@oneaccount/express 0.1.0 → 0.1.2

package/dist/middleware/auth.js

@@ -69,16 +69,56 @@ function rsaPublicKeyFromJWK(jwk) {
     const pem = `-----BEGIN PUBLIC KEY-----\n${der.toString("base64").match(/.{1,64}/g)?.join("\n")}\n-----END PUBLIC KEY-----`;
     return pem;
 }
+function extractTokenFromCookies(cookieHeader, cookieName) {
+    if (!cookieHeader)
+        return null;
+    const cookies = cookieHeader.split(';').map(c => c.trim());
+    for (const cookie of cookies) {
+        const [name, ...valueParts] = cookie.split('=');
+        if (name === cookieName) {
+            return valueParts.join('=');
+        }
+    }
+    return null;
+}
 function createAuthMiddleware(config) {
     const jwksUrl = config.jwksUrl ||
         `${config.accountProUrl || "https://myaccount.one"}/.well-known/jwks.json`;
+    const cookieName = config.cookieName || "auth_token";
+    const autoSetCookie = config.autoSetCookie !== false; // Default to true
     return async function authMiddleware(req, res, next) {
         req.oneAccount = { user: null };
+        // Auto-set cookie from ?token= query parameter (SSO redirect handling)
+        if (autoSetCookie && req.query?.token && typeof req.query.token === 'string') {
+            const tokenFromUrl = req.query.token;
+            // Set the cookie
+            res.cookie(cookieName, tokenFromUrl, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                maxAge: 30 * 24 * 60 * 60 * 1000, // 30 days
+                sameSite: 'lax',
+                path: '/',
+            });
+            // Build redirect URL without the token parameter
+            const url = new URL(req.originalUrl || req.url, `${req.protocol}://${req.get('host')}`);
+            url.searchParams.delete('token');
+            const redirectPath = url.pathname + url.search;
+            if (config.debug) {
+                console.log(`[OneAccount] Auto-set cookie from URL token, redirecting to ${redirectPath}`);
+            }
+            return res.redirect(redirectPath);
+        }
+        let token = null;
         const authHeader = req.headers.authorization;
-        if (!authHeader?.startsWith("Bearer ")) {
+        if (authHeader?.startsWith("Bearer ")) {
+            token = authHeader.substring(7);
+        }
+        else {
+            token = extractTokenFromCookies(req.headers.cookie, cookieName);
+        }
+        if (!token) {
             return next();
         }
-        const token = authHeader.substring(7);
         try {
             const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
             if (!decoded) {

package/dist/types/index.d.ts

@@ -24,6 +24,15 @@ export interface OneAccountConfig {
     jwksUrl?: string;
     cacheMaxAge?: number;
     debug?: boolean;
+    cookieName?: string;
+    /**
+     * Automatically set auth cookie from ?token= URL parameter (SSO redirect handling).
+     * When enabled (default: true), the middleware will:
+     * 1. Detect ?token= in the URL
+     * 2. Set it as an HttpOnly cookie
+     * 3. Redirect to the same URL without the token parameter
+     */
+    autoSetCookie?: boolean;
 }
 export interface StripeConnectStatus {
     hasAccount: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaccount/express",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "OneAccount SDK for Express.js - Authentication, entitlements, and Stripe Connect",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",