@rtorcato/api-auth-hono 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Richard Torcato
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,38 @@
+# @rtorcato/api-auth-hono
+
+Hono middleware for `@rtorcato/api-auth` — JWT authentication with Bearer-header and cookie support.
+
+## Install
+
+```sh
+pnpm add @rtorcato/api-auth @rtorcato/api-auth-hono
+```
+
+`hono` is a peer dependency — you bring your own version.
+
+## Usage
+
+```ts
+import { Hono } from 'hono'
+import { authMiddleware, type AuthVariables } from '@rtorcato/api-auth-hono'
+
+const app = new Hono<{ Variables: AuthVariables }>()
+
+app.use(authMiddleware(process.env.JWT_SECRET))
+
+app.get('/me', (c) => c.json({ user: c.get('user') }))
+```
+
+Type the app with `{ Variables: AuthVariables }` to get a typed `c.get('user')`.
+
+- `authMiddleware(secret, options?)` — throws `UnauthorizedError` (`missing_token` / `invalid_token`) when the token is absent or invalid. Pair with [`@rtorcato/api-errors-hono`](https://github.com/rtorcato/api-common/tree/main/packages/api-errors-hono)'s `errorHandler` to translate it to a JSON response.
+- `optionalAuthMiddleware(secret, options?)` — sets `c.get('user')` when a valid token is present, otherwise passes through untouched.
+
+Options: `{ cookieName?: string; verifyOptions?: VerifyOptions }`. The token is read from the `Authorization: Bearer …` header first, then the cookie named `cookieName` (default `token`).
+
+## Related
+
+- [`@rtorcato/api-auth`](https://github.com/rtorcato/api-common/tree/main/packages/api-auth) — framework-agnostic core
+- [`@rtorcato/api-auth-express`](https://github.com/rtorcato/api-common/tree/main/packages/api-auth-express) — Express adapter
+
+Source: https://github.com/rtorcato/api-common/tree/main/packages/api-auth-hono

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { authMiddleware, optionalAuthMiddleware, type AuthVariables } from './middleware';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { authMiddleware, optionalAuthMiddleware } from './middleware';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAsB,MAAM,cAAc,CAAA"}

package/dist/middleware.d.ts

@@ -0,0 +1,17 @@
+import { type JwtPayload, type Secret, type VerifyOptions } from '@rtorcato/api-auth';
+import type { MiddlewareHandler } from 'hono';
+export type AuthVariables = {
+    user: JwtPayload;
+};
+interface AuthOptions {
+    cookieName?: string;
+    verifyOptions?: VerifyOptions;
+}
+export declare function authMiddleware(secret: Secret, options?: AuthOptions): MiddlewareHandler<{
+    Variables: AuthVariables;
+}>;
+export declare function optionalAuthMiddleware(secret: Secret, options?: AuthOptions): MiddlewareHandler<{
+    Variables: AuthVariables;
+}>;
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,MAAM,EAEX,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAG7C,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEhD,UAAU,WAAW;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,aAAa,CAAA;CAC7B;AAED,wBAAgB,cAAc,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,WAAgB,GACvB,iBAAiB,CAAC;IAAE,SAAS,EAAE,aAAa,CAAA;CAAE,CAAC,CAUjD;AAED,wBAAgB,sBAAsB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,WAAgB,GACvB,iBAAiB,CAAC;IAAE,SAAS,EAAE,aAAa,CAAA;CAAE,CAAC,CAejD"}

package/dist/middleware.js

@@ -0,0 +1,27 @@
+import { findToken, verifyToken, } from '@rtorcato/api-auth';
+import { UnauthorizedError } from '@rtorcato/api-errors';
+import { getCookie } from 'hono/cookie';
+export function authMiddleware(secret, options = {}) {
+    return async (c, next) => {
+        const token = findToken({ headers: { authorization: c.req.header('authorization') }, cookies: getCookie(c) }, { cookieName: options.cookieName });
+        if (!token)
+            throw new UnauthorizedError('No token provided', 'missing_token');
+        c.set('user', verifyToken(token, secret, options.verifyOptions));
+        return next();
+    };
+}
+export function optionalAuthMiddleware(secret, options = {}) {
+    return async (c, next) => {
+        const token = findToken({ headers: { authorization: c.req.header('authorization') }, cookies: getCookie(c) }, { cookieName: options.cookieName });
+        if (token) {
+            try {
+                c.set('user', verifyToken(token, secret, options.verifyOptions));
+            }
+            catch {
+                // ponytail: silently skip invalid token — optional auth never blocks the request
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,SAAS,EAGT,WAAW,GAEX,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAWvC,MAAM,UAAU,cAAc,CAC7B,MAAc,EACd,UAAuB,EAAE;IAEzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,SAAS,CACtB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EACpF,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAClC,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAA;QAC7E,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAa,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;QAC5E,OAAO,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACF,CAAC;AAED,MAAM,UAAU,sBAAsB,CACrC,MAAc,EACd,UAAuB,EAAE;IAEzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,SAAS,CACtB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EACpF,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAClC,CAAA;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,CAAC;gBACJ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAa,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACR,iFAAiF;YAClF,CAAC;QACF,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACF,CAAC"}

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@rtorcato/api-auth-hono",
+  "version": "0.2.0",
+  "description": "Hono middleware for @rtorcato/api-auth — JWT authentication with Bearer-header and cookie support.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Richard Torcato",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@rtorcato/api-auth": "0.1.0",
+    "@rtorcato/api-errors": "0.2.0"
+  },
+  "peerDependencies": {
+    "hono": "^4.0.0"
+  },
+  "devDependencies": {
+    "hono": "^4.12.27",
+    "typescript": "~6.0.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "api",
+    "nodejs",
+    "typescript",
+    "hono",
+    "middleware",
+    "jwt",
+    "auth",
+    "authentication"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rtorcato/api-common.git",
+    "directory": "packages/api-auth-hono"
+  },
+  "homepage": "https://github.com/rtorcato/api-common/tree/main/packages/api-auth-hono#readme",
+  "bugs": {
+    "url": "https://github.com/rtorcato/api-common/issues"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}