@productcraft/auth 0.7.1 → 0.8.0

package/dist/index.d.cts

@@ -2823,9 +2823,18 @@ interface VerifyOptions {
     /** Maximum token age — passed straight to jose. */
     maxTokenAge?: string | number;
 }
+/**
+ * True when the claims mark a refresh token: `token_use: "refresh"`
+ * (current shape) or `type: "refresh"` (older Auth tokens). Refresh
+ * tokens must never authenticate a request.
+ */
+declare function isRefreshToken(claims: Record<string, unknown> | null | undefined): boolean;
 /**
  * Verify an Auth-issued JWT against a JWKS resolver.
  *
+ * Refresh tokens are refused with `JwtRefreshTokenError` even when the
+ * signature, issuer and audience are valid.
+ *
  * @param token        The compact-form JWT (header.payload.signature)
  * @param getKey       A jose-compatible key resolver — pass
  *                     `scope.jwks.getKey` from a `ConsumerScope`
@@ -3236,6 +3245,16 @@ declare class JwtNotYetValidError extends JwtVerifyError {
         cause?: unknown;
     });
 }
+/**
+ * The token is a refresh token (`token_use: "refresh"` or
+ * `type: "refresh"`). Refresh tokens are only valid at the refresh
+ * endpoint and must never authenticate an API request.
+ */
+declare class JwtRefreshTokenError extends JwtVerifyError {
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
 /** `iss` claim doesn't match the expected issuer. */
 declare class JwtIssuerMismatchError extends JwtVerifyError {
     constructor(message: string, options?: {
@@ -3286,7 +3305,15 @@ interface AuthConfig extends PCClientConfig {
     jwksTtlMs?: number;
 }
 declare class Auth {
+    /** Admin client: explicit `auth`, else `PRODUCTCRAFT_API_KEY`. */
     private readonly client;
+    /**
+     * Consumer client: explicit `auth` only. Consumer routes act for an
+     * end user, so a workspace key from the environment must never leak
+     * onto them. Pass `auth` explicitly for PAK-only consumer routes
+     * (`signup_requires_pak`, tenants, code mint, factors).
+     */
+    private readonly consumerClient;
     private readonly baseUrl;
     private readonly fetch;
     private readonly jwtConfig;
@@ -3294,15 +3321,20 @@ declare class Auth {
     /**
      * Returns an `AppScope` bound to the given appId. All operations under
      * `/v1/apps/{appId}/...` are exposed as resource namespaces on the
-     * returned object.
+     * returned object. Uses the explicit `auth`, else
+     * `PRODUCTCRAFT_API_KEY` from the environment.
      */
     app(appId: string): AppScope;
     /**
      * Returns a `ConsumerScope` bound to the given appSlug. Exposes the
      * `/{appSlug}/v1/...` surface (sign-in, sign-up, me, verify, oauth)
      * and the JWT-verify helper for tokens issued by this app.
+     *
+     * `appSlug` defaults to `PRODUCTCRAFT_AUTH_APP` from the environment.
+     * No credential is ever read from the environment for consumer
+     * routes; only an explicit `auth` is sent.
      */
-    consumer(appSlug: string): ConsumerScope;
+    consumer(appSlug?: string): ConsumerScope;
     readonly apps: {
         /** List apps the caller's workspace can see. */
         list: (params?: Partial<AppControllerListMyAppsQueryParams>) => Promise<AppListResponseDto>;
@@ -3319,4 +3351,4 @@ declare class Auth {
     };
 }
 
-export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConfirmEnrollmentResponseDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EncodedPasskeyCredential, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, type PasskeyBrowserOptions, type PasskeyCredentialLike, type PasskeyCredentialsContainer, type PasskeyDecodedOptions, PasskeyError, type PasskeyErrorCode, type PasskeyMediation, type PasskeyPublicKeyOptions, type PublicFactorDto, type SetPermissionsDto, type SetScopesDto, type StepUpResponseDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, type WebauthnCredentialDto, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, toB64u, verifyAuthToken };
+export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConfirmEnrollmentResponseDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EncodedPasskeyCredential, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtRefreshTokenError, JwtVerifyError, type PasskeyBrowserOptions, type PasskeyCredentialLike, type PasskeyCredentialsContainer, type PasskeyDecodedOptions, PasskeyError, type PasskeyErrorCode, type PasskeyMediation, type PasskeyPublicKeyOptions, type PublicFactorDto, type SetPermissionsDto, type SetScopesDto, type StepUpResponseDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, type WebauthnCredentialDto, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, isRefreshToken, toB64u, verifyAuthToken };

package/dist/index.d.ts

@@ -2823,9 +2823,18 @@ interface VerifyOptions {
     /** Maximum token age — passed straight to jose. */
     maxTokenAge?: string | number;
 }
+/**
+ * True when the claims mark a refresh token: `token_use: "refresh"`
+ * (current shape) or `type: "refresh"` (older Auth tokens). Refresh
+ * tokens must never authenticate a request.
+ */
+declare function isRefreshToken(claims: Record<string, unknown> | null | undefined): boolean;
 /**
  * Verify an Auth-issued JWT against a JWKS resolver.
  *
+ * Refresh tokens are refused with `JwtRefreshTokenError` even when the
+ * signature, issuer and audience are valid.
+ *
  * @param token        The compact-form JWT (header.payload.signature)
  * @param getKey       A jose-compatible key resolver — pass
  *                     `scope.jwks.getKey` from a `ConsumerScope`
@@ -3236,6 +3245,16 @@ declare class JwtNotYetValidError extends JwtVerifyError {
         cause?: unknown;
     });
 }
+/**
+ * The token is a refresh token (`token_use: "refresh"` or
+ * `type: "refresh"`). Refresh tokens are only valid at the refresh
+ * endpoint and must never authenticate an API request.
+ */
+declare class JwtRefreshTokenError extends JwtVerifyError {
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
 /** `iss` claim doesn't match the expected issuer. */
 declare class JwtIssuerMismatchError extends JwtVerifyError {
     constructor(message: string, options?: {
@@ -3286,7 +3305,15 @@ interface AuthConfig extends PCClientConfig {
     jwksTtlMs?: number;
 }
 declare class Auth {
+    /** Admin client: explicit `auth`, else `PRODUCTCRAFT_API_KEY`. */
     private readonly client;
+    /**
+     * Consumer client: explicit `auth` only. Consumer routes act for an
+     * end user, so a workspace key from the environment must never leak
+     * onto them. Pass `auth` explicitly for PAK-only consumer routes
+     * (`signup_requires_pak`, tenants, code mint, factors).
+     */
+    private readonly consumerClient;
     private readonly baseUrl;
     private readonly fetch;
     private readonly jwtConfig;
@@ -3294,15 +3321,20 @@ declare class Auth {
     /**
      * Returns an `AppScope` bound to the given appId. All operations under
      * `/v1/apps/{appId}/...` are exposed as resource namespaces on the
-     * returned object.
+     * returned object. Uses the explicit `auth`, else
+     * `PRODUCTCRAFT_API_KEY` from the environment.
      */
     app(appId: string): AppScope;
     /**
      * Returns a `ConsumerScope` bound to the given appSlug. Exposes the
      * `/{appSlug}/v1/...` surface (sign-in, sign-up, me, verify, oauth)
      * and the JWT-verify helper for tokens issued by this app.
+     *
+     * `appSlug` defaults to `PRODUCTCRAFT_AUTH_APP` from the environment.
+     * No credential is ever read from the environment for consumer
+     * routes; only an explicit `auth` is sent.
      */
-    consumer(appSlug: string): ConsumerScope;
+    consumer(appSlug?: string): ConsumerScope;
     readonly apps: {
         /** List apps the caller's workspace can see. */
         list: (params?: Partial<AppControllerListMyAppsQueryParams>) => Promise<AppListResponseDto>;
@@ -3319,4 +3351,4 @@ declare class Auth {
     };
 }
 
-export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConfirmEnrollmentResponseDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EncodedPasskeyCredential, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, type PasskeyBrowserOptions, type PasskeyCredentialLike, type PasskeyCredentialsContainer, type PasskeyDecodedOptions, PasskeyError, type PasskeyErrorCode, type PasskeyMediation, type PasskeyPublicKeyOptions, type PublicFactorDto, type SetPermissionsDto, type SetScopesDto, type StepUpResponseDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, type WebauthnCredentialDto, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, toB64u, verifyAuthToken };
+export { AUTH_LEGACY_ISSUER, AppScope, type AssignRoleDto, Auth, type AuthClaims, type AuthConfig, AuthHttpError, type AuthorizeBatchBody, type AuthorizeBody, type ClientCredentialsDto, type ConfirmEnrollmentResponseDto, type ConsumerAcceptInviteDto, type ConsumerLogoutDto, type ConsumerRefreshDto, type ConsumerRequestPasswordResetDto, type ConsumerResetPasswordDto, ConsumerScope, type ConsumerSigninDto, type ConsumerSignupDto, type ConsumerTokenResponseDto, type CreateApiKeyDto, type CreateAppDto, type CreateEndUserInviteDto, type CreateM2MClientDto, type CreatePermissionDto, type CreateRoleDto, type EncodedPasskeyCredential, type EndUserInviteResponseDto, type IdpNativeSigninDto, type IdpNativeUserHintDto, type IdpTokenResponseDto, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtRefreshTokenError, JwtVerifyError, type PasskeyBrowserOptions, type PasskeyCredentialLike, type PasskeyCredentialsContainer, type PasskeyDecodedOptions, PasskeyError, type PasskeyErrorCode, type PasskeyMediation, type PasskeyPublicKeyOptions, type PublicFactorDto, type SetPermissionsDto, type SetScopesDto, type StepUpResponseDto, type UpdateAppDto, type UpdateAppStatusDto, type UpdateAuthConfigDto, type UpdateEndUserDto, type UpdateEndUserRoleDto, type UpdateEndUserStatusDto, type UpdateM2MClientDto, type UpdateMeDto, type UpdateRoleDto, type VerifyBody, type VerifyOptions, type WebauthnCredentialDto, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, isRefreshToken, toB64u, verifyAuthToken };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { PC_BASE_URL } from '@productcraft/core';
+import { PC_BASE_URL, resolveAuth, readEnv, PC_AUTH_APP_ENV } from '@productcraft/core';
 import { createRemoteJWKSet, errors, jwtVerify, customFetch } from 'jose';
 
 // src/index.ts
@@ -2068,6 +2068,12 @@ var JwtNotYetValidError = class extends JwtVerifyError {
     this.name = "JwtNotYetValidError";
   }
 };
+var JwtRefreshTokenError = class extends JwtVerifyError {
+  constructor(message = "Refresh tokens cannot be used as access tokens", options) {
+    super("ERR_JWT_REFRESH_TOKEN", message, options);
+    this.name = "JwtRefreshTokenError";
+  }
+};
 var JwtIssuerMismatchError = class extends JwtVerifyError {
   constructor(message, options) {
     super("ERR_JWT_ISS_MISMATCH", message, options);
@@ -2148,6 +2154,10 @@ var JwksCache = class {
   refresh() {
   }
 };
+function isRefreshToken(claims) {
+  if (!claims) return false;
+  return claims.token_use === "refresh" || claims.type === "refresh";
+}
 async function verifyAuthToken(token, getKey, opts = {}) {
   try {
     const { payload } = await jwtVerify(token, getKey, {
@@ -2159,6 +2169,7 @@ async function verifyAuthToken(token, getKey, opts = {}) {
       currentDate: opts.currentDate,
       maxTokenAge: opts.maxTokenAge
     });
+    if (isRefreshToken(payload)) throw new JwtRefreshTokenError();
     return payload;
   } catch (err) {
     throw translateJoseError(err);
@@ -2700,7 +2711,15 @@ async function statsControllerGetMyStats({ params } = {}, config = {}) {
 
 // src/index.ts
 var Auth = class {
+  /** Admin client: explicit `auth`, else `PRODUCTCRAFT_API_KEY`. */
   client;
+  /**
+   * Consumer client: explicit `auth` only. Consumer routes act for an
+   * end user, so a workspace key from the environment must never leak
+   * onto them. Pass `auth` explicitly for PAK-only consumer routes
+   * (`signup_requires_pak`, tenants, code mint, factors).
+   */
+  consumerClient;
   baseUrl;
   fetch;
   jwtConfig;
@@ -2708,6 +2727,11 @@ var Auth = class {
     this.baseUrl = config.baseUrl ?? PC_BASE_URL.auth;
     this.fetch = config.fetch;
     this.client = makeAuthHttpClient({
+      baseUrl: this.baseUrl,
+      auth: resolveAuth(config.auth),
+      fetch: this.fetch
+    });
+    this.consumerClient = makeAuthHttpClient({
       baseUrl: this.baseUrl,
       auth: config.auth,
       fetch: this.fetch
@@ -2719,7 +2743,8 @@ var Auth = class {
   /**
    * Returns an `AppScope` bound to the given appId. All operations under
    * `/v1/apps/{appId}/...` are exposed as resource namespaces on the
-   * returned object.
+   * returned object. Uses the explicit `auth`, else
+   * `PRODUCTCRAFT_API_KEY` from the environment.
    */
   app(appId) {
     return new AppScope(appId, this.client);
@@ -2728,11 +2753,21 @@ var Auth = class {
    * Returns a `ConsumerScope` bound to the given appSlug. Exposes the
    * `/{appSlug}/v1/...` surface (sign-in, sign-up, me, verify, oauth)
    * and the JWT-verify helper for tokens issued by this app.
+   *
+   * `appSlug` defaults to `PRODUCTCRAFT_AUTH_APP` from the environment.
+   * No credential is ever read from the environment for consumer
+   * routes; only an explicit `auth` is sent.
    */
   consumer(appSlug) {
+    const slug = appSlug ?? readEnv(PC_AUTH_APP_ENV);
+    if (!slug) {
+      throw new Error(
+        `@productcraft/auth: consumer() needs an app slug. Pass one, or set ${PC_AUTH_APP_ENV}.`
+      );
+    }
     return new ConsumerScope(
-      appSlug,
-      { client: this.client, baseUrl: this.baseUrl, fetch: this.fetch },
+      slug,
+      { client: this.consumerClient, baseUrl: this.baseUrl, fetch: this.fetch },
       this.jwtConfig
     );
   }
@@ -2771,6 +2806,6 @@ var Auth = class {
   };
 };
 
-export { AUTH_LEGACY_ISSUER, AppScope, Auth, AuthHttpError, ConsumerScope, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtVerifyError, PasskeyError, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, toB64u, verifyAuthToken };
+export { AUTH_LEGACY_ISSUER, AppScope, Auth, AuthHttpError, ConsumerScope, JwksCache, JwksFetchError, JwksKeyNotFoundError, JwtAudienceMismatchError, JwtExpiredError, JwtInvalidError, JwtIssuerMismatchError, JwtNotYetValidError, JwtRefreshTokenError, JwtVerifyError, PasskeyError, createPasskeyCredential, decodeOptions, encodeCredential, fromB64u, getPasskeyCredential, isPasskeySupported, isRefreshToken, toB64u, verifyAuthToken };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map