@segmentstream-cloud/app 0.0.0-stage → 0.2.0

package/dist/tokens.js

@@ -0,0 +1,70 @@
+import { createRemoteJWKSet, errors, jwtVerify } from "jose";
+const CLOCK_TOLERANCE_SECONDS = 5;
+const remoteKeySets = new Map();
+/** One remote JWKS per SegmentStream origin, shared by every app instance in the process. */
+export function remoteKeySet(baseUrl) {
+    const existing = remoteKeySets.get(baseUrl);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const keySet = createRemoteJWKSet(new URL(`${baseUrl}/api/v1/app-sessions/jwks`), {
+        timeoutDuration: 5_000,
+    });
+    remoteKeySets.set(baseUrl, keySet);
+    return keySet;
+}
+export function createTokenVerifier(config, keySet) {
+    return async function verifyToken(token) {
+        let payload;
+        try {
+            const verified = await jwtVerify(token, keySet, {
+                algorithms: ["ES256"],
+                issuer: config.issuer,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: ["sub", "exp", "iat", "org", "wsp"],
+            });
+            payload = verified.payload;
+        }
+        catch (error) {
+            return classifyVerificationFailure(error);
+        }
+        const user = appUserFromClaims(config, payload);
+        return user === null ? { status: "invalid" } : { status: "valid", user, token };
+    };
+}
+function classifyVerificationFailure(error) {
+    if (error instanceof errors.JWTExpired) {
+        return { status: "expired" };
+    }
+    if (error instanceof errors.JWKSTimeout) {
+        return { status: "unavailable" };
+    }
+    if (error instanceof errors.JOSEError) {
+        return { status: "invalid" };
+    }
+    // Network failures while fetching the key set are not token defects.
+    return { status: "unavailable" };
+}
+function appUserFromClaims(config, payload) {
+    const { sub, org, wsp, email, name } = payload;
+    if (typeof sub !== "string" ||
+        sub === "" ||
+        org !== config.organizationId ||
+        wsp !== config.workspaceId) {
+        return null;
+    }
+    if (!hasAppAudience(payload.aud)) {
+        return null;
+    }
+    return {
+        id: sub,
+        ...(typeof email === "string" ? { email } : {}),
+        ...(typeof name === "string" ? { name } : {}),
+        organizationId: org,
+        workspaceId: wsp,
+    };
+}
+function hasAppAudience(audience) {
+    const audiences = typeof audience === "string" ? [audience] : (audience ?? []);
+    return audiences.some((candidate) => candidate.startsWith("app:"));
+}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@segmentstream-cloud/app",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Sign-in, sessions, and warehouse data access for SegmentStream workspace apps built with Next.js.",
+  "license": "Apache-2.0",
+  "author": "SegmentStream",
+  "homepage": "https://segmentstream.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/segmentstream/segmentstream.git",
+    "directory": "packages/app-sdk"
+  },
+  "keywords": [
+    "segmentstream",
+    "nextjs",
+    "authentication"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src tests --config ../../eslint.config.mjs",
+    "test": "vitest run",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "jose": "^6.2.12"
+  },
+  "peerDependencies": {
+    "next": ">=16.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^24",
+    "next": "16.3.8",
+    "typescript": "^5.9",
+    "vitest": "^4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}