@query-farm/vgi-rpc 0.6.4 → 0.7.1

package/src/http/index.ts

@@ -17,6 +17,7 @@ export {
   mtlsAuthenticateXfcc,
   parseXfcc,
 } from "./mtls.js";
+export { cookieAuthenticate } from "./oauth-pkce.js";
 export { type UnpackedToken, unpackStateToken } from "./token.js";
 export type { HttpHandlerOptions, StateSerializer } from "./types.js";
 export { jsonStateSerializer } from "./types.js";

package/src/http/jwt.ts

@@ -5,6 +5,7 @@ import * as oauth from "oauth4webapi";
 import { AuthContext } from "../auth.js";
 import type { AuthenticateFn } from "./auth.js";
 
+/** Options for {@link jwtAuthenticate}, configuring JWT Bearer-token validation. */
 export interface JwtAuthenticateOptions {
   /** The expected `iss` claim (also used to discover AS metadata). */
   issuer: string;

package/src/http/mtls.ts

@@ -1,21 +1,41 @@
 // © Copyright 2025-2026, Query.Farm LLC - https://query.farm
 // SPDX-License-Identifier: Apache-2.0
 
-import { createHash, X509Certificate } from "node:crypto";
 import { AuthContext } from "../auth.js";
 import type { AuthenticateFn } from "./auth.js";
 
+// Indirect-string require so esbuild doesn't pull node:crypto into the bundle.
+// X509Certificate and createHash are used only by the PEM-based mTLS factories;
+// callers on workerd should not configure mTLS.
+const _NODE_CRYPTO_MOD = "node:crypto";
+type X509Certificate = any;
+function _loadNodeCrypto(): { X509Certificate: any; createHash: any } {
+  const req: any = (import.meta as any).require ?? (globalThis as any).require ?? null;
+  if (!req) {
+    throw new Error("mTLS PEM-based authentication requires Node.js or Bun (node:crypto).");
+  }
+  const nc = req(_NODE_CRYPTO_MOD);
+  return { X509Certificate: nc.X509Certificate, createHash: nc.createHash };
+}
+
 // ---------------------------------------------------------------------------
 // XFCC types and parser (no crypto needed)
 // ---------------------------------------------------------------------------
 
 /** A single element from an `x-forwarded-client-cert` header. */
 export interface XfccElement {
+  /** Hex SHA-256 digest of the client certificate (`Hash` key). */
   hash: string | null;
+  /** URL-decoded PEM of the client certificate (`Cert` key), if the proxy
+   *  forwarded it. */
   cert: string | null;
+  /** Certificate Subject DN (`Subject` key). */
   subject: string | null;
+  /** URL-decoded URI-type Subject Alternative Name (`URI` key). */
   uri: string | null;
+  /** DNS-type Subject Alternative Names (`DNS` keys); may repeat in the header. */
   dns: readonly string[];
+  /** URL-decoded URI of the proxy that presented the cert (`By` key). */
   by: string | null;
 }
 
@@ -172,6 +192,7 @@ function parseCertFromHeader(request: Request, header: string): X509Certificate
   if (!pemStr.startsWith("-----BEGIN CERTIFICATE-----")) {
     throw new Error("Header value is not a PEM certificate");
   }
+  const { X509Certificate } = _loadNodeCrypto();
   try {
     return new X509Certificate(pemStr);
   } catch (exc) {
@@ -239,6 +260,7 @@ export function mtlsAuthenticateFingerprint(options: {
     fingerprints instanceof Map ? fingerprints : new Map(Object.entries(fingerprints));
 
   function validate(cert: X509Certificate): AuthContext {
+    const { createHash } = _loadNodeCrypto();
     const fp = createHash(algorithm).update(cert.raw).digest("hex");
     const ctx = entries.get(fp);
     if (!ctx) {
@@ -266,9 +288,9 @@ export function mtlsAuthenticateSubject(options?: {
 
   function validate(cert: X509Certificate): AuthContext {
     // Node's cert.subject is \n-separated "KEY=value" lines
-    const subjectParts = cert.subject
+    const subjectParts: string[] = cert.subject
       .split("\n")
-      .map((s) => s.trim())
+      .map((s: string) => s.trim())
       .filter(Boolean);
     const subjectDn = subjectParts.join(", ");