@productcraft/auth-passport 1.0.0 → 1.0.1

package/dist/index.d.cts

@@ -0,0 +1,127 @@
+import { KeyObject } from 'node:crypto';
+import { ConsumerScope } from '@productcraft/auth';
+
+/**
+ * `@productcraft/auth-passport` — passport-jwt adapter for Auth.
+ *
+ * Install alongside `@productcraft/auth` + `passport-jwt`:
+ *
+ * ```bash
+ * npm install @productcraft/auth @productcraft/auth-passport passport-jwt
+ * ```
+ *
+ * Recommended one-call form:
+ *
+ * ```ts
+ * import passportJwt from "passport-jwt";
+ * import passport from "passport";
+ * import { Auth } from "@productcraft/auth";
+ * import { createAuthJwtStrategy } from "@productcraft/auth-passport";
+ *
+ * const auth = new Auth({ auth: { type: "apiKey", key: process.env.PCFT_KEY! } });
+ * const scope = auth.consumer("my-app-slug");
+ *
+ * passport.use(createAuthJwtStrategy(scope, (claims, done) => {
+ *   // claims is the verified Auth claims object (sub, role, permissions, ...)
+ *   return done(null, claims);
+ * }));
+ * ```
+ *
+ * The helper wires `secretOrKeyProvider` + `issuer` (per-app URL) +
+ * `audience` (app slug) + algorithms automatically from the scope.
+ *
+ * If you need the underlying primitives — to compose with your own
+ * options or pass a custom `jwtFromRequest` — use the lower-level
+ * `createPassportSecretOrKeyProvider` directly:
+ *
+ * ```ts
+ * new passportJwt.Strategy(
+ *   {
+ *     jwtFromRequest: passportJwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
+ *     secretOrKeyProvider: createPassportSecretOrKeyProvider(scope),
+ *     issuer: scope.acceptedIssuers as string[],
+ *     audience: scope.expectedAudience,
+ *     algorithms: ["RS256", "ES256"],
+ *   },
+ *   (payload, done) => done(null, payload),
+ * );
+ * ```
+ */
+
+/**
+ * passport-jwt's `secretOrKeyProvider` callback signature. We don't
+ * depend on passport-jwt's types directly (to keep it a soft dep),
+ * so this is the same shape as `SecretOrKeyProvider` in their typings.
+ */
+type PassportSecretOrKeyProvider = (request: unknown, rawJwtToken: string, done: (err: unknown, secretOrKey?: string | Buffer | KeyObject) => void) => void;
+/**
+ * Returns a passport-jwt `secretOrKeyProvider` bound to an Auth
+ * `ConsumerScope`. Decodes the protected header, looks up the matching
+ * key via the scope's JWKS cache, and converts the resulting jose
+ * `CryptoKey` into a Node `KeyObject` that `jsonwebtoken` (the library
+ * passport-jwt delegates to) accepts.
+ */
+declare function createPassportSecretOrKeyProvider(scope: ConsumerScope): PassportSecretOrKeyProvider;
+/**
+ * Shape of the verified-claims callback passport delegates to once a
+ * token passes signature + issuer + audience + expiry checks. Mirrors
+ * `passport-jwt`'s own `VerifyCallback` / `VerifyCallbackWithRequest`.
+ */
+type AuthVerifyCallback = (payload: Record<string, unknown>, done: (err: unknown, user?: unknown, info?: unknown) => void) => void;
+/**
+ * Extra options for `createAuthJwtStrategy`. Defaults are the
+ * Auth-recommended values; override here if you need a different
+ * token source (cookie, custom header, ...), a stricter algorithm
+ * allow-list, or want to skip the legacy-issuer acceptance window.
+ */
+interface CreateAuthJwtStrategyOptions {
+    /**
+     * Where to read the bearer from. Defaults to
+     * `ExtractJwt.fromAuthHeaderAsBearerToken()`. Pass any
+     * passport-jwt extractor when you need a different source.
+     */
+    jwtFromRequest?: (req: unknown) => string | null;
+    /**
+     * JWS algorithms accepted by the underlying verifier. Defaults to
+     * the algorithms Auth mints today (`['RS256']`); set explicitly
+     * if your app is on a different signing alg or you also accept
+     * customer-minted tokens with a different alg.
+     */
+    algorithms?: string[];
+    /**
+     * Pin only the per-app issuer URL (skip the legacy `'heimdall'`
+     * literal). Defaults to `false` — verifying both keeps in-flight
+     * tokens minted before the per-app-issuer migration valid. Set to
+     * `true` once you're confident all old tokens have expired.
+     */
+    strictIssuer?: boolean;
+    /** Whether the request object should be passed to the verify callback. Defaults to `false`. */
+    passReqToCallback?: boolean;
+}
+/**
+ * Constructor signature for `passport-jwt`'s `Strategy`. We don't take
+ * a direct dep on passport-jwt to keep it a peer/soft dep — at runtime
+ * the caller imports passportJwt and the helper does
+ * `new passportJwt.Strategy(...)` via the constructor reference.
+ */
+interface PassportJwtStrategyCtor {
+    new (options: Record<string, unknown>, verify: AuthVerifyCallback): any;
+}
+/**
+ * Build a fully-configured `passport-jwt` strategy from an Auth
+ * `ConsumerScope`. Wires:
+ *
+ *   - `jwtFromRequest`     → `ExtractJwt.fromAuthHeaderAsBearerToken()` (override via opts)
+ *   - `secretOrKeyProvider` → JWKS-backed key resolution via `scope.jwks`
+ *   - `issuer`             → both `scope.expectedIssuer` AND the legacy `'heimdall'` literal (or only the per-app URL if `strictIssuer: true`)
+ *   - `audience`           → `scope.expectedAudience` (the app slug)
+ *   - `algorithms`         → `['RS256']` (override via opts)
+ *
+ * The verify callback you pass receives the parsed claims after
+ * passport-jwt has finished its checks. Refresh tokens
+ * (`token_use: "refresh"` or `type: "refresh"`) are refused before
+ * your callback runs: the request fails authentication.
+ */
+declare function createAuthJwtStrategy(scope: ConsumerScope, verify: AuthVerifyCallback, options?: CreateAuthJwtStrategyOptions): any;
+
+export { type AuthVerifyCallback, type CreateAuthJwtStrategyOptions, type PassportJwtStrategyCtor, createAuthJwtStrategy, createPassportSecretOrKeyProvider };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productcraft/auth-passport",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Passport-JWT adapter for ProductCraft Auth. Plug an Auth ConsumerScope into a `passport-jwt` Strategy so existing Passport setups can authenticate Auth-issued tokens.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -8,9 +8,14 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.cjs"
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     }
   },
   "files": [
@@ -48,11 +53,11 @@
     "jose": "^6.2.3"
   },
   "peerDependencies": {
-    "@productcraft/auth": "^1.0.0",
+    "@productcraft/auth": "^1.0.1",
     "passport-jwt": "^4.0.0"
   },
   "devDependencies": {
-    "@productcraft/auth": "1.0.0"
+    "@productcraft/auth": "1.0.1"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",