@lunora/cloudflare-access 1.0.0-alpha.91 → 1.0.0-alpha.93

package/dist/context.mjs

@@ -1 +1 @@
-import{r as m}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=o=>typeof o=="string"?o:void 0,n={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(o,a)=>{const s=o.access;if(typeof s!="object"||s===null)return n;const e=s,t=m(o)??[];return{authenticated:!0,claims:e,commonName:c(o.commonName)??c(e.common_name),email:c(o.email)??c(e.email),groups:t,hasGroup:r=>t.includes(r),userId:a}},u=(o,a)=>o?i(o,a??void 0):n,l=()=>async({ctx:o,next:a})=>{const s=await o.auth?.getIdentity?.(),e=u(s,o.auth?.userId);return a({ctx:{access:e}})};export{l as accessContext,u as accessFacade};
+import{i as r,r as m}from"./packem_shared/identity-groups-CpehEdiX.mjs";const e=s=>typeof s=="string"?s:void 0,t={authenticated:!1,claims:void 0,commonName:void 0,email:void 0,groups:[],hasGroup:()=>!1,userId:void 0},i=(s,a)=>{if(!r(s))return t;const o=s.access,c=m(s)??[];return{authenticated:!0,claims:o,commonName:e(s.commonName)??e(o.common_name),email:e(s.email)??e(o.email),groups:c,hasGroup:n=>c.includes(n),userId:a}},u=(s,a)=>s?i(s,a??void 0):t,l=()=>async({ctx:s,next:a})=>{const o=await s.auth?.getIdentity?.(),c=u(o,s.auth?.userId);return a({ctx:{access:c}})};export{l as accessContext,u as accessFacade};

package/dist/packem_shared/identity-groups-CpehEdiX.mjs

@@ -0,0 +1 @@
+const c=t=>{const{access:s}=t;return typeof s=="object"&&s!==null},n=t=>{const{access:s}=t,r=typeof s=="object"&&s!==null?s.groups:void 0,o=t.groups??r;return Array.isArray(o)?o.filter(e=>typeof e=="string"):void 0};export{c as i,n as r};

package/dist/roles.d.mts

@@ -41,6 +41,11 @@ interface AccessRolesOptions {
  * is preserved). When there is no identity or no groups it forwards the context
  * unchanged — anonymous requests stay role-less (fail-closed under RLS).
  *
+ * Only a **verified Access identity** contributes roles: an envelope without the
+ * claim set under `access` (a session resolved by another adapter under
+ * `composeResolvers`, e.g. better-auth) is forwarded unchanged, so a `groups`
+ * field on a foreign identity can never become an RLS role.
+ *
  * ```ts
  * export const listInvoices = query
  *   .use(accessRoles({ map: { "idp-admins": "admin", "idp-billing": ["billing", "viewer"] } }))

package/dist/roles.d.ts

@@ -41,6 +41,11 @@ interface AccessRolesOptions {
  * is preserved). When there is no identity or no groups it forwards the context
  * unchanged — anonymous requests stay role-less (fail-closed under RLS).
  *
+ * Only a **verified Access identity** contributes roles: an envelope without the
+ * claim set under `access` (a session resolved by another adapter under
+ * `composeResolvers`, e.g. better-auth) is forwarded unchanged, so a `groups`
+ * field on a foreign identity can never become an RLS role.
+ *
  * ```ts
  * export const listInvoices = query
  *   .use(accessRoles({ map: { "idp-admins": "admin", "idp-billing": ["billing", "viewer"] } }))

package/dist/roles.mjs

@@ -1 +1 @@
-import{r as a}from"./packem_shared/identity-groups-CCucbpzP.mjs";const c=(o,t)=>{if(t===void 0)return[o];const r=typeof t=="function"?t(o):t[o];return r===void 0?[]:Array.isArray(r)?r:[r]},l=(o={})=>{const t=o.readGroups??a;return async({ctx:r,next:s})=>{const n=await r.auth?.getIdentity?.()??void 0,e=n?t(n):void 0;if(e===void 0||e.length===0)return s();const i=new Set(r.auth?.roles);for(const u of e)for(const d of c(u,o.map))i.add(d);return s({ctx:{auth:{...r.auth,roles:[...i]}}})}};export{l as accessRoles};
+import{r as a,i as c}from"./packem_shared/identity-groups-CpehEdiX.mjs";const f=(o,t)=>{if(t===void 0)return[o];const r=typeof t=="function"?t(o):t[o];return r===void 0?[]:Array.isArray(r)?r:[r]},y=(o={})=>{const t=o.readGroups??a;return async({ctx:r,next:n})=>{const e=await r.auth?.getIdentity?.()??void 0,s=e!==void 0&&c(e)?t(e):void 0;if(s===void 0||s.length===0)return n();const i=new Set(r.auth?.roles);for(const d of s)for(const u of f(d,o.map))i.add(u);return n({ctx:{auth:{...r.auth,roles:[...i]}}})}};export{y as accessRoles};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/cloudflare-access",
-  "version": "1.0.0-alpha.91",
+  "version": "1.0.0-alpha.93",
   "description": "Cloudflare Access (Zero Trust) identity for Lunora — verify the Cf-Access-Jwt-Assertion JWT against your team JWKS and feed the verified identity into ctx.auth / RLS via a resolveIdentity adapter",
   "keywords": [
     "access",

package/dist/packem_shared/identity-groups-CCucbpzP.mjs

@@ -1 +0,0 @@
-const n=o=>{const{access:r}=o,t=typeof r=="object"&&r!==null?r.groups:void 0,s=o.groups??t;return Array.isArray(s)?s.filter(e=>typeof e=="string"):void 0};export{n as r};