@productcraft/auth 0.7.1 → 0.8.1

package/README.md

@@ -13,9 +13,8 @@ Server-side only. For React / Next.js apps, call this from your backend (BFF pat
 ```ts
 import { Auth } from "@productcraft/auth";
 
-const auth = new Auth({
-  auth: { type: "apiKey", key: process.env.PCFT_KEY! },
-});
+// Reads PRODUCTCRAFT_API_KEY (and PRODUCTCRAFT_AUTH_APP) from the environment
+const auth = new Auth();
 ```
 
 The SDK splits into three caller contexts.
@@ -310,6 +309,8 @@ try {
 
 Behind the scenes: JWKS fetched once, cached in-memory (10 min TTL by default), singleflighted so 100 concurrent verifies do 1 fetch, auto-refetched if a token's `kid` isn't in the cached JWKS (rotation handling). Issuer + audience are checked against `scope.acceptedIssuers` + `scope.expectedAudience` automatically.
 
+**Refresh tokens are refused.** A token carrying `token_use: "refresh"` (or the older `type: "refresh"`) throws `JwtRefreshTokenError` (code `ERR_JWT_REFRESH_TOKEN`) even when its signature, issuer and audience are valid: a refresh token is only good at the refresh endpoint, never as an access token. `createAuthJwtStrategy` from `@productcraft/auth-passport` refuses them too. If you call `jwtVerify` yourself (below), check `isRefreshToken(payload)` and reject.
+
 ### Building blocks for `jose`, NestJS guards, Hono, etc.
 
 `scope.jwks.getKey` is a [jose-compatible](https://github.com/panva/jose) key resolver — pass it anywhere a `GetKeyFunction` is expected.
@@ -368,11 +369,28 @@ import {
 } from "@productcraft/auth";
 ```
 
+## Credentials from the environment
+
+Server-side, omit `auth` and the client reads your workspace key from the environment:
+
+```bash
+# .env
+PRODUCTCRAFT_API_KEY=pcft_live_...
+PRODUCTCRAFT_AUTH_APP=acme           # default slug for auth.consumer()
+```
+
+- An explicit `auth` always wins over the environment.
+- Hosts are never read from the environment. Override them in code with `baseUrl`.
+- This is a server-only fallback. Never put a key in `NEXT_PUBLIC_*` or any other variable a bundler inlines into browser code.
+- `auth.app(appId)` and the workspace methods (`apps`, `stats`) use the explicit `auth`, else `PRODUCTCRAFT_API_KEY`.
+- `auth.consumer()` takes its slug from `PRODUCTCRAFT_AUTH_APP` when you omit it, and **never** reads a credential from the environment: consumer routes act for an end user, so only an explicit `auth` is sent. PAK-only consumer routes (`signup_requires_pak` sign-ups, tenants, code mint, factors) therefore need `new Auth({ auth: { type: "apiKey", key: process.env.MY_APP_PAK! } })`.
+
 ## Configuration
 
 ```ts
 new Auth({
   // Auth credential the SDK presents to Auth
+  // Omit to use PRODUCTCRAFT_API_KEY from the environment
   auth: { type: "apiKey", key: "pcft_live_..." }
       | { type: "bearer", token: "eyJ..." }
       | { type: "cookie", value: "auth_token=..." },

package/dist/index.cjs

@@ -2070,6 +2070,12 @@ var JwtNotYetValidError = class extends JwtVerifyError {
     this.name = "JwtNotYetValidError";
   }
 };
+var JwtRefreshTokenError = class extends JwtVerifyError {
+  constructor(message = "Refresh tokens cannot be used as access tokens", options) {
+    super("ERR_JWT_REFRESH_TOKEN", message, options);
+    this.name = "JwtRefreshTokenError";
+  }
+};
 var JwtIssuerMismatchError = class extends JwtVerifyError {
   constructor(message, options) {
     super("ERR_JWT_ISS_MISMATCH", message, options);
@@ -2150,6 +2156,10 @@ var JwksCache = class {
   refresh() {
   }
 };
+function isRefreshToken(claims) {
+  if (!claims) return false;
+  return claims.token_use === "refresh" || claims.type === "refresh";
+}
 async function verifyAuthToken(token, getKey, opts = {}) {
   try {
     const { payload } = await jose.jwtVerify(token, getKey, {
@@ -2161,6 +2171,7 @@ async function verifyAuthToken(token, getKey, opts = {}) {
       currentDate: opts.currentDate,
       maxTokenAge: opts.maxTokenAge
     });
+    if (isRefreshToken(payload)) throw new JwtRefreshTokenError();
     return payload;
   } catch (err) {
     throw translateJoseError(err);
@@ -2702,7 +2713,15 @@ async function statsControllerGetMyStats({ params } = {}, config = {}) {
 
 // src/index.ts
 var Auth = class {
+  /** Admin client: explicit `auth`, else `PRODUCTCRAFT_API_KEY`. */
   client;
+  /**
+   * Consumer client: explicit `auth` only. Consumer routes act for an
+   * end user, so a workspace key from the environment must never leak
+   * onto them. Pass `auth` explicitly for PAK-only consumer routes
+   * (`signup_requires_pak`, tenants, code mint, factors).
+   */
+  consumerClient;
   baseUrl;
   fetch;
   jwtConfig;
@@ -2710,6 +2729,11 @@ var Auth = class {
     this.baseUrl = config.baseUrl ?? core.PC_BASE_URL.auth;
     this.fetch = config.fetch;
     this.client = makeAuthHttpClient({
+      baseUrl: this.baseUrl,
+      auth: core.resolveAuth(config.auth),
+      fetch: this.fetch
+    });
+    this.consumerClient = makeAuthHttpClient({
       baseUrl: this.baseUrl,
       auth: config.auth,
       fetch: this.fetch
@@ -2721,7 +2745,8 @@ var Auth = class {
   /**
    * Returns an `AppScope` bound to the given appId. All operations under
    * `/v1/apps/{appId}/...` are exposed as resource namespaces on the
-   * returned object.
+   * returned object. Uses the explicit `auth`, else
+   * `PRODUCTCRAFT_API_KEY` from the environment.
    */
   app(appId) {
     return new AppScope(appId, this.client);
@@ -2730,11 +2755,21 @@ var Auth = class {
    * Returns a `ConsumerScope` bound to the given appSlug. Exposes the
    * `/{appSlug}/v1/...` surface (sign-in, sign-up, me, verify, oauth)
    * and the JWT-verify helper for tokens issued by this app.
+   *
+   * `appSlug` defaults to `PRODUCTCRAFT_AUTH_APP` from the environment.
+   * No credential is ever read from the environment for consumer
+   * routes; only an explicit `auth` is sent.
    */
   consumer(appSlug) {
+    const slug = appSlug ?? core.readEnv(core.PC_AUTH_APP_ENV);
+    if (!slug) {
+      throw new Error(
+        `@productcraft/auth: consumer() needs an app slug. Pass one, or set ${core.PC_AUTH_APP_ENV}.`
+      );
+    }
     return new ConsumerScope(
-      appSlug,
-      { client: this.client, baseUrl: this.baseUrl, fetch: this.fetch },
+      slug,
+      { client: this.consumerClient, baseUrl: this.baseUrl, fetch: this.fetch },
       this.jwtConfig
     );
   }
@@ -2786,6 +2821,7 @@ exports.JwtExpiredError = JwtExpiredError;
 exports.JwtInvalidError = JwtInvalidError;
 exports.JwtIssuerMismatchError = JwtIssuerMismatchError;
 exports.JwtNotYetValidError = JwtNotYetValidError;
+exports.JwtRefreshTokenError = JwtRefreshTokenError;
 exports.JwtVerifyError = JwtVerifyError;
 exports.PasskeyError = PasskeyError;
 exports.createPasskeyCredential = createPasskeyCredential;
@@ -2794,6 +2830,7 @@ exports.encodeCredential = encodeCredential;
 exports.fromB64u = fromB64u;
 exports.getPasskeyCredential = getPasskeyCredential;
 exports.isPasskeySupported = isPasskeySupported;
+exports.isRefreshToken = isRefreshToken;
 exports.toB64u = toB64u;
 exports.verifyAuthToken = verifyAuthToken;
 //# sourceMappingURL=index.cjs.map