@seamless-auth/express 0.0.2-beta.9 → 0.0.3-beta.0

package/README.md

@@ -110,14 +110,17 @@ This keeps trust boundaries clean and auditable.
 
 ## Environment Variables
 
-| Variable             | Description                               | Example                                                |
-| -------------------- | ----------------------------------------- | ------------------------------------------------------ |
-| `AUTH_SERVER_URL`    | Base URL of your Seamless Auth Server     | `https://auth.client.com`                              |
-| `COOKIE_SIGNING_KEY` | Secret for signing API session cookies    | `local-dev-secret`                                     |
-| `API_SERVICE_TOKEN`  | API → Auth Server service secret          | `shared-m2m-value`                                     |
-| `APP_ORIGIN`         | Your site URL (or localhost in demo mode) | `https://myapp.com`                                    |
-| `DATABASE_URL`       | Database URL for your API                 | `postgres://myuser:mypassword@localhost:5432/seamless` |
-| `DB_NAME`            | Name of your database                     | `seamless`                                             |
+| Variable             | Description                               | Example                   |
+| -------------------- | ----------------------------------------- | ------------------------- |
+| `AUTH_SERVER_URL`    | Base URL of your Seamless Auth Server     | `https://auth.client.com` |
+| `COOKIE_SIGNING_KEY` | Secret for signing API session cookies    | `local-dev-secret`        |
+| `API_SERVICE_TOKEN`  | API → Auth Server service secret          | `shared-m2m-value`        |
+| `APP_ORIGIN`         | Your site URL (or localhost in demo mode) | `https://myapp.com`       |
+| `DB_HOST`            | Database Host                             | `localhost`               |
+| `DB_PORT`            | Database Port                             | `5432`                    |
+| `DB_USER`            | Database user                             | `myuser`                  |
+| `DB_PASSWORD`        | Database password                         | `mypassword`              |
+| `DB_NAME`            | Name of your database                     | `seamless`                |
 
 ---
 
@@ -219,7 +222,7 @@ Returned shape (example):
 AUTH_SERVER_URL=http://localhost:5312
 SEAMLESS_SERVICE_TOKEN=generated-secret
 COOKIE_SIGNING_KEY=local-dev-key
-FRONTEND_URL=https://localhost:5001
+FRONTEND_URL=http://localhost:5001
 ```
 
 ---

package/dist/index.d.ts

@@ -1,12 +1,26 @@
 import { Router, Request, Response, NextFunction, RequestHandler } from 'express';
 
-interface SeamlessAuthServerOptions {
+type SeamlessAuthServerOptions = {
     authServerUrl: string;
+    cookieSecret: string;
+    serviceSecret: string;
+    issuer: string;
+    audience: string;
+    jwksKid?: string;
     cookieDomain?: string;
     accessCookieName?: string;
     registrationCookieName?: string;
     refreshCookieName?: string;
     preAuthCookieName?: string;
+};
+interface SeamlessAuthUser {
+    id: string;
+    sub: string;
+    roles: string[];
+    email: string;
+    phone: string;
+    iat?: number;
+    exp?: number;
 }
 /**
  * Creates an Express Router that proxies all authentication traffic to a Seamless Auth server.
@@ -36,6 +50,9 @@ interface SeamlessAuthServerOptions {
  * app.use("/auth", createSeamlessAuthServer({
  *   authServerUrl: "https://identifier.seamlessauth.com",
  *   cookieDomain: "mycompany.com",
+ *   cookieSecret: "someLongRandomValue"
+ *   serviceSecret: "someLongRandomValueToo"
+ *   jwksKid: "dev-main"
  *   accessCookieName: "sa_access",
  *   registrationCookieName: "sa_registration",
  *   refreshCookieName: "sa_refresh",
@@ -44,6 +61,9 @@ interface SeamlessAuthServerOptions {
  *
  * @param opts - Configuration options for the Seamless Auth proxy:
  *   - `authServerUrl` — Base URL of your Seamless Auth instance (required)
+ *   - `cookieSecret` — The value to encode your cookies secrets with (required)
+ *   - `serviceSecret` - An machine to machine shared secret that matches your auth servers (required)
+ *   - `jwksKid` - The active jwks KID
  *   - `cookieDomain` — Domain attribute applied to all auth cookies
  *   - `accessCookieName` — Name of the session access cookie
  *   - `registrationCookieName` — Name of the ephemeral registration cookie
@@ -172,6 +192,6 @@ interface EnsureCookiesMiddlewareOptions {
 }
 declare function createEnsureCookiesMiddleware(opts: EnsureCookiesMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
 
-declare function getSeamlessUser(req: Request, authServerUrl: string, cookieName?: string): Promise<any>;
+declare function getSeamlessUser(req: Request, opts: SeamlessAuthServerOptions): Promise<any>;
 
-export { createEnsureCookiesMiddleware, createSeamlessAuthServer as default, getSeamlessUser, requireAuth, requireRole };
+export { type SeamlessAuthServerOptions, type SeamlessAuthUser, createEnsureCookiesMiddleware, createSeamlessAuthServer as default, getSeamlessUser, requireAuth, requireRole };

package/dist/index.js

@@ -98,7 +98,7 @@ function applyResult(res, req, result, opts, cookieSigner) {
 import { loginHandler } from "@seamless-auth/core/handlers/login";
 async function login(req, res, opts) {
   const cookieSigner = {
-    secret: process.env.COOKIE_SIGNING_KEY,
+    secret: opts.cookieSecret,
     secure: process.env.NODE_ENV === "production",
     sameSite: process.env.NODE_ENV === "production" ? "none" : "lax"
   };
@@ -138,16 +138,16 @@ import { finishLoginHandler } from "@seamless-auth/core/handlers/finishLogin";
 
 // src/internal/buildAuthorization.ts
 import { createServiceToken } from "@seamless-auth/core";
-function buildServiceAuthorization(req) {
+function buildServiceAuthorization(req, opts) {
   if (!req.cookiePayload?.sub && !req.user.sub) {
     return void 0;
   }
   const token = createServiceToken({
     subject: req.cookiePayload?.sub || req.user.sub,
-    issuer: process.env.APP_ORIGIN,
-    audience: process.env.AUTH_SERVER_URL,
-    serviceSecret: process.env.API_SERVICE_TOKEN,
-    keyId: "dev-main"
+    issuer: opts.issuer,
+    audience: opts.audience,
+    serviceSecret: opts.serviceSecret,
+    keyId: opts.jwksKid || "dev-main"
   });
   return `Bearer ${token}`;
 }
@@ -155,11 +155,11 @@ function buildServiceAuthorization(req) {
 // src/handlers/finishLogin.ts
 async function finishLogin(req, res, opts) {
   const cookieSigner = {
-    secret: process.env.COOKIE_SIGNING_KEY,
+    secret: opts.cookieSecret,
     secure: process.env.NODE_ENV === "production",
     sameSite: process.env.NODE_ENV === "production" ? "none" : "lax"
   };
-  const authorization = buildServiceAuthorization(req);
+  const authorization = buildServiceAuthorization(req, opts);
   const result = await finishLoginHandler(
     { body: req.body, authorization },
     {
@@ -196,7 +196,7 @@ async function finishLogin(req, res, opts) {
 import { registerHandler } from "@seamless-auth/core/handlers/register";
 async function register(req, res, opts) {
   const cookieSigner = {
-    secret: process.env.COOKIE_SIGNING_KEY,
+    secret: opts.cookieSecret,
     secure: process.env.NODE_ENV === "production",
     sameSite: process.env.NODE_ENV === "production" ? "none" : "lax"
   };
@@ -235,11 +235,11 @@ async function register(req, res, opts) {
 import { finishRegisterHandler } from "@seamless-auth/core/handlers/finishRegister";
 async function finishRegister(req, res, opts) {
   const cookieSigner = {
-    secret: process.env.COOKIE_SIGNING_KEY,
+    secret: opts.cookieSecret,
     secure: process.env.NODE_ENV === "production",
     sameSite: process.env.NODE_ENV === "production" ? "none" : "lax"
   };
-  const authorization = buildServiceAuthorization(req);
+  const authorization = buildServiceAuthorization(req, opts);
   const result = await finishRegisterHandler(
     { body: req.body, authorization },
     {
@@ -269,13 +269,13 @@ async function finishRegister(req, res, opts) {
   if (result.error) {
     return res.status(result.status).json(result.error);
   }
-  res.status(result.status).end();
+  res.status(result.status).json({ message: "success" });
 }
 
 // src/handlers/me.ts
 import { meHandler } from "@seamless-auth/core/handlers/me";
 async function me(req, res, opts) {
-  const authorization = buildServiceAuthorization(req);
+  const authorization = buildServiceAuthorization(req, opts);
   const result = await meHandler({
     authServerUrl: opts.authServerUrl,
     preAuthCookieName: opts.preAuthCookieName,
@@ -307,8 +307,7 @@ async function logout(req, res, opts) {
 
 // src/createServer.ts
 import {
-  authFetch,
-  createServiceToken as createServiceToken2
+  authFetch
 } from "@seamless-auth/core";
 function createSeamlessAuthServer(opts) {
   const r = express.Router();
@@ -316,6 +315,11 @@ function createSeamlessAuthServer(opts) {
   r.use(cookieParser());
   const resolvedOpts = {
     authServerUrl: opts.authServerUrl,
+    issuer: opts.issuer,
+    audience: opts.audience,
+    cookieSecret: opts.cookieSecret,
+    serviceSecret: opts.serviceSecret,
+    jwksKid: opts.jwksKid ?? "dev-main",
     cookieDomain: opts.cookieDomain ?? "",
     accessCookieName: opts.accessCookieName ?? "seamless-access",
     registrationCookieName: opts.registrationCookieName ?? "seamless-ephemeral",
@@ -339,14 +343,11 @@ function createSeamlessAuthServer(opts) {
       res.status(401).json({ error: "registeration session required" });
       return;
     }
-    const authorization = buildServiceAuthorization2(req);
+    const authorization = buildServiceAuthorization(req, resolvedOpts);
+    const options = method == "GET" ? { method, authorization } : { method, authorization, body: req.body };
     const upstream = await authFetch(
       `${resolvedOpts.authServerUrl}/${path}`,
-      {
-        method,
-        body: req.body,
-        authorization
-      }
+      options
     );
     const data = await upstream.json();
     res.status(upstream.status).json(data);
@@ -359,26 +360,13 @@ function createSeamlessAuthServer(opts) {
       registrationCookieName: resolvedOpts.registrationCookieName,
       refreshCookieName: resolvedOpts.refreshCookieName,
       preAuthCookieName: resolvedOpts.preAuthCookieName,
-      cookieSecret: process.env.COOKIE_SIGNING_KEY,
-      serviceSecret: process.env.API_SERVICE_TOKEN,
-      issuer: process.env.APP_ORIGIN,
-      audience: process.env.AUTH_SERVER_URL,
-      keyId: "dev-main"
+      cookieSecret: resolvedOpts.cookieSecret,
+      serviceSecret: resolvedOpts.serviceSecret,
+      issuer: resolvedOpts.issuer,
+      audience: resolvedOpts.authServerUrl,
+      keyId: resolvedOpts.jwksKid
     })
   );
-  function buildServiceAuthorization2(req) {
-    if (!req.cookiePayload?.sub) {
-      return void 0;
-    }
-    const token = createServiceToken2({
-      subject: req.cookiePayload.sub,
-      issuer: process.env.APP_ORIGIN,
-      audience: process.env.AUTH_SERVER_URL,
-      serviceSecret: process.env.API_SERVICE_TOKEN,
-      keyId: "dev-main"
-    });
-    return `Bearer ${token}`;
-  }
   r.post(
     "/webAuthn/login/start",
     proxyWithIdentity("webAuthn/login/start", "preAuth")
@@ -445,7 +433,9 @@ function requireAuth(opts) {
       return;
     }
     const user = {
+      id: payload.sub,
       sub: payload.sub,
+      // TODO: Silly to store the same value twice. Search every where its used and phase this out.
       roles: Array.isArray(payload.roles) ? payload.roles : [],
       email: payload.email,
       phone: payload.phone,
@@ -491,12 +481,12 @@ function requireRole(requiredRoles) {
 import {
   getSeamlessUser as getSeamlessUserCore
 } from "@seamless-auth/core";
-async function getSeamlessUser(req, authServerUrl, cookieName = "seamless-access") {
-  const authorization = buildServiceAuthorization(req);
+async function getSeamlessUser(req, opts) {
+  const authorization = buildServiceAuthorization(req, opts);
   return getSeamlessUserCore(req.cookies ?? {}, {
-    authServerUrl,
-    cookieSecret: process.env.COOKIE_SIGNING_KEY,
-    cookieName,
+    authServerUrl: opts.authServerUrl,
+    cookieSecret: opts.cookieSecret,
+    cookieName: opts.accessCookieName ?? "seamless-access",
     authorization
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/express",
-  "version": "0.0.2-beta.9",
+  "version": "0.0.3-beta.0",
   "description": "Express adapter for Seamless Auth passwordless authentication",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -33,8 +33,8 @@
     "url": "https://github.com/fells-code/seamless-auth-server/tree/main/packages/express"
   },
   "peerDependencies": {
-    "express": ">=4.18.0",
-    "@types/express": ">=4.17.0"
+    "@types/express": ">=4.17.0",
+    "express": ">=4.18.0"
   },
   "dependencies": {
     "@seamless-auth/core": "beta",
@@ -46,8 +46,8 @@
     "@types/jest": "^29.5.14",
     "@types/jsonwebtoken": "^9.0.10",
     "jest": "^29.7.0",
-    "ts-node": "^10.9.2",
     "supertest": "^7.2.2",
+    "ts-node": "^10.9.2",
     "tsup": "^8.5.1",
     "typescript": "^5.5.0"
   },