@lunora/cloudflare-access 1.0.0-alpha.69 → 1.0.0-alpha.70

package/dist/admin.mjs

@@ -1 +1 @@
-import{assertVerifyOptions as i,verifyRequest as e}from"./packem_shared/accessIssuer-BdF2LQuC.mjs";const r=s=>(i(s),async t=>{const a=await e(t,s);return a===void 0?!1:s.isAdmin(a)});export{r as accessAdminGate};
+import{assertVerifyOptions as t,verifyRequest as a}from"./packem_shared/accessIssuer-B6vVJPus.mjs";const c=e=>(t(e),async s=>{const r=await a(s,e);return r===void 0?!1:e.isAdmin(r)});export{c as accessAdminGate};

package/dist/context.d.mts

@@ -1,6 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.mjs";
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
 import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.mjs";
-import '@lunora/errors';
 import 'jose';
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.d.ts

@@ -1,6 +1,5 @@
-import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.js";
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
 import { A as AccessClaims } from "./packem_shared/types.d-C8c7Qwx1.js";
-import '@lunora/errors';
 import 'jose';
 /**
  * The slice of context {@link accessContext} reads: the `auth` facade every

package/dist/context.mjs

@@ -1 +1 @@
-import{t as m}from"./packem_shared/identity-groups-lzvxGu3k.mjs";const e=t=>typeof t=="string"?t:void 0,i={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},r=(t,a)=>{const o=t.access;if(typeof o!="object"||o===null)return i;const s=o,c=m(t)??[];return{authenticated:!0,claims:s,commonName:e(t.commonName)??e(s.common_name),email:e(t.email)??e(s.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(t,a)=>t?r(t,a??void 0):i,l=()=>async({ctx:t,next:a})=>{const o=await t.auth?.getIdentity?.(),s=u(o,t.auth?.userId);return a({ctx:{access:s}})};export{l as accessContext,u as accessFacade};
+import{r as m}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=o=>typeof o=="string"?o:void 0,n={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(o,a)=>{const s=o.access;if(typeof s!="object"||s===null)return n;const e=s,t=m(o)??[];return{authenticated:!0,claims:e,commonName:c(o.commonName)??c(e.common_name),email:c(o.email)??c(e.email),groups:t,hasGroup:r=>t.includes(r),userId:a}},u=(o,a)=>o?i(o,a??void 0):n,l=()=>async({ctx:o,next:a})=>{const s=await o.auth?.getIdentity?.(),e=u(s,o.auth?.userId);return a({ctx:{access:e}})};export{l as accessContext,u as accessFacade};

package/dist/index.mjs

@@ -1 +1 @@
-import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers-BZQFvmWK.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-BdF2LQuC.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};
+import{composeResolvers as r,createAccessResolver as c}from"./packem_shared/composeResolvers--vZvblPO.mjs";import{accessIssuer as t,verifyAccessJwt as f}from"./packem_shared/accessIssuer-B6vVJPus.mjs";export{t as accessIssuer,r as composeResolvers,c as createAccessResolver,f as verifyAccessJwt};

package/dist/packem_shared/accessIssuer-B6vVJPus.mjs

@@ -0,0 +1 @@
+import{LunoraError as l}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as h}from"jose";const f="cf-access-jwt-assertion",w="CF_Authorization",g=(t,e,r)=>{const c=t.headers.get(e);if(c!==null&&c.length>0)return c;const o=t.headers.get("cookie");if(o!==null)for(const n of o.split(";")){const s=n.indexOf("=");if(s!==-1&&n.slice(0,s).trim()===r){const a=n.slice(s+1).trim();return a.length>0?a:void 0}}},y="/cdn-cgi/access/certs",k=/^https?:\/\//i,A=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},u=t=>{const e=A(t.trim().replace(k,""));if(e.length===0)throw new l("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},i=new Map,E=t=>{let e=i.get(t);return e===void 0&&(e=h(new URL(`${t}${y}`)),i.set(t,e)),e},d=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new l("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},v=t=>{u(t.teamDomain),d(t.aud)},p=async(t,e)=>{const r=u(e.teamDomain),c=d(e.aud),o=e.keySet??E(r),{payload:n}=await m(t,o,{algorithms:["RS256"],audience:c,clockTolerance:e.clockToleranceSec,issuer:r});return n},L=async(t,e)=>{const r=(e.headerName??f).toLowerCase(),c=e.cookieName??w,o=g(t,r,c);if(o!==void 0)try{return await p(o,e)}catch(n){try{e.onError?.(n,t)}catch{}return}};export{u as accessIssuer,v as assertVerifyOptions,p as verifyAccessJwt,L as verifyRequest};

package/dist/packem_shared/composeResolvers--vZvblPO.mjs

@@ -0,0 +1 @@
+import{assertVerifyOptions as i,verifyRequest as c}from"./accessIssuer-B6vVJPus.mjs";const s=null,t=e=>typeof e=="string"&&e.length>0?e:void 0,u=e=>t(e.sub)??t(e.email)??t(e.common_name),m=(e,r)=>{const o=r?.(e)??{},n=t(o.userId)??u(e);return n===void 0?s:{access:e,...e.common_name===void 0?{}:{commonName:e.common_name},...e.email===void 0?{}:{email:e.email},...e.exp===void 0?{}:{exp:e.exp},...e.groups===void 0?{}:{groups:e.groups},...o,userId:n}},v=e=>(i(e),async r=>{const o=await c(r,e);return o===void 0?s:m(o,e.mapClaims)}),f=(...e)=>async(r,o)=>{for(const n of e){const d=await n(r,o);if(d)return d}return s};export{f as composeResolvers,v as createAccessResolver};

package/dist/packem_shared/identity-groups-CCucbpzP.mjs

@@ -0,0 +1 @@
+const n=o=>{const{access:r}=o,t=typeof r=="object"&&r!==null?r.groups:void 0,s=o.groups??t;return Array.isArray(s)?s.filter(e=>typeof e=="string"):void 0};export{n as r};

package/dist/packem_shared/{index.d-5O8LZ3gE.d.ts → index.d-D7R8k7yf.d.mts}

@@ -1,4 +1,3 @@
-import '@lunora/errors';
 /**
  * `next()` advances the middleware chain. Called with no argument it forwards
  * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/packem_shared/{index.d-5O8LZ3gE.d.mts → index.d-D7R8k7yf.d.ts}

@@ -1,4 +1,3 @@
-import '@lunora/errors';
 /**
  * `next()` advances the middleware chain. Called with no argument it forwards
  * the current context unchanged; called with `{ ctx }` it shallow-merges the

package/dist/roles.d.mts

@@ -1,5 +1,4 @@
-import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.mjs";
-import '@lunora/errors';
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.mjs";
 /**
  * The slice of context {@link accessRoles} reads and augments: the `auth` facade
  * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.d.ts

@@ -1,5 +1,4 @@
-import { M as Middleware } from "./packem_shared/index.d-5O8LZ3gE.js";
-import '@lunora/errors';
+import { M as Middleware } from "./packem_shared/index.d-D7R8k7yf.js";
 /**
  * The slice of context {@link accessRoles} reads and augments: the `auth` facade
  * every Lunora ctx carries. `getIdentity()` returns the verified identity

package/dist/roles.mjs

@@ -1 +1 @@
-import{t as u}from"./packem_shared/identity-groups-lzvxGu3k.mjs";const d=(o,r)=>{if(r===void 0)return[o];const t=typeof r=="function"?r(o):r[o];return t===void 0?[]:Array.isArray(t)?t:[t]},h=(o={})=>{const r=o.readGroups??u;return async({ctx:t,next:n})=>{const a=await t.auth?.getIdentity?.()??void 0,e=a?r(a):void 0;if(e===void 0||e.length===0)return n();const s=new Set(t.auth?.roles);for(const c of e)for(const i of d(c,o.map))s.add(i);return n({ctx:{auth:{...t.auth,roles:[...s]}}})}};export{h as accessRoles};
+import{r as a}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=(o,t)=>{if(t===void 0)return[o];const r=typeof t=="function"?t(o):t[o];return r===void 0?[]:Array.isArray(r)?r:[r]},l=(o={})=>{const t=o.readGroups??a;return async({ctx:r,next:s})=>{const n=await r.auth?.getIdentity?.()??void 0,e=n?t(n):void 0;if(e===void 0||e.length===0)return s();const i=new Set(r.auth?.roles);for(const u of e)for(const d of c(u,o.map))i.add(d);return s({ctx:{auth:{...r.auth,roles:[...i]}}})}};export{l as accessRoles};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.69",
+  "version": "1.0.0-alpha.70",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",
@@ -55,7 +55,7 @@
   },
   "dependencies": {
     "@lunora/errors": "1.0.0-alpha.21",
-    "jose": "^6.2.4"
+    "jose": "^6.2.8"
   },
   "peerDependencies": {
     "@lunora/server": ">=1.0.0-alpha.24 <2.0.0-0"

package/dist/packem_shared/accessIssuer-BdF2LQuC.mjs

@@ -1 +0,0 @@
-import{LunoraError as l}from"@lunora/errors";import{jwtVerify as m,createRemoteJWKSet as d}from"jose";const h="cf-access-jwt-assertion",p="CF_Authorization",g=(t,e,r)=>{const o=t.headers.get(e);if(o!==null&&o.length>0)return o;const s=t.headers.get("cookie");if(s!==null)for(const c of s.split(";")){const a=c.indexOf("=");if(a!==-1&&c.slice(0,a).trim()===r){const n=c.slice(a+1).trim();return n.length>0?n:void 0}}},w="/cdn-cgi/access/certs",y=/^https?:\/\//i,A=t=>{let e=t.length;for(;e>0&&t[e-1]==="/";)e-=1;return t.slice(0,e)},u=t=>{const e=A(t.trim().replace(y,""));if(e.length===0)throw new l("INTERNAL",'@lunora/cloudflare-access: `teamDomain` is required (e.g. "acme" or "acme.cloudflareaccess.com")');const r=e.includes(".")?`https://${e}`:`https://${e}.cloudflareaccess.com`;return`https://${new URL(r).host.toLowerCase()}`},i=new Map,R=t=>{let e=i.get(t);return e===void 0&&(e=d(new URL(`${t}${w}`)),i.set(t,e)),e},f=t=>{const e=(Array.isArray(t)?t:[t]).filter(r=>typeof r=="string"&&r.length>0);if(e.length===0)throw new l("INTERNAL","@lunora/cloudflare-access: `aud` is required and must be a non-empty Access AUD tag — refusing to verify a token without an audience to scope it to your application");return e},N=t=>{u(t.teamDomain),f(t.aud)},L=async(t,e)=>{const r=u(e.teamDomain),o=f(e.aud),s=e.keySet??R(r),{payload:c}=await m(t,s,{algorithms:["RS256"],audience:o,clockTolerance:e.clockToleranceSec,issuer:r});return c},$=async(t,e)=>{const r=(e.headerName??h).toLowerCase(),o=e.cookieName??p,s=g(t,r,o);if(s!==void 0)try{return await L(s,e)}catch(c){try{e.onError?.(c,t)}catch{}return}};export{u as accessIssuer,N as assertVerifyOptions,L as verifyAccessJwt,$ as verifyRequest};

package/dist/packem_shared/composeResolvers-BZQFvmWK.mjs

@@ -1 +0,0 @@
-import{assertVerifyOptions as t,verifyRequest as c}from"./accessIssuer-BdF2LQuC.mjs";const i=null,a=o=>typeof o=="string"&&o.length>0?o:void 0,e=o=>a(o.sub)??a(o.email)??a(o.common_name),u=(o,n)=>{const s=n?.(o)??{},r=a(s.userId)??e(o);return r===void 0?i:{access:o,...o.common_name===void 0?{}:{commonName:o.common_name},...o.email===void 0?{}:{email:o.email},...o.exp===void 0?{}:{exp:o.exp},...o.groups===void 0?{}:{groups:o.groups},...s,userId:r}},l=o=>(t(o),async n=>{const s=await c(n,o);return s===void 0?i:u(s,o.mapClaims)}),v=(...o)=>async(n,s)=>{for(const r of o){const m=await r(n,s);if(m)return m}return i};export{v as composeResolvers,l as createAccessResolver};

package/dist/packem_shared/identity-groups-lzvxGu3k.mjs

@@ -1 +0,0 @@
-const n=r=>{const{access:o}=r,s=typeof o=="object"&&o!==null?o.groups:void 0,t=r.groups??s;return Array.isArray(t)?t.filter(e=>typeof e=="string"):void 0};export{n as t};