@nerdsystem/sdk 0.0.6 → 0.0.7

package/dist/auth/client.d.ts

@@ -21,8 +21,12 @@ export declare class AuthServiceError extends Error {
 export declare class AuthServiceClient {
     private readonly env;
     private readonly fetchImpl;
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    private readonly clientIp?;
     private readonly base;
-    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch);
+    constructor(env: Pick<NerdEnv, "NERD_AUTH_URL" | "NERD_PROJECT_ID" | "NERD_AUTH_SECRET">, fetchImpl?: typeof fetch, 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp?: string | undefined);
     get jwksUrl(): string;
     private call;
     signup(input: {

package/dist/auth/client.js

@@ -13,12 +13,16 @@ export class AuthServiceError extends Error {
 export class AuthServiceClient {
     env;
     fetchImpl;
+    clientIp;
     base;
     constructor(env, 
     // Wrapped, not bare: calling a stored `fetch` as a method breaks in workerd (illegal invocation).
-    fetchImpl = (input, init) => fetch(input, init)) {
+    fetchImpl = (input, init) => fetch(input, init), 
+    /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
+    clientIp) {
         this.env = env;
         this.fetchImpl = fetchImpl;
+        this.clientIp = clientIp;
         this.base = `${env.NERD_AUTH_URL.replace(/\/$/, "")}/t/${env.NERD_PROJECT_ID}`;
     }
     get jwksUrl() {
@@ -30,6 +34,7 @@ export class AuthServiceClient {
             headers: {
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
                 ...(auth ? { authorization: `Bearer ${auth}` } : {}),
+                ...(this.clientIp ? { "x-nerd-client-ip": this.clientIp } : {}),
             },
             body: body !== undefined ? JSON.stringify(body) : null,
         });

package/dist/auth/middleware.js

@@ -16,7 +16,7 @@ export async function resolveUser(c) {
     const token = bearer?.toLowerCase().startsWith("bearer ") ? bearer.slice(7) : readAccessCookie(c);
     if (!token)
         return null;
-    const client = new AuthServiceClient(c.env);
+    const client = new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip"));
     const verified = await verifyAccessToken(token, { jwksUrl: client.jwksUrl, projectId: c.env.NERD_PROJECT_ID });
     if (!verified)
         return null;

package/dist/auth/routes.js

@@ -39,7 +39,7 @@ export function authRoutes() {
         if (c.env.NERD_TURNSTILE_SECRET && !(await verifyTurnstile(c.env.NERD_TURNSTILE_SECRET, str(body.turnstileToken), c.req.header("cf-connecting-ip")))) {
             return c.json({ error: { code: "bad_request", message: "Please complete the verification challenge" } }, 400);
         }
-        const session = await new AuthServiceClient(c.env).signup({ email, password, name });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).signup({ email, password, name });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 201);
     });
@@ -49,7 +49,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!email || !password)
             return c.json({ error: { code: "bad_request", message: "email and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).login({ email, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).login({ email, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -58,7 +58,7 @@ export function authRoutes() {
         if (!refreshToken)
             return c.json({ error: { code: "unauthorized", message: "No session" } }, 401);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: session.user }, 200);
         }
@@ -73,7 +73,7 @@ export function authRoutes() {
     r.post("/logout", async (c) => {
         const refreshToken = readRefreshCookie(c);
         if (refreshToken)
-            await new AuthServiceClient(c.env).logout(refreshToken).catch(() => { });
+            await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).logout(refreshToken).catch(() => { });
         clearSessionCookies(c);
         return c.json({ ok: true }, 200);
     });
@@ -84,7 +84,7 @@ export function authRoutes() {
         if (!email)
             return c.json({ error: { code: "bad_request", message: "email is required" } }, 400);
         const origin = new URL(c.req.url).origin;
-        await new AuthServiceClient(c.env).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
+        await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).forgotPassword({ email, resetUrl: `${origin}/reset-password`, ...(c.env.NERD_APP_NAME ? { appName: c.env.NERD_APP_NAME } : {}) });
         return c.json({ ok: true }, 200);
     });
     r.post("/reset", async (c) => {
@@ -93,7 +93,7 @@ export function authRoutes() {
         const password = str(body.password);
         if (!token || !password)
             return c.json({ error: { code: "bad_request", message: "token and password are required" } }, 400);
-        const session = await new AuthServiceClient(c.env).resetPassword({ token, password });
+        const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).resetPassword({ token, password });
         setSessionCookies(c, session);
         return c.json({ user: session.user }, 200);
     });
@@ -106,7 +106,7 @@ export function authRoutes() {
         if (!refreshToken || readAccessCookie(c))
             return c.json({ user: null }, 200);
         try {
-            const session = await new AuthServiceClient(c.env).refresh(refreshToken);
+            const session = await new AuthServiceClient(c.env, undefined, c.req.header("cf-connecting-ip")).refresh(refreshToken);
             setSessionCookies(c, session);
             return c.json({ user: { id: session.user.id, email: session.user.email, name: session.user.name, roles: session.user.roles } }, 200);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",