headerValue = request.headers.get(headerName);
-  if (headerValue !== null && headerValue.length > 0) {
-    return headerValue;
-  }
-  const cookieHeader = request.headers.get("cookie");
-  if (cookieHeader === null) {
-    return void 0;
-  }
-  for (const part of cookieHeader.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) {
-      continue;
-    }
-    if (part.slice(0, eq).trim() === cookieName) {
-      const value = part.slice(eq + 1).trim();
-      return value.length > 0 ? value : void 0;
-    }
-  }
-  return void 0;
-};
-
-const CERTS_PATH = "/cdn-cgi/access/certs";
-const SCHEME_PREFIX = /^https?:\/\//i;
-const stripTrailingSlashes = (value) => {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") {
-    end -= 1;
-  }
-  return value.slice(0, end);
-};
-const accessIssuer = (teamDomain) => {
-  const trimmed = stripTrailingSlashes(teamDomain.trim().replace(SCHEME_PREFIX, ""));
-  if (trimmed.length === 0) {
-    throw new LunoraError("INTERNAL", '@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');
-  }
-  const candidate = trimmed.includes(".") ? `https://${trimmed}` : `https://${trimmed}.cloudflareaccess.com`;
-  const host = new URL(candidate).host.toLowerCase();
-  return `https://${host}`;
-};
-const jwksByIssuer = /* @__PURE__ */ new Map();
-const remoteJwks = (issuer) => {
-  let getter = jwksByIssuer.get(issuer);
-  if (getter === void 0) {
-    getter = createRemoteJWKSet(new URL(`${issuer}${CERTS_PATH}`));
-    jwksByIssuer.set(issuer, getter);
-  }
-  return getter;
-};
-const normalizeAudiences = (aud) => {
-  const audiences = (Array.isArray(aud) ? aud : [aud]).filter((entry) => typeof entry === "string" && entry.length > 0);
-  if (audiences.length === 0) {
-    throw new LunoraError(
-      "INTERNAL",
-      "@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application"
-    );
-  }
-  return audiences;
-};
-const assertVerifyOptions = (options) => {
-  accessIssuer(options.teamDomain);
-  normalizeAudiences(options.aud);
-};
-const verifyAccessJwt = async (token, options) => {
-  const issuer = accessIssuer(options.teamDomain);
-  const audiences = normalizeAudiences(options.aud);
-  const keySet = options.keySet ?? remoteJwks(issuer);
-  const { payload } = await jwtVerify(token, keySet, {
-    algorithms: ["RS256"],
-    audience: audiences,
-    clockTolerance: options.clockToleranceSec,
-    issuer
-  });
-  return payload;
-};
-const verifyRequest = async (request, options) => {
-  const headerName = (options.headerName ?? DEFAULT_HEADER).toLowerCase();
-  const cookieName = options.cookieName ?? DEFAULT_COOKIE;
-  const token = readToken(request, headerName, cookieName);
-  if (token === void 0) {
-    return void 0;
-  }
-  try {
-    return await verifyAccessJwt(token, options);
-  } catch (error) {
-    try {
-      options.onError?.(error, request);
-    } catch {
-    }
-    return void 0;
-  }
-};
-
-export { accessIssuer, assertVerifyOptions, verifyAccessJwt, verifyRequest };

package/dist/packem_shared/composeResolvers-BlVswT75.mjs

@@ -1,39 +0,0 @@
-import { assertVerifyOptions, verifyRequest } from './accessIssuer-C69kkiYc.mjs';
-
-const ANONYMOUS = null;
-const nonEmpty = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
-const deriveUserId = (claims) => nonEmpty(claims.sub) ?? nonEmpty(claims.email) ?? nonEmpty(claims.common_name);
-const toIdentity = (claims, mapClaims) => {
-  const overrides = mapClaims?.(claims) ?? {};
-  const userId = nonEmpty(overrides.userId) ?? deriveUserId(claims);
-  if (userId === void 0) {
-    return ANONYMOUS;
-  }
-  return {
-    access: claims,
-    ...claims.common_name === void 0 ? {} : { commonName: claims.common_name },
-    ...claims.email === void 0 ? {} : { email: claims.email },
-    ...claims.exp === void 0 ? {} : { exp: claims.exp },
-    ...claims.groups === void 0 ? {} : { groups: claims.groups },
-    ...overrides,
-    userId
-  };
-};
-const createAccessResolver = (options) => {
-  assertVerifyOptions(options);
-  return async (request) => {
-    const claims = await verifyRequest(request, options);
-    return claims === void 0 ? ANONYMOUS : toIdentity(claims, options.mapClaims);
-  };
-};
-const composeResolvers = (...resolvers) => async (request, env) => {
-  for (const resolve of resolvers) {
-    const identity = await resolve(request, env);
-    if (identity) {
-      return identity;
-    }
-  }
-  return ANONYMOUS;
-};
-
-export { composeResolvers, createAccessResolver };

package/dist/packem_shared/identity-groups-CONuLY61.mjs

@@ -1,8 +0,0 @@
-const readIdentityGroups = (identity) => {
-  const { access } = identity;
-  const nested = typeof access === "object" && access !== null ? access.groups : void 0;
-  const groups = identity["groups"] ?? nested;
-  return Array.isArray(groups) ? groups.filter((group) => typeof group === "string") : void 0;
-};
-
-export { readIdentityGroups as r };