@rimelight/auth 0.0.3 → 0.0.4

package/dist/adapters/auth0.d.mts

@@ -1,7 +1,7 @@
 import { AuthAdapter, UserSessionContext } from "../types.mjs";
 import { decodeJwt } from "jose";
 //#region src/adapters/auth0.d.ts
-interface Auth0AdapterOptions {
+export interface Auth0AdapterOptions {
   domain: string;
   audience?: string | undefined;
   clientId?: string | undefined;
@@ -14,7 +14,7 @@ interface Auth0AdapterOptions {
   loginUrl?: string | undefined;
   defaultRole?: string | undefined;
 }
-interface Auth0AuthorizeUrlOptions {
+export interface Auth0AuthorizeUrlOptions {
   domain: string;
   clientId: string;
   redirectUri: string;
@@ -26,7 +26,7 @@ interface Auth0AuthorizeUrlOptions {
   prompt?: string | undefined;
   screenHint?: string | undefined;
 }
-interface Auth0TokenResponse {
+export interface Auth0TokenResponse {
   access_token: string;
   id_token?: string | undefined;
   token_type: string;
@@ -34,7 +34,7 @@ interface Auth0TokenResponse {
   refresh_token?: string | undefined;
   scope?: string | undefined;
 }
-interface Auth0CodeExchangeOptions {
+export interface Auth0CodeExchangeOptions {
   domain: string;
   clientId: string;
   clientSecret?: string | undefined;
@@ -42,7 +42,7 @@ interface Auth0CodeExchangeOptions {
   redirectUri: string;
   codeVerifier?: string | undefined;
 }
-interface Auth0PasswordLoginOptions {
+export interface Auth0PasswordLoginOptions {
   domain: string;
   clientId: string;
   clientSecret?: string | undefined;
@@ -52,7 +52,7 @@ interface Auth0PasswordLoginOptions {
   scope?: string | undefined;
   realm?: string | undefined;
 }
-interface Auth0RefreshTokenOptions {
+export interface Auth0RefreshTokenOptions {
   domain: string;
   clientId: string;
   clientSecret?: string | undefined;
@@ -62,7 +62,7 @@ interface Auth0RefreshTokenOptions {
 /**
  * Verifies an Auth0 RS256 JWT Access Token or ID Token against Auth0 JWKS endpoint
  */
-declare function verifyAuth0Jwt(token: string, options: {
+export declare function verifyAuth0Jwt(token: string, options: {
   domain: string;
   audience?: string | undefined;
   issuer?: string | undefined;
@@ -70,33 +70,33 @@ declare function verifyAuth0Jwt(token: string, options: {
 /**
  * Creates a signed compact session token (HS256) for local session cookie storage
  */
-declare function createSessionToken(session: UserSessionContext, secret: string, expiresIn?: string | number): Promise<string>;
+export declare function createSessionToken(session: UserSessionContext, secret: string, expiresIn?: string | number): Promise<string>;
 /**
  * Verifies a signed session token from a session cookie
  */
-declare function verifySessionToken(token: string, secret: string): Promise<UserSessionContext | null>;
+export declare function verifySessionToken(token: string, secret: string): Promise<UserSessionContext | null>;
 /**
  * Generates an Auth0 OAuth2 / OIDC authorization URL
  */
-declare function createAuth0AuthorizeUrl(options: Auth0AuthorizeUrlOptions): string;
+export declare function createAuth0AuthorizeUrl(options: Auth0AuthorizeUrlOptions): string;
 /**
  * Exchanges an authorization code for Auth0 tokens
  */
-declare function exchangeAuth0Code(options: Auth0CodeExchangeOptions): Promise<Auth0TokenResponse>;
+export declare function exchangeAuth0Code(options: Auth0CodeExchangeOptions): Promise<Auth0TokenResponse>;
 /**
  * Authenticates directly with Auth0 using Resource Owner Password Credentials (ROPC). Used by
  * headless clients (e.g., Unreal Engine 5) to authenticate without browser redirects.
  */
-declare function loginWithAuth0Password(options: Auth0PasswordLoginOptions): Promise<Auth0TokenResponse>;
+export declare function loginWithAuth0Password(options: Auth0PasswordLoginOptions): Promise<Auth0TokenResponse>;
 /**
  * Exchanges a refresh token for a new Auth0 access token. Ensures uninterrupted play sessions in
  * native game clients.
  */
-declare function refreshAuth0Token(options: Auth0RefreshTokenOptions): Promise<Auth0TokenResponse>;
+export declare function refreshAuth0Token(options: Auth0RefreshTokenOptions): Promise<Auth0TokenResponse>;
 /**
  * Generates an Auth0 logout URL
  */
-declare function createAuth0LogoutUrl(options: {
+export declare function createAuth0LogoutUrl(options: {
   domain: string;
   clientId: string;
   returnTo: string;
@@ -104,12 +104,12 @@ declare function createAuth0LogoutUrl(options: {
 /**
  * Auth0 / OIDC Auth Adapter
  */
-declare function auth0Auth(options: Auth0AdapterOptions): AuthAdapter;
-declare function mapAuth0PayloadToSession(payload: Record<string, any>, options: {
+export declare function auth0Auth(options: Auth0AdapterOptions): AuthAdapter;
+export declare function mapAuth0PayloadToSession(payload: Record<string, any>, options: {
   rolesClaim: string;
   userTypeClaim: string;
   permissionsClaim: string;
   defaultRole: string;
 }): UserSessionContext;
 //#endregion
-export { Auth0AdapterOptions, Auth0AuthorizeUrlOptions, Auth0CodeExchangeOptions, Auth0PasswordLoginOptions, Auth0RefreshTokenOptions, Auth0TokenResponse, auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken };
+export { decodeJwt };

package/dist/adapters/auth0.mjs

@@ -74,8 +74,8 @@ async function exchangeAuth0Code(options) {
 		code: options.code,
 		redirect_uri: options.redirectUri
 	};
-	if (options.clientSecret) body.client_secret = options.clientSecret;
-	if (options.codeVerifier) body.code_verifier = options.codeVerifier;
+	if (options.clientSecret) body["client_secret"] = options.clientSecret;
+	if (options.codeVerifier) body["code_verifier"] = options.codeVerifier;
 	const response = await fetch(tokenUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -100,9 +100,9 @@ async function loginWithAuth0Password(options) {
 		password: options.password,
 		scope: options.scope || "openid profile email offline_access"
 	};
-	if (options.realm) body.realm = options.realm;
-	if (options.clientSecret) body.client_secret = options.clientSecret;
-	if (options.audience) body.audience = options.audience;
+	if (options.realm) body["realm"] = options.realm;
+	if (options.clientSecret) body["client_secret"] = options.clientSecret;
+	if (options.audience) body["audience"] = options.audience;
 	const response = await fetch(tokenUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -125,8 +125,8 @@ async function refreshAuth0Token(options) {
 		client_id: options.clientId,
 		refresh_token: options.refreshToken
 	};
-	if (options.clientSecret) body.client_secret = options.clientSecret;
-	if (options.scope) body.scope = options.scope;
+	if (options.clientSecret) body["client_secret"] = options.clientSecret;
+	if (options.scope) body["scope"] = options.scope;
 	const response = await fetch(tokenUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
@@ -231,8 +231,8 @@ function auth0Auth(options) {
 	};
 }
 function mapAuth0PayloadToSession(payload, options) {
-	const roles = Array.isArray(payload[options.rolesClaim]) ? payload[options.rolesClaim] : Array.isArray(payload.roles) ? payload.roles : [options.defaultRole];
-	const permissions = Array.isArray(payload[options.permissionsClaim]) ? payload[options.permissionsClaim] : Array.isArray(payload.permissions) ? payload.permissions : [];
+	const roles = Array.isArray(payload[options.rolesClaim]) ? payload[options.rolesClaim] : Array.isArray(payload["roles"]) ? payload["roles"] : [options.defaultRole];
+	const permissions = Array.isArray(payload[options.permissionsClaim]) ? payload[options.permissionsClaim] : Array.isArray(payload["permissions"]) ? payload["permissions"] : [];
 	const isStaff = roles.some((r) => [
 		"owner",
 		"admin",
@@ -240,12 +240,12 @@ function mapAuth0PayloadToSession(payload, options) {
 		"employee",
 		"superadmin"
 	].includes(r.toLowerCase()));
-	const userType = payload[options.userTypeClaim] || payload.user_type || (isStaff ? "employee" : "user");
+	const userType = payload[options.userTypeClaim] || payload["user_type"] || (isStaff ? "employee" : "user");
 	return {
-		userId: payload.sub || "anonymous",
-		email: payload.email,
-		name: payload.name || payload.nickname || payload.email?.split("@")[0] || "User",
-		avatar: payload.picture,
+		userId: payload["sub"] || "anonymous",
+		email: payload["email"],
+		name: payload["name"] || payload["nickname"] || payload["email"]?.split("@")[0] || "User",
+		avatar: payload["picture"],
 		roles,
 		permissions,
 		userType,

package/dist/adapters/cf-access.d.mts

@@ -1,6 +1,6 @@
 import { AuthAdapter } from "../types.mjs";
 //#region src/adapters/cf-access.d.ts
-interface CfAccessAdapterOptions {
+export interface CfAccessAdapterOptions {
   aud?: string | undefined;
   teamDomain?: string | undefined;
   defaultRole?: string | undefined;
@@ -8,6 +8,5 @@ interface CfAccessAdapterOptions {
   verifyJwt?: boolean | undefined;
   loginUrl?: string | undefined;
 }
-declare function cfAccessAuth(options?: CfAccessAdapterOptions): AuthAdapter;
-//#endregion
-export { CfAccessAdapterOptions, cfAccessAuth };
+export declare function cfAccessAuth(options?: CfAccessAdapterOptions): AuthAdapter;
+//#endregion

package/dist/adapters/cf-access.mjs

@@ -22,8 +22,8 @@ function cfAccessAuth(options = {}) {
 				if (aud) verifyOpts.audience = aud;
 				if (teamDomain) verifyOpts.issuer = `https://${teamDomain.replace(/^https?:\/\//, "")}`;
 				const { payload } = await jwtVerify(jwtAssertion, jwks, verifyOpts);
-				if (payload.email && typeof payload.email === "string") email = payload.email.toLowerCase().trim();
-				if (payload.name && typeof payload.name === "string") name = payload.name;
+				if (payload["email"] && typeof payload["email"] === "string") email = payload["email"].toLowerCase().trim();
+				if (payload["name"] && typeof payload["name"] === "string") name = payload["name"];
 				customClaims = payload;
 			} catch {
 				return null;

package/dist/adapters/mock.d.mts

@@ -1,9 +1,8 @@
 import { AuthAdapter, UserSessionContext } from "../types.mjs";
 //#region src/adapters/mock.d.ts
-interface MockAuthOptions {
+export interface MockAuthOptions {
   session?: Partial<UserSessionContext> | null;
   unauthorizedResponse?: Response;
 }
-declare function mockAuth(options?: MockAuthOptions | Partial<UserSessionContext>): AuthAdapter;
-//#endregion
-export { MockAuthOptions, mockAuth };
+export declare function mockAuth(options?: MockAuthOptions | Partial<UserSessionContext>): AuthAdapter;
+//#endregion

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import "./types.mjs";
-import { cfAccessAuth } from "./adapters/cf-access.mjs";
 import { auth0Auth, createAuth0AuthorizeUrl, createAuth0LogoutUrl, createSessionToken, decodeJwt, exchangeAuth0Code, loginWithAuth0Password, mapAuth0PayloadToSession, refreshAuth0Token, verifyAuth0Jwt, verifySessionToken } from "./adapters/auth0.mjs";
+import { cfAccessAuth } from "./adapters/cf-access.mjs";
 import { mockAuth } from "./adapters/mock.mjs";
+import "./types.mjs";
 import { AccessControl, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc } from "./permissions/index.mjs";
 import { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername } from "./plugins/reserved-usernames/index.mjs";
 import { CONSTRUCTION_GUEST_COOKIE, isConstructionGuest, signInConstructionGuest } from "./plugins/construction-guest/index.mjs";

package/dist/permissions/index.d.mts

@@ -1,41 +1,41 @@
 import { UserSessionContext } from "../types.mjs";
 //#region src/permissions/index.d.ts
-declare function hasRole(session: UserSessionContext | null | undefined, requiredRoles: string | string[]): boolean;
-declare function hasPermission(session: UserSessionContext | null | undefined, requiredPermission: string): boolean;
-declare function evaluateAccess(session: UserSessionContext | null | undefined, constraints: {
+export declare function hasRole(session: UserSessionContext | null | undefined, requiredRoles: string | string[]): boolean;
+export declare function hasPermission(session: UserSessionContext | null | undefined, requiredPermission: string): boolean;
+export declare function evaluateAccess(session: UserSessionContext | null | undefined, constraints: {
   roles?: string[];
   permission?: string;
 }): boolean;
-type StatementMap = Record<string, readonly string[]>;
-interface AccessRole<TStatements extends StatementMap> {
+export type StatementMap = Record<string, readonly string[]>;
+export interface AccessRole<TStatements extends StatementMap> {
   statements: Partial<{ [K in keyof TStatements]: TStatements[K][number][]; }>;
   can(statement: string, action: string): boolean;
 }
-declare class AccessControl<TStatements extends StatementMap> {
+export declare class AccessControl<TStatements extends StatementMap> {
   readonly statements: TStatements;
   constructor(statements: TStatements);
   newRole(permissions: Partial<{ [K in keyof TStatements]: TStatements[K][number][]; }>): AccessRole<TStatements>;
 }
-declare function createAccessControl<const TStatements extends StatementMap>(statements: TStatements): AccessControl<TStatements>;
-declare const defaultStatements: {
+export declare function createAccessControl<const TStatements extends StatementMap>(statements: TStatements): AccessControl<TStatements>;
+export declare const defaultStatements: {
   user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
 };
-declare const ownerAc: {
+export declare const ownerAc: {
   statements: {
     user: string[];
   };
 };
-declare const adminAc: {
+export declare const adminAc: {
   statements: {
     user: string[];
   };
 };
-declare const memberAc: {
+export declare const memberAc: {
   statements: {
     user: string[];
   };
 };
-declare function createPermissions<const TStatements extends StatementMap>(statements: TStatements): {
+export declare function createPermissions<const TStatements extends StatementMap>(statements: TStatements): {
   ac: AccessControl<{
     user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
   } & TStatements>;
@@ -43,5 +43,4 @@ declare function createPermissions<const TStatements extends StatementMap>(state
     user: readonly ["create", "list", "set-role", "ban", "impersonate", "delete", "setRole"];
   } & TStatements;
 };
-//#endregion
-export { AccessControl, AccessRole, StatementMap, adminAc, createAccessControl, createPermissions, defaultStatements, evaluateAccess, hasPermission, hasRole, memberAc, ownerAc };
+//#endregion

package/dist/plugins/construction-guest/index.d.mts

@@ -1,9 +1,8 @@
 //#region src/plugins/construction-guest/index.d.ts
-declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
-type GuestEnv = {
+export declare const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
+export type GuestEnv = {
   CONSTRUCTION_PASSPHRASE?: string;
 };
-declare const isConstructionGuest: (c: any) => Promise<boolean>;
-declare const signInConstructionGuest: (c: any, passphrase: string, rememberMe?: boolean) => Promise<boolean>;
-//#endregion
-export { CONSTRUCTION_GUEST_COOKIE, GuestEnv, isConstructionGuest, signInConstructionGuest };
+export declare const isConstructionGuest: (c: any) => Promise<boolean>;
+export declare const signInConstructionGuest: (c: any, passphrase: string, rememberMe?: boolean) => Promise<boolean>;
+//#endregion

package/dist/plugins/construction-guest/index.mjs

@@ -2,7 +2,7 @@ import { getCookie, setCookie } from "hono/cookie";
 //#region src/plugins/construction-guest/index.ts
 const CONSTRUCTION_GUEST_COOKIE = "rimelight-construction-guest";
 const getConfig = (env) => {
-	return { passphrase: env?.CONSTRUCTION_PASSPHRASE ?? process.env.CONSTRUCTION_PASSPHRASE };
+	return { passphrase: env?.CONSTRUCTION_PASSPHRASE ?? process.env["CONSTRUCTION_PASSPHRASE"] };
 };
 const encode = (value) => btoa(String.fromCharCode(...value)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 const decode = (value) => {

package/dist/plugins/reserved-usernames/index.d.mts

@@ -1,12 +1,11 @@
 //#region src/plugins/reserved-usernames/index.d.ts
-declare const normalizeUsername: (input: string) => string;
-declare const STANDARD_RESTRICTED_GROUPS: {
+export declare const normalizeUsername: (input: string) => string;
+export declare const STANDARD_RESTRICTED_GROUPS: {
   STAFF_ROLES: string[];
   LEGAL_FINANCIAL: string[];
   TECHNICAL: string[];
   LEETSPEAK: string[];
 };
-declare const createRestrictedUsernameSet: (customBlacklist?: string[]) => Set<string>;
-declare const RESTRICTED_SET: Set<string>;
-//#endregion
-export { RESTRICTED_SET, STANDARD_RESTRICTED_GROUPS, createRestrictedUsernameSet, normalizeUsername };
+export declare const createRestrictedUsernameSet: (customBlacklist?: string[]) => Set<string>;
+export declare const RESTRICTED_SET: Set<string>;
+//#endregion

package/dist/types.d.mts

@@ -1,6 +1,6 @@
 //#region src/types.d.ts
-type UserType = "user" | "employee" | "guest" | (string & {});
-interface UserSessionContext {
+export type UserType = "user" | "employee" | "guest" | (string & {});
+export interface UserSessionContext {
   /**
    * Unique user identifier (e.g. Auth0 sub claim, user UUID, or email)
    */
@@ -35,7 +35,7 @@ interface UserSessionContext {
    */
   metadata?: Record<string, any> | undefined;
 }
-interface AuthAdapter {
+export interface AuthAdapter {
   /**
    * Unique name of the auth adapter
    */
@@ -54,5 +54,4 @@ interface AuthAdapter {
    */
   handleUnauthorized?: ((request: Request) => Response | Promise<Response>) | undefined;
 }
-//#endregion
-export { AuthAdapter, UserSessionContext, UserType };
+//#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rimelight/auth",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "private": false,
   "description": "Rimelight Entertainment's Universal Authentication & Identity Package",
   "homepage": "https://rimelight.com/docs",
@@ -58,11 +58,11 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "jose": "6.2.11"
+    "jose": "6.2.12"
   },
   "devDependencies": {
-    "@rimelight/config": "0.0.4",
-    "@types/node": "26.4.1"
+    "@rimelight/config": "0.0.6",
+    "@types/node": "26.5.1"
   },
   "peerDependencies": {
     "drizzle-orm": ">=0.30.0",
@@ -77,7 +77,7 @@
     }
   },
   "engines": {
-    "node": ">=26.7.0"
+    "node": ">=26.8.2"
   },
   "scripts": {
     "build": "vp pack",