@ovixa/auth-client 0.1.0

package/dist/middleware/astro.d.ts

@@ -0,0 +1,155 @@
+import { TokenResponse } from '../index.js';
+import { A as AuthMiddlewareConfig, a as AuthContext, C as CookieOptions } from '../types-Czfah64-.js';
+import 'jose';
+
+/**
+ * Astro middleware for @ovixa/auth-client
+ *
+ * Provides authentication middleware for Astro applications using cookie-based sessions.
+ *
+ * @example
+ * ```typescript
+ * // src/middleware.ts
+ * import { createAstroAuth } from '@ovixa/auth-client/astro';
+ * import { auth } from './lib/auth';
+ *
+ * export const onRequest = createAstroAuth({
+ *   auth,
+ *   publicRoutes: ['/', '/login', '/signup', '/api/public/*'],
+ *   loginRedirect: '/login',
+ * });
+ *
+ * // Access in pages/layouts:
+ * const { user, isAuthenticated } = Astro.locals.auth;
+ * ```
+ */
+
+/**
+ * Astro APIContext type (minimal subset we need).
+ * We use this instead of importing from 'astro' to avoid requiring it as a dependency.
+ */
+interface AstroAPIContext {
+    url: URL;
+    cookies: AstroCookies;
+    locals: AstroLocals;
+    redirect: (path: string, status?: number) => Response;
+}
+interface AstroCookies {
+    get(name: string): {
+        value: string;
+    } | undefined;
+    set(name: string, value: string, options?: AstroCookieSetOptions): void;
+    delete(name: string, options?: AstroCookieDeleteOptions): void;
+}
+interface AstroCookieSetOptions {
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none';
+    domain?: string;
+    maxAge?: number;
+    expires?: Date;
+}
+interface AstroCookieDeleteOptions {
+    path?: string;
+    domain?: string;
+}
+interface AstroLocals {
+    auth?: AuthContext;
+    [key: string]: unknown;
+}
+/**
+ * Astro middleware handler type.
+ */
+type AstroMiddlewareHandler = (context: AstroAPIContext, next: () => Promise<Response>) => Promise<Response>;
+/**
+ * Create Astro authentication middleware.
+ *
+ * This middleware:
+ * - Checks authentication status from cookies on each request
+ * - Automatically refreshes expired access tokens using refresh tokens
+ * - Sets `Astro.locals.auth` with the authentication context
+ * - Optionally redirects unauthenticated requests to a login page
+ * - Allows public routes to bypass authentication
+ *
+ * @param config - Middleware configuration
+ * @returns Astro middleware handler
+ *
+ * @example
+ * ```typescript
+ * // src/middleware.ts
+ * import { createAstroAuth } from '@ovixa/auth-client/astro';
+ * import { OvixaAuth } from '@ovixa/auth-client';
+ *
+ * const auth = new OvixaAuth({
+ *   authUrl: import.meta.env.AUTH_URL,
+ *   realmId: import.meta.env.AUTH_REALM_ID,
+ * });
+ *
+ * export const onRequest = createAstroAuth({
+ *   auth,
+ *   publicRoutes: ['/', '/login', '/signup'],
+ *   loginRedirect: '/login',
+ *   cookies: {
+ *     secure: import.meta.env.PROD,
+ *   },
+ * });
+ * ```
+ */
+declare function createAstroAuth(config: AuthMiddlewareConfig): AstroMiddlewareHandler;
+/**
+ * Set authentication cookies after login.
+ *
+ * Call this after a successful login to store tokens in cookies.
+ *
+ * @param context - Astro API context (from Astro global or API route)
+ * @param tokens - Token response from login/verify/OAuth callback
+ * @param cookieOptions - Optional cookie configuration overrides
+ *
+ * @example
+ * ```typescript
+ * // src/pages/api/login.ts
+ * import { setAstroAuthCookies } from '@ovixa/auth-client/astro';
+ * import { auth } from '../../lib/auth';
+ *
+ * export async function POST({ request, cookies }: APIContext) {
+ *   const { email, password } = await request.json();
+ *   const tokens = await auth.login({ email, password });
+ *
+ *   setAstroAuthCookies({ cookies }, tokens);
+ *
+ *   return new Response(JSON.stringify({ success: true }));
+ * }
+ * ```
+ */
+declare function setAstroAuthCookies(context: Pick<AstroAPIContext, 'cookies'>, tokens: TokenResponse, cookieOptions?: CookieOptions): void;
+/**
+ * Clear authentication cookies on logout.
+ *
+ * Call this to log out the user by removing their session cookies.
+ *
+ * @param context - Astro API context
+ * @param cookieOptions - Optional cookie configuration overrides
+ *
+ * @example
+ * ```typescript
+ * // src/pages/api/logout.ts
+ * import { clearAstroAuthCookies } from '@ovixa/auth-client/astro';
+ * import { auth } from '../../lib/auth';
+ *
+ * export async function POST({ cookies, locals }: APIContext) {
+ *   // Revoke refresh token on server
+ *   if (locals.auth?.session?.refreshToken) {
+ *     await auth.logout(locals.auth.session.refreshToken);
+ *   }
+ *
+ *   // Clear cookies
+ *   clearAstroAuthCookies({ cookies });
+ *
+ *   return new Response(JSON.stringify({ success: true }));
+ * }
+ * ```
+ */
+declare function clearAstroAuthCookies(context: Pick<AstroAPIContext, 'cookies'>, cookieOptions?: CookieOptions): void;
+
+export { AuthContext, AuthMiddlewareConfig, CookieOptions, clearAstroAuthCookies, createAstroAuth, setAstroAuthCookies };

package/dist/middleware/astro.js

@@ -0,0 +1,75 @@
+import {
+  checkAuth,
+  clearAuthCookies,
+  isPublicRoute,
+  setAuthCookies
+} from "../chunk-Y5NJCTZO.js";
+import "../chunk-UHRF6AFJ.js";
+
+// src/middleware/astro.ts
+var AstroCookieAdapter = class {
+  constructor(cookies) {
+    this.cookies = cookies;
+  }
+  getCookie(name) {
+    return this.cookies.get(name)?.value;
+  }
+  setCookie(name, value, options) {
+    this.cookies.set(name, value, {
+      path: options.path,
+      secure: options.secure,
+      httpOnly: options.httpOnly,
+      sameSite: options.sameSite,
+      domain: options.domain,
+      maxAge: options.maxAge,
+      expires: options.expires
+    });
+  }
+  deleteCookie(name, options) {
+    this.cookies.delete(name, {
+      path: options.path,
+      domain: options.domain
+    });
+  }
+};
+function createAstroAuth(config) {
+  const { auth, cookies, publicRoutes = [], loginRedirect, autoRefresh = true } = config;
+  return async (context, next) => {
+    const path = context.url.pathname;
+    const isPublic = isPublicRoute(path, publicRoutes);
+    const adapter = new AstroCookieAdapter(context.cookies);
+    const result = await checkAuth(auth, adapter, cookies, autoRefresh);
+    if (result.newTokens) {
+      setAuthCookies(adapter, result.newTokens, cookies);
+    }
+    context.locals.auth = result.context;
+    if (result.context.isAuthenticated || isPublic) {
+      return next();
+    }
+    if (loginRedirect) {
+      const returnUrl = encodeURIComponent(context.url.pathname + context.url.search);
+      const redirectUrl = `${loginRedirect}?returnUrl=${returnUrl}`;
+      return context.redirect(redirectUrl, 302);
+    }
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: {
+        "Content-Type": "application/json"
+      }
+    });
+  };
+}
+function setAstroAuthCookies(context, tokens, cookieOptions) {
+  const adapter = new AstroCookieAdapter(context.cookies);
+  setAuthCookies(adapter, tokens, cookieOptions);
+}
+function clearAstroAuthCookies(context, cookieOptions) {
+  const adapter = new AstroCookieAdapter(context.cookies);
+  clearAuthCookies(adapter, cookieOptions);
+}
+export {
+  clearAstroAuthCookies,
+  createAstroAuth,
+  setAstroAuthCookies
+};
+//# sourceMappingURL=astro.js.map

package/dist/middleware/astro.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/middleware/astro.ts"],"sourcesContent":["/**\n * Astro middleware for @ovixa/auth-client\n *\n * Provides authentication middleware for Astro applications using cookie-based sessions.\n *\n * @example\n * ```typescript\n * // src/middleware.ts\n * import { createAstroAuth } from '@ovixa/auth-client/astro';\n * import { auth } from './lib/auth';\n *\n * export const onRequest = createAstroAuth({\n *   auth,\n *   publicRoutes: ['/', '/login', '/signup', '/api/public/*'],\n *   loginRedirect: '/login',\n * });\n *\n * // Access in pages/layouts:\n * const { user, isAuthenticated } = Astro.locals.auth;\n * ```\n */\n\nimport type { TokenResponse } from '../index.js';\nimport type {\n  AuthMiddlewareConfig,\n  AuthContext,\n  CookieAdapter,\n  SetCookieOptions,\n  DeleteCookieOptions,\n  CookieOptions,\n} from './types.js';\nimport { isPublicRoute } from './types.js';\nimport {\n  checkAuth,\n  setAuthCookies as coreSetAuthCookies,\n  clearAuthCookies as coreClearAuthCookies,\n} from './core.js';\n\n/**\n * Astro APIContext type (minimal subset we need).\n * We use this instead of importing from 'astro' to avoid requiring it as a dependency.\n */\ninterface AstroAPIContext {\n  url: URL;\n  cookies: AstroCookies;\n  locals: AstroLocals;\n  redirect: (path: string, status?: number) => Response;\n}\n\ninterface AstroCookies {\n  get(name: string): { value: string } | undefined;\n  set(name: string, value: string, options?: AstroCookieSetOptions): void;\n  delete(name: string, options?: AstroCookieDeleteOptions): void;\n}\n\ninterface AstroCookieSetOptions {\n  path?: string;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: 'strict' | 'lax' | 'none';\n  domain?: string;\n  maxAge?: number;\n  expires?: Date;\n}\n\ninterface AstroCookieDeleteOptions {\n  path?: string;\n  domain?: string;\n}\n\ninterface AstroLocals {\n  auth?: AuthContext;\n  [key: string]: unknown;\n}\n\n/**\n * Astro middleware handler type.\n */\ntype AstroMiddlewareHandler = (\n  context: AstroAPIContext,\n  next: () => Promise<Response>\n) => Promise<Response>;\n\n/**\n * Cookie adapter for Astro's cookie API.\n */\nclass AstroCookieAdapter implements CookieAdapter {\n  constructor(private cookies: AstroCookies) {}\n\n  getCookie(name: string): string | undefined {\n    return this.cookies.get(name)?.value;\n  }\n\n  setCookie(name: string, value: string, options: SetCookieOptions): void {\n    this.cookies.set(name, value, {\n      path: options.path,\n      secure: options.secure,\n      httpOnly: options.httpOnly,\n      sameSite: options.sameSite,\n      domain: options.domain,\n      maxAge: options.maxAge,\n      expires: options.expires,\n    });\n  }\n\n  deleteCookie(name: string, options: DeleteCookieOptions): void {\n    this.cookies.delete(name, {\n      path: options.path,\n      domain: options.domain,\n    });\n  }\n}\n\n/**\n * Create Astro authentication middleware.\n *\n * This middleware:\n * - Checks authentication status from cookies on each request\n * - Automatically refreshes expired access tokens using refresh tokens\n * - Sets `Astro.locals.auth` with the authentication context\n * - Optionally redirects unauthenticated requests to a login page\n * - Allows public routes to bypass authentication\n *\n * @param config - Middleware configuration\n * @returns Astro middleware handler\n *\n * @example\n * ```typescript\n * // src/middleware.ts\n * import { createAstroAuth } from '@ovixa/auth-client/astro';\n * import { OvixaAuth } from '@ovixa/auth-client';\n *\n * const auth = new OvixaAuth({\n *   authUrl: import.meta.env.AUTH_URL,\n *   realmId: import.meta.env.AUTH_REALM_ID,\n * });\n *\n * export const onRequest = createAstroAuth({\n *   auth,\n *   publicRoutes: ['/', '/login', '/signup'],\n *   loginRedirect: '/login',\n *   cookies: {\n *     secure: import.meta.env.PROD,\n *   },\n * });\n * ```\n */\nexport function createAstroAuth(config: AuthMiddlewareConfig): AstroMiddlewareHandler {\n  const { auth, cookies, publicRoutes = [], loginRedirect, autoRefresh = true } = config;\n\n  return async (context: AstroAPIContext, next: () => Promise<Response>): Promise<Response> => {\n    const path = context.url.pathname;\n\n    // Check if this is a public route\n    const isPublic = isPublicRoute(path, publicRoutes);\n\n    // Create cookie adapter\n    const adapter = new AstroCookieAdapter(context.cookies);\n\n    // Check authentication status\n    const result = await checkAuth(auth, adapter, cookies, autoRefresh);\n\n    // If tokens were refreshed, update cookies\n    if (result.newTokens) {\n      coreSetAuthCookies(adapter, result.newTokens, cookies);\n    }\n\n    // Set auth context in locals\n    context.locals.auth = result.context;\n\n    // If authenticated or public route, continue\n    if (result.context.isAuthenticated || isPublic) {\n      return next();\n    }\n\n    // Not authenticated and not public - redirect or return 401\n    if (loginRedirect) {\n      // Add return URL as query param for redirect after login\n      const returnUrl = encodeURIComponent(context.url.pathname + context.url.search);\n      const redirectUrl = `${loginRedirect}?returnUrl=${returnUrl}`;\n      return context.redirect(redirectUrl, 302);\n    }\n\n    // Return 401 Unauthorized\n    return new Response(JSON.stringify({ error: 'Unauthorized' }), {\n      status: 401,\n      headers: {\n        'Content-Type': 'application/json',\n      },\n    });\n  };\n}\n\n/**\n * Set authentication cookies after login.\n *\n * Call this after a successful login to store tokens in cookies.\n *\n * @param context - Astro API context (from Astro global or API route)\n * @param tokens - Token response from login/verify/OAuth callback\n * @param cookieOptions - Optional cookie configuration overrides\n *\n * @example\n * ```typescript\n * // src/pages/api/login.ts\n * import { setAstroAuthCookies } from '@ovixa/auth-client/astro';\n * import { auth } from '../../lib/auth';\n *\n * export async function POST({ request, cookies }: APIContext) {\n *   const { email, password } = await request.json();\n *   const tokens = await auth.login({ email, password });\n *\n *   setAstroAuthCookies({ cookies }, tokens);\n *\n *   return new Response(JSON.stringify({ success: true }));\n * }\n * ```\n */\nexport function setAstroAuthCookies(\n  context: Pick<AstroAPIContext, 'cookies'>,\n  tokens: TokenResponse,\n  cookieOptions?: CookieOptions\n): void {\n  const adapter = new AstroCookieAdapter(context.cookies);\n  coreSetAuthCookies(adapter, tokens, cookieOptions);\n}\n\n/**\n * Clear authentication cookies on logout.\n *\n * Call this to log out the user by removing their session cookies.\n *\n * @param context - Astro API context\n * @param cookieOptions - Optional cookie configuration overrides\n *\n * @example\n * ```typescript\n * // src/pages/api/logout.ts\n * import { clearAstroAuthCookies } from '@ovixa/auth-client/astro';\n * import { auth } from '../../lib/auth';\n *\n * export async function POST({ cookies, locals }: APIContext) {\n *   // Revoke refresh token on server\n *   if (locals.auth?.session?.refreshToken) {\n *     await auth.logout(locals.auth.session.refreshToken);\n *   }\n *\n *   // Clear cookies\n *   clearAstroAuthCookies({ cookies });\n *\n *   return new Response(JSON.stringify({ success: true }));\n * }\n * ```\n */\nexport function clearAstroAuthCookies(\n  context: Pick<AstroAPIContext, 'cookies'>,\n  cookieOptions?: CookieOptions\n): void {\n  const adapter = new AstroCookieAdapter(context.cookies);\n  coreClearAuthCookies(adapter, cookieOptions);\n}\n\n// Re-export types for convenience\nexport type { AuthMiddlewareConfig, AuthContext, CookieOptions } from './types.js';\n"],"mappings":";;;;;;;;;AAsFA,IAAM,qBAAN,MAAkD;AAAA,EAChD,YAAoB,SAAuB;AAAvB;AAAA,EAAwB;AAAA,EAE5C,UAAU,MAAkC;AAC1C,WAAO,KAAK,QAAQ,IAAI,IAAI,GAAG;AAAA,EACjC;AAAA,EAEA,UAAU,MAAc,OAAe,SAAiC;AACtE,SAAK,QAAQ,IAAI,MAAM,OAAO;AAAA,MAC5B,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,MAChB,SAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,MAAc,SAAoC;AAC7D,SAAK,QAAQ,OAAO,MAAM;AAAA,MACxB,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoCO,SAAS,gBAAgB,QAAsD;AACpF,QAAM,EAAE,MAAM,SAAS,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK,IAAI;AAEhF,SAAO,OAAO,SAA0B,SAAqD;AAC3F,UAAM,OAAO,QAAQ,IAAI;AAGzB,UAAM,WAAW,cAAc,MAAM,YAAY;AAGjD,UAAM,UAAU,IAAI,mBAAmB,QAAQ,OAAO;AAGtD,UAAM,SAAS,MAAM,UAAU,MAAM,SAAS,SAAS,WAAW;AAGlE,QAAI,OAAO,WAAW;AACpB,qBAAmB,SAAS,OAAO,WAAW,OAAO;AAAA,IACvD;AAGA,YAAQ,OAAO,OAAO,OAAO;AAG7B,QAAI,OAAO,QAAQ,mBAAmB,UAAU;AAC9C,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,eAAe;AAEjB,YAAM,YAAY,mBAAmB,QAAQ,IAAI,WAAW,QAAQ,IAAI,MAAM;AAC9E,YAAM,cAAc,GAAG,aAAa,cAAc,SAAS;AAC3D,aAAO,QAAQ,SAAS,aAAa,GAAG;AAAA,IAC1C;AAGA,WAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,eAAe,CAAC,GAAG;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AA2BO,SAAS,oBACd,SACA,QACA,eACM;AACN,QAAM,UAAU,IAAI,mBAAmB,QAAQ,OAAO;AACtD,iBAAmB,SAAS,QAAQ,aAAa;AACnD;AA6BO,SAAS,sBACd,SACA,eACM;AACN,QAAM,UAAU,IAAI,mBAAmB,QAAQ,OAAO;AACtD,mBAAqB,SAAS,aAAa;AAC7C;","names":[]}

package/dist/middleware/express.d.ts

@@ -0,0 +1,197 @@
+import { TokenResponse } from '../index.js';
+import { A as AuthMiddlewareConfig, a as AuthContext, C as CookieOptions } from '../types-Czfah64-.js';
+import 'jose';
+
+/**
+ * Express middleware for @ovixa/auth-client
+ *
+ * Provides authentication middleware for Express applications using cookie-based sessions.
+ *
+ * @example
+ * ```typescript
+ * import express from 'express';
+ * import cookieParser from 'cookie-parser';
+ * import { createExpressAuth, requireAuth } from '@ovixa/auth-client/express';
+ * import { auth } from './lib/auth';
+ *
+ * const app = express();
+ * app.use(cookieParser());
+ * app.use(createExpressAuth({
+ *   auth,
+ *   publicRoutes: ['/', '/login', '/signup', '/api/public/*'],
+ *   loginRedirect: '/login',
+ * }));
+ *
+ * // Protected routes
+ * app.get('/api/me', requireAuth(), (req, res) => {
+ *   res.json({ user: req.auth.user });
+ * });
+ * ```
+ */
+
+/**
+ * Express Request type (minimal subset we need).
+ * We use this instead of importing from 'express' to avoid requiring it as a dependency.
+ */
+interface ExpressRequest {
+    path: string;
+    url: string;
+    originalUrl: string;
+    cookies: Record<string, string>;
+    auth?: AuthContext;
+}
+/**
+ * Express Response type (minimal subset we need).
+ */
+interface ExpressResponse {
+    cookie(name: string, value: string, options?: ExpressCookieOptions): this;
+    clearCookie(name: string, options?: ExpressClearCookieOptions): this;
+    redirect(url: string): void;
+    redirect(status: number, url: string): void;
+    status(code: number): this;
+    json(body: unknown): this;
+}
+interface ExpressCookieOptions {
+    path?: string;
+    secure?: boolean;
+    httpOnly?: boolean;
+    sameSite?: 'strict' | 'lax' | 'none' | boolean;
+    domain?: string;
+    maxAge?: number;
+    expires?: Date;
+}
+interface ExpressClearCookieOptions {
+    path?: string;
+    domain?: string;
+}
+/**
+ * Express next function.
+ */
+type ExpressNextFunction = (err?: unknown) => void;
+/**
+ * Express middleware handler type.
+ */
+type ExpressMiddleware = (req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void | Promise<void>;
+/**
+ * Create Express authentication middleware.
+ *
+ * This middleware:
+ * - Checks authentication status from cookies on each request
+ * - Automatically refreshes expired access tokens using refresh tokens
+ * - Sets `req.auth` with the authentication context
+ * - Optionally redirects unauthenticated requests to a login page
+ * - Allows public routes to bypass authentication
+ *
+ * **Note:** Requires `cookie-parser` middleware to be installed and used before this middleware.
+ *
+ * @param config - Middleware configuration
+ * @returns Express middleware
+ *
+ * @example
+ * ```typescript
+ * import express from 'express';
+ * import cookieParser from 'cookie-parser';
+ * import { createExpressAuth } from '@ovixa/auth-client/express';
+ * import { OvixaAuth } from '@ovixa/auth-client';
+ *
+ * const auth = new OvixaAuth({
+ *   authUrl: process.env.AUTH_URL!,
+ *   realmId: process.env.AUTH_REALM_ID!,
+ * });
+ *
+ * const app = express();
+ * app.use(cookieParser());
+ * app.use(createExpressAuth({
+ *   auth,
+ *   publicRoutes: ['/', '/login', '/signup'],
+ *   loginRedirect: '/login',
+ *   cookies: {
+ *     secure: process.env.NODE_ENV === 'production',
+ *   },
+ * }));
+ * ```
+ */
+declare function createExpressAuth(config: AuthMiddlewareConfig): ExpressMiddleware;
+/**
+ * Express middleware to require authentication on specific routes.
+ *
+ * Use this as an additional guard on routes that must be authenticated,
+ * even when the main middleware is configured with `loginRedirect`.
+ *
+ * @param options - Optional configuration
+ * @returns Express middleware
+ *
+ * @example
+ * ```typescript
+ * import { requireAuth } from '@ovixa/auth-client/express';
+ *
+ * // API route that requires authentication (returns 401 if not authenticated)
+ * app.get('/api/me', requireAuth(), (req, res) => {
+ *   res.json({ user: req.auth.user });
+ * });
+ *
+ * // API route with custom redirect
+ * app.get('/dashboard', requireAuth({ redirect: '/login' }), (req, res) => {
+ *   res.render('dashboard', { user: req.auth.user });
+ * });
+ * ```
+ */
+declare function requireAuth(options?: {
+    redirect?: string;
+}): ExpressMiddleware;
+/**
+ * Set authentication cookies after login.
+ *
+ * Call this after a successful login to store tokens in cookies.
+ *
+ * @param res - Express response object
+ * @param req - Express request object (for adapter consistency)
+ * @param tokens - Token response from login/verify/OAuth callback
+ * @param cookieOptions - Optional cookie configuration overrides
+ *
+ * @example
+ * ```typescript
+ * import { setExpressAuthCookies } from '@ovixa/auth-client/express';
+ * import { auth } from './lib/auth';
+ *
+ * app.post('/api/login', async (req, res) => {
+ *   const { email, password } = req.body;
+ *   const tokens = await auth.login({ email, password });
+ *
+ *   setExpressAuthCookies(res, req, tokens);
+ *
+ *   res.json({ success: true });
+ * });
+ * ```
+ */
+declare function setExpressAuthCookies(res: ExpressResponse, req: ExpressRequest, tokens: TokenResponse, cookieOptions?: CookieOptions): void;
+/**
+ * Clear authentication cookies on logout.
+ *
+ * Call this to log out the user by removing their session cookies.
+ *
+ * @param res - Express response object
+ * @param req - Express request object (for adapter consistency)
+ * @param cookieOptions - Optional cookie configuration overrides
+ *
+ * @example
+ * ```typescript
+ * import { clearExpressAuthCookies } from '@ovixa/auth-client/express';
+ * import { auth } from './lib/auth';
+ *
+ * app.post('/api/logout', async (req, res) => {
+ *   // Revoke refresh token on server
+ *   if (req.auth?.session?.refreshToken) {
+ *     await auth.logout(req.auth.session.refreshToken);
+ *   }
+ *
+ *   // Clear cookies
+ *   clearExpressAuthCookies(res, req);
+ *
+ *   res.json({ success: true });
+ * });
+ * ```
+ */
+declare function clearExpressAuthCookies(res: ExpressResponse, req: ExpressRequest, cookieOptions?: CookieOptions): void;
+
+export { AuthContext, AuthMiddlewareConfig, CookieOptions, clearExpressAuthCookies, createExpressAuth, requireAuth, setExpressAuthCookies };

package/dist/middleware/express.js

@@ -0,0 +1,87 @@
+import {
+  checkAuth,
+  clearAuthCookies,
+  isPublicRoute,
+  setAuthCookies
+} from "../chunk-Y5NJCTZO.js";
+import "../chunk-UHRF6AFJ.js";
+
+// src/middleware/express.ts
+var ExpressCookieAdapter = class {
+  constructor(req, res) {
+    this.req = req;
+    this.res = res;
+  }
+  getCookie(name) {
+    return this.req.cookies[name];
+  }
+  setCookie(name, value, options) {
+    this.res.cookie(name, value, {
+      path: options.path,
+      secure: options.secure,
+      httpOnly: options.httpOnly,
+      sameSite: options.sameSite,
+      domain: options.domain,
+      maxAge: options.maxAge ? options.maxAge * 1e3 : void 0,
+      // Express uses milliseconds
+      expires: options.expires
+    });
+  }
+  deleteCookie(name, options) {
+    this.res.clearCookie(name, {
+      path: options.path,
+      domain: options.domain
+    });
+  }
+};
+function createExpressAuth(config) {
+  const { auth, cookies, publicRoutes = [], loginRedirect, autoRefresh = true } = config;
+  return async (req, res, next) => {
+    const path = req.path;
+    const isPublic = isPublicRoute(path, publicRoutes);
+    const adapter = new ExpressCookieAdapter(req, res);
+    const result = await checkAuth(auth, adapter, cookies, autoRefresh);
+    if (result.newTokens) {
+      setAuthCookies(adapter, result.newTokens, cookies);
+    }
+    req.auth = result.context;
+    if (result.context.isAuthenticated || isPublic) {
+      return next();
+    }
+    if (loginRedirect) {
+      const returnUrl = encodeURIComponent(req.originalUrl);
+      const redirectUrl = `${loginRedirect}?returnUrl=${returnUrl}`;
+      res.redirect(302, redirectUrl);
+      return;
+    }
+    res.status(401).json({ error: "Unauthorized" });
+  };
+}
+function requireAuth(options) {
+  return (req, res, next) => {
+    if (req.auth?.isAuthenticated) {
+      return next();
+    }
+    if (options?.redirect) {
+      const returnUrl = encodeURIComponent(req.originalUrl);
+      res.redirect(302, `${options.redirect}?returnUrl=${returnUrl}`);
+      return;
+    }
+    res.status(401).json({ error: "Unauthorized" });
+  };
+}
+function setExpressAuthCookies(res, req, tokens, cookieOptions) {
+  const adapter = new ExpressCookieAdapter(req, res);
+  setAuthCookies(adapter, tokens, cookieOptions);
+}
+function clearExpressAuthCookies(res, req, cookieOptions) {
+  const adapter = new ExpressCookieAdapter(req, res);
+  clearAuthCookies(adapter, cookieOptions);
+}
+export {
+  clearExpressAuthCookies,
+  createExpressAuth,
+  requireAuth,
+  setExpressAuthCookies
+};
+//# sourceMappingURL=express.js.map

package/dist/middleware/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/middleware/express.ts"],"sourcesContent":["/**\n * Express middleware for @ovixa/auth-client\n *\n * Provides authentication middleware for Express applications using cookie-based sessions.\n *\n * @example\n * ```typescript\n * import express from 'express';\n * import cookieParser from 'cookie-parser';\n * import { createExpressAuth, requireAuth } from '@ovixa/auth-client/express';\n * import { auth } from './lib/auth';\n *\n * const app = express();\n * app.use(cookieParser());\n * app.use(createExpressAuth({\n *   auth,\n *   publicRoutes: ['/', '/login', '/signup', '/api/public/*'],\n *   loginRedirect: '/login',\n * }));\n *\n * // Protected routes\n * app.get('/api/me', requireAuth(), (req, res) => {\n *   res.json({ user: req.auth.user });\n * });\n * ```\n */\n\nimport type { TokenResponse } from '../index.js';\nimport type {\n  AuthMiddlewareConfig,\n  AuthContext,\n  CookieAdapter,\n  SetCookieOptions,\n  DeleteCookieOptions,\n  CookieOptions,\n} from './types.js';\nimport { isPublicRoute } from './types.js';\nimport {\n  checkAuth,\n  setAuthCookies as coreSetAuthCookies,\n  clearAuthCookies as coreClearAuthCookies,\n} from './core.js';\n\n/**\n * Express Request type (minimal subset we need).\n * We use this instead of importing from 'express' to avoid requiring it as a dependency.\n */\ninterface ExpressRequest {\n  path: string;\n  url: string;\n  originalUrl: string;\n  cookies: Record<string, string>;\n  auth?: AuthContext;\n}\n\n/**\n * Express Response type (minimal subset we need).\n */\ninterface ExpressResponse {\n  cookie(name: string, value: string, options?: ExpressCookieOptions): this;\n  clearCookie(name: string, options?: ExpressClearCookieOptions): this;\n  redirect(url: string): void;\n  redirect(status: number, url: string): void;\n  status(code: number): this;\n  json(body: unknown): this;\n}\n\ninterface ExpressCookieOptions {\n  path?: string;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: 'strict' | 'lax' | 'none' | boolean;\n  domain?: string;\n  maxAge?: number;\n  expires?: Date;\n}\n\ninterface ExpressClearCookieOptions {\n  path?: string;\n  domain?: string;\n}\n\n/**\n * Express next function.\n */\ntype ExpressNextFunction = (err?: unknown) => void;\n\n/**\n * Express middleware handler type.\n */\ntype ExpressMiddleware = (\n  req: ExpressRequest,\n  res: ExpressResponse,\n  next: ExpressNextFunction\n) => void | Promise<void>;\n\n/**\n * Cookie adapter for Express's cookie API.\n *\n * Requires `cookie-parser` middleware to be installed and used before this middleware.\n */\nclass ExpressCookieAdapter implements CookieAdapter {\n  constructor(\n    private req: ExpressRequest,\n    private res: ExpressResponse\n  ) {}\n\n  getCookie(name: string): string | undefined {\n    return this.req.cookies[name];\n  }\n\n  setCookie(name: string, value: string, options: SetCookieOptions): void {\n    this.res.cookie(name, value, {\n      path: options.path,\n      secure: options.secure,\n      httpOnly: options.httpOnly,\n      sameSite: options.sameSite,\n      domain: options.domain,\n      maxAge: options.maxAge ? options.maxAge * 1000 : undefined, // Express uses milliseconds\n      expires: options.expires,\n    });\n  }\n\n  deleteCookie(name: string, options: DeleteCookieOptions): void {\n    this.res.clearCookie(name, {\n      path: options.path,\n      domain: options.domain,\n    });\n  }\n}\n\n/**\n * Create Express authentication middleware.\n *\n * This middleware:\n * - Checks authentication status from cookies on each request\n * - Automatically refreshes expired access tokens using refresh tokens\n * - Sets `req.auth` with the authentication context\n * - Optionally redirects unauthenticated requests to a login page\n * - Allows public routes to bypass authentication\n *\n * **Note:** Requires `cookie-parser` middleware to be installed and used before this middleware.\n *\n * @param config - Middleware configuration\n * @returns Express middleware\n *\n * @example\n * ```typescript\n * import express from 'express';\n * import cookieParser from 'cookie-parser';\n * import { createExpressAuth } from '@ovixa/auth-client/express';\n * import { OvixaAuth } from '@ovixa/auth-client';\n *\n * const auth = new OvixaAuth({\n *   authUrl: process.env.AUTH_URL!,\n *   realmId: process.env.AUTH_REALM_ID!,\n * });\n *\n * const app = express();\n * app.use(cookieParser());\n * app.use(createExpressAuth({\n *   auth,\n *   publicRoutes: ['/', '/login', '/signup'],\n *   loginRedirect: '/login',\n *   cookies: {\n *     secure: process.env.NODE_ENV === 'production',\n *   },\n * }));\n * ```\n */\nexport function createExpressAuth(config: AuthMiddlewareConfig): ExpressMiddleware {\n  const { auth, cookies, publicRoutes = [], loginRedirect, autoRefresh = true } = config;\n\n  return async (\n    req: ExpressRequest,\n    res: ExpressResponse,\n    next: ExpressNextFunction\n  ): Promise<void> => {\n    const path = req.path;\n\n    // Check if this is a public route\n    const isPublic = isPublicRoute(path, publicRoutes);\n\n    // Create cookie adapter\n    const adapter = new ExpressCookieAdapter(req, res);\n\n    // Check authentication status\n    const result = await checkAuth(auth, adapter, cookies, autoRefresh);\n\n    // If tokens were refreshed, update cookies\n    if (result.newTokens) {\n      coreSetAuthCookies(adapter, result.newTokens, cookies);\n    }\n\n    // Set auth context on request\n    req.auth = result.context;\n\n    // If authenticated or public route, continue\n    if (result.context.isAuthenticated || isPublic) {\n      return next();\n    }\n\n    // Not authenticated and not public - redirect or return 401\n    if (loginRedirect) {\n      // Add return URL as query param for redirect after login\n      const returnUrl = encodeURIComponent(req.originalUrl);\n      const redirectUrl = `${loginRedirect}?returnUrl=${returnUrl}`;\n      res.redirect(302, redirectUrl);\n      return;\n    }\n\n    // Return 401 Unauthorized\n    res.status(401).json({ error: 'Unauthorized' });\n  };\n}\n\n/**\n * Express middleware to require authentication on specific routes.\n *\n * Use this as an additional guard on routes that must be authenticated,\n * even when the main middleware is configured with `loginRedirect`.\n *\n * @param options - Optional configuration\n * @returns Express middleware\n *\n * @example\n * ```typescript\n * import { requireAuth } from '@ovixa/auth-client/express';\n *\n * // API route that requires authentication (returns 401 if not authenticated)\n * app.get('/api/me', requireAuth(), (req, res) => {\n *   res.json({ user: req.auth.user });\n * });\n *\n * // API route with custom redirect\n * app.get('/dashboard', requireAuth({ redirect: '/login' }), (req, res) => {\n *   res.render('dashboard', { user: req.auth.user });\n * });\n * ```\n */\nexport function requireAuth(options?: { redirect?: string }): ExpressMiddleware {\n  return (req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction): void => {\n    if (req.auth?.isAuthenticated) {\n      return next();\n    }\n\n    if (options?.redirect) {\n      const returnUrl = encodeURIComponent(req.originalUrl);\n      res.redirect(302, `${options.redirect}?returnUrl=${returnUrl}`);\n      return;\n    }\n\n    res.status(401).json({ error: 'Unauthorized' });\n  };\n}\n\n/**\n * Set authentication cookies after login.\n *\n * Call this after a successful login to store tokens in cookies.\n *\n * @param res - Express response object\n * @param req - Express request object (for adapter consistency)\n * @param tokens - Token response from login/verify/OAuth callback\n * @param cookieOptions - Optional cookie configuration overrides\n *\n * @example\n * ```typescript\n * import { setExpressAuthCookies } from '@ovixa/auth-client/express';\n * import { auth } from './lib/auth';\n *\n * app.post('/api/login', async (req, res) => {\n *   const { email, password } = req.body;\n *   const tokens = await auth.login({ email, password });\n *\n *   setExpressAuthCookies(res, req, tokens);\n *\n *   res.json({ success: true });\n * });\n * ```\n */\nexport function setExpressAuthCookies(\n  res: ExpressResponse,\n  req: ExpressRequest,\n  tokens: TokenResponse,\n  cookieOptions?: CookieOptions\n): void {\n  const adapter = new ExpressCookieAdapter(req, res);\n  coreSetAuthCookies(adapter, tokens, cookieOptions);\n}\n\n/**\n * Clear authentication cookies on logout.\n *\n * Call this to log out the user by removing their session cookies.\n *\n * @param res - Express response object\n * @param req - Express request object (for adapter consistency)\n * @param cookieOptions - Optional cookie configuration overrides\n *\n * @example\n * ```typescript\n * import { clearExpressAuthCookies } from '@ovixa/auth-client/express';\n * import { auth } from './lib/auth';\n *\n * app.post('/api/logout', async (req, res) => {\n *   // Revoke refresh token on server\n *   if (req.auth?.session?.refreshToken) {\n *     await auth.logout(req.auth.session.refreshToken);\n *   }\n *\n *   // Clear cookies\n *   clearExpressAuthCookies(res, req);\n *\n *   res.json({ success: true });\n * });\n * ```\n */\nexport function clearExpressAuthCookies(\n  res: ExpressResponse,\n  req: ExpressRequest,\n  cookieOptions?: CookieOptions\n): void {\n  const adapter = new ExpressCookieAdapter(req, res);\n  coreClearAuthCookies(adapter, cookieOptions);\n}\n\n// Re-export types for convenience\nexport type { AuthMiddlewareConfig, AuthContext, CookieOptions } from './types.js';\n"],"mappings":";;;;;;;;;AAqGA,IAAM,uBAAN,MAAoD;AAAA,EAClD,YACU,KACA,KACR;AAFQ;AACA;AAAA,EACP;AAAA,EAEH,UAAU,MAAkC;AAC1C,WAAO,KAAK,IAAI,QAAQ,IAAI;AAAA,EAC9B;AAAA,EAEA,UAAU,MAAc,OAAe,SAAiC;AACtE,SAAK,IAAI,OAAO,MAAM,OAAO;AAAA,MAC3B,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ,SAAS,QAAQ,SAAS,MAAO;AAAA;AAAA,MACjD,SAAS,QAAQ;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,aAAa,MAAc,SAAoC;AAC7D,SAAK,IAAI,YAAY,MAAM;AAAA,MACzB,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAyCO,SAAS,kBAAkB,QAAiD;AACjF,QAAM,EAAE,MAAM,SAAS,eAAe,CAAC,GAAG,eAAe,cAAc,KAAK,IAAI;AAEhF,SAAO,OACL,KACA,KACA,SACkB;AAClB,UAAM,OAAO,IAAI;AAGjB,UAAM,WAAW,cAAc,MAAM,YAAY;AAGjD,UAAM,UAAU,IAAI,qBAAqB,KAAK,GAAG;AAGjD,UAAM,SAAS,MAAM,UAAU,MAAM,SAAS,SAAS,WAAW;AAGlE,QAAI,OAAO,WAAW;AACpB,qBAAmB,SAAS,OAAO,WAAW,OAAO;AAAA,IACvD;AAGA,QAAI,OAAO,OAAO;AAGlB,QAAI,OAAO,QAAQ,mBAAmB,UAAU;AAC9C,aAAO,KAAK;AAAA,IACd;AAGA,QAAI,eAAe;AAEjB,YAAM,YAAY,mBAAmB,IAAI,WAAW;AACpD,YAAM,cAAc,GAAG,aAAa,cAAc,SAAS;AAC3D,UAAI,SAAS,KAAK,WAAW;AAC7B;AAAA,IACF;AAGA,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EAChD;AACF;AA0BO,SAAS,YAAY,SAAoD;AAC9E,SAAO,CAAC,KAAqB,KAAsB,SAAoC;AACrF,QAAI,IAAI,MAAM,iBAAiB;AAC7B,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,SAAS,UAAU;AACrB,YAAM,YAAY,mBAAmB,IAAI,WAAW;AACpD,UAAI,SAAS,KAAK,GAAG,QAAQ,QAAQ,cAAc,SAAS,EAAE;AAC9D;AAAA,IACF;AAEA,QAAI,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,eAAe,CAAC;AAAA,EAChD;AACF;AA2BO,SAAS,sBACd,KACA,KACA,QACA,eACM;AACN,QAAM,UAAU,IAAI,qBAAqB,KAAK,GAAG;AACjD,iBAAmB,SAAS,QAAQ,aAAa;AACnD;AA6BO,SAAS,wBACd,KACA,KACA,eACM;AACN,QAAM,UAAU,IAAI,qBAAqB,KAAK,GAAG;AACjD,mBAAqB,SAAS,aAAa;AAC7C;","names":[]}

package/dist/types-Czfah64-.d.ts

@@ -0,0 +1,57 @@
+import { OvixaAuth, User, Session } from './index.js';
+
+/**
+ * Middleware types for @ovixa/auth-client
+ *
+ * Provides generic adapter interfaces and shared types for framework integrations.
+ */
+
+/**
+ * Cookie configuration options for auth middleware.
+ */
+interface CookieOptions {
+    /** Name of the access token cookie (default: 'ovixa_access_token') */
+    accessTokenCookie?: string;
+    /** Name of the refresh token cookie (default: 'ovixa_refresh_token') */
+    refreshTokenCookie?: string;
+    /** Cookie path (default: '/') */
+    path?: string;
+    /** Whether to use secure cookies (default: true) */
+    secure?: boolean;
+    /** Whether cookies are HTTP-only (default: true) */
+    httpOnly?: boolean;
+    /** SameSite cookie policy (default: 'lax') */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /** Cookie domain (optional, defaults to current domain) */
+    domain?: string;
+    /** Max age for cookies in seconds (optional, defaults to token expiry) */
+    maxAge?: number;
+}
+/**
+ * Configuration for auth middleware.
+ */
+interface AuthMiddlewareConfig {
+    /** OvixaAuth client instance */
+    auth: OvixaAuth;
+    /** Cookie configuration options */
+    cookies?: CookieOptions;
+    /** Routes that don't require authentication */
+    publicRoutes?: string[];
+    /** URL to redirect unauthenticated requests (if not set, returns 401) */
+    loginRedirect?: string;
+    /** Whether to automatically refresh expired tokens (default: true) */
+    autoRefresh?: boolean;
+}
+/**
+ * Authentication context available in request handlers.
+ */
+interface AuthContext {
+    /** The authenticated user, or null if not authenticated */
+    user: User | null;
+    /** The current session, or null if not authenticated */
+    session: Session | null;
+    /** Whether the request is authenticated */
+    isAuthenticated: boolean;
+}
+
+export type { AuthMiddlewareConfig as A, CookieOptions as C, AuthContext as a };