@omg-dev/auth 0.4.24

package/dist/index.mjs

@@ -0,0 +1,43 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/index.ts
+const DEFAULT_JWKS_URL = "https://auth.omg.dev/.well-known/jwks.json";
+const DEFAULT_ISSUER = "https://auth.omg.dev";
+/**
+* Creates an auth middleware for the given mode.
+* - "vibes": verifies JWT Bearer token via JWKS endpoint
+* - "local": returns null (unauthenticated / no auth required)
+*/
+function createAuthMiddleware(mode, options) {
+	if (mode === "local") return async () => null;
+	const jwksUrl = options?.jwksUrl ?? DEFAULT_JWKS_URL;
+	const issuer = options?.issuer ?? DEFAULT_ISSUER;
+	const audience = options?.audience;
+	const algorithms = options?.algorithms ?? ["ES256"];
+	const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+	return async (req) => {
+		const authHeader = req.headers.get("authorization") ?? "";
+		if (!authHeader.startsWith("Bearer ")) return null;
+		const token = authHeader.slice(7).trim();
+		if (!token) return null;
+		try {
+			const { payload } = await jwtVerify(token, JWKS, {
+				algorithms,
+				issuer,
+				...audience ? { audience } : {}
+			});
+			const userId = payload.sub;
+			if (!userId) return null;
+			if (userId.startsWith("svc:")) return null;
+			return {
+				userId,
+				userEmail: payload.email,
+				userName: payload.name,
+				appId: payload.appId
+			};
+		} catch {
+			return null;
+		}
+	};
+}
+//#endregion
+export { createAuthMiddleware };

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@omg-dev/auth",
+  "version": "0.4.24",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./dist/index.mjs"
+    }
+  },
+  "dependencies": {
+    "jose": "^5.0.0"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BennyKok/vibes.git"
+  },
+  "homepage": "https://docs.omg.dev",
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}

package/src/index.ts

@@ -0,0 +1,77 @@
+// @omg-dev/auth — Server-side JWT verification middleware
+//
+// Verifies JWT tokens issued by auth.omg.dev using JWKS.
+
+import { createRemoteJWKSet, jwtVerify, type JWTPayload } from "jose"
+
+export type AuthMode = "vibes" | "local"
+
+export interface AuthResult {
+  userId: string
+  userEmail?: string
+  userName?: string
+  appId?: string
+}
+
+interface VibesJWTPayload extends JWTPayload {
+  email?: string
+  name?: string
+  appId?: string
+}
+
+const DEFAULT_JWKS_URL = "https://auth.omg.dev/.well-known/jwks.json"
+const DEFAULT_ISSUER = "https://auth.omg.dev"
+
+/**
+ * Creates an auth middleware for the given mode.
+ * - "vibes": verifies JWT Bearer token via JWKS endpoint
+ * - "local": returns null (unauthenticated / no auth required)
+ */
+export function createAuthMiddleware(
+  mode: AuthMode,
+  options?: { jwksUrl?: string; issuer?: string; audience?: string | string[]; algorithms?: string[] }
+): (req: Request) => Promise<AuthResult | null> {
+  if (mode === "local") {
+    return async () => null
+  }
+
+  const jwksUrl = options?.jwksUrl ?? DEFAULT_JWKS_URL
+  const issuer = options?.issuer ?? DEFAULT_ISSUER
+  const audience = options?.audience
+  // Default to ES256 (auth.omg.dev's /token-minted JWTs). The OAuth provider
+  // at /api/auth/jwks signs access tokens with EdDSA, so callers verifying
+  // those must pass algorithms: ["EdDSA"] + the matching jwksUrl.
+  const algorithms = options?.algorithms ?? ["ES256"]
+  const JWKS = createRemoteJWKSet(new URL(jwksUrl))
+
+  return async (req: Request): Promise<AuthResult | null> => {
+    const authHeader = req.headers.get("authorization") ?? ""
+    if (!authHeader.startsWith("Bearer ")) return null
+
+    const token = authHeader.slice(7).trim()
+    if (!token) return null
+
+    try {
+      const { payload } = await jwtVerify(token, JWKS, {
+        algorithms,
+        issuer,
+        ...(audience ? { audience } : {}),
+      }) as { payload: VibesJWTPayload }
+
+      const userId = payload.sub
+      if (!userId) return null
+      // Service-principal tokens (sub="svc:*") are minted for infra-to-infra
+      // calls; user-facing apps must never accept them as a logged-in user.
+      if (userId.startsWith("svc:")) return null
+
+      return {
+        userId,
+        userEmail: payload.email,
+        userName: payload.name,
+        appId: payload.appId,
+      }
+    } catch {
+      return null
+    }
+  }
+}