@serialsubscriptions/platform-integration 0.0.8-5.1 → 0.0.8-5.3

package/lib/requestConfig.d.ts

@@ -23,8 +23,9 @@ export type SSIRequestConfig = {
     ssiClientId: string | null;
 };
 /**
- * Get the base URL from request headers or environment.
- * Uses x-forwarded-proto, x-forwarded-host, origin, host, and NEXT_PUBLIC_APP_URL.
+ * Get the base URL from environment or request headers.
+ * If NEXT_PUBLIC_APP_URL is set, returns it; otherwise derives from
+ * x-forwarded-proto, x-forwarded-host, origin, or host.
  */
 export declare function getBaseUrl(req: Request): string | null;
 /** When baseUrl is a single URL or comma-separated list, return the first URL. */

package/lib/requestConfig.js

@@ -14,32 +14,26 @@ exports.toAuthConfig = toAuthConfig;
 exports.normalizeAuthConfig = normalizeAuthConfig;
 // --- Helpers used by getRequestConfig (env: NEXT_PUBLIC_APP_URL, SSI_*, request headers) ---
 /**
- * Get the base URL from request headers or environment.
- * Uses x-forwarded-proto, x-forwarded-host, origin, host, and NEXT_PUBLIC_APP_URL.
+ * Get the base URL from environment or request headers.
+ * If NEXT_PUBLIC_APP_URL is set, returns it; otherwise derives from
+ * x-forwarded-proto, x-forwarded-host, origin, or host.
  */
 function getBaseUrl(req) {
+    const fromEnv = process.env.NEXT_PUBLIC_APP_URL?.trim();
+    if (fromEnv)
+        return fromEnv;
     const proto = req.headers.get('x-forwarded-proto') || 'https';
-    let baseUrl = process.env.NEXT_PUBLIC_APP_URL;
-    if (!baseUrl) {
-        const forwardedHost = req.headers.get('x-forwarded-host');
-        if (forwardedHost) {
-            baseUrl = `${proto}://${forwardedHost}`;
-        }
-        else {
-            const origin = req.headers.get('origin');
-            if (origin) {
-                baseUrl = origin;
-            }
-            else {
-                const host = req.headers.get('host');
-                const hostWithoutPort = host ? host.split(':')[0] : undefined;
-                if (hostWithoutPort) {
-                    baseUrl = `${proto}://${hostWithoutPort}`;
-                }
-            }
-        }
-    }
-    return baseUrl || null;
+    const forwardedHost = req.headers.get('x-forwarded-host');
+    if (forwardedHost)
+        return `${proto}://${forwardedHost}`;
+    const origin = req.headers.get('origin');
+    if (origin)
+        return origin;
+    const host = req.headers.get('host');
+    const hostWithoutPort = host ? host.split(':')[0] : undefined;
+    if (hostWithoutPort)
+        return `${proto}://${hostWithoutPort}`;
+    return null;
 }
 /** When baseUrl is a single URL or comma-separated list, return the first URL. */
 function firstBaseUrl(baseUrl) {

package/lib/session/SessionManager.d.ts

@@ -42,10 +42,18 @@ export declare class SessionManager {
     private auth?;
     private _sessionId?;
     private authConfig?;
+    private bearerSession?;
+    private pendingBearerToken?;
     private static inFlightRefresh;
     private freshnessOnce;
     /** Accepts AuthConfig or SSIRequestConfig (e.g. from getRequestConfig(req)). */
     constructor(storage: SSIStorage, authConfig?: AuthConfigInput);
+    /**
+     * Create a session from environment: cookie or Authorization: Bearer JWT.
+     * When a Request is passed and contains "Authorization: Bearer <token>", the token is verified
+     * (valid and not expired); a session id is generated but not cached. Cookie is used only when
+     * no Bearer header is present.
+     */
     static fromEnv(): SessionManager;
     static fromEnv(cookieHeader: string | null, authConfig?: AuthConfigInput): SessionManager;
     static fromEnv(request: Request, authConfig?: AuthConfigInput): SessionManager;
@@ -70,6 +78,17 @@ export declare class SessionManager {
     static fromEnvAsync(cookieHeader: string | null, authConfig?: AuthConfigInput): Promise<SessionManager>;
     static fromEnvAsync(request: Request, authConfig?: AuthConfigInput): Promise<SessionManager>;
     static fromEnvAsync(authConfig: AuthConfigInput): Promise<SessionManager>;
+    /**
+     * Parse Authorization: Bearer <token> from Request or Headers.
+     * Returns the JWT string or null if missing/invalid format.
+     */
+    private static parseBearerToken;
+    /**
+     * Verify the Bearer JWT and set ephemeral session (not cached).
+     * When token is provided (async path), generates a new sessionId.
+     * When called with no args, uses pendingBearerToken (sync path, lazy verification).
+     */
+    private verifyAndSetBearerSession;
     private parseCookies;
     get sessionId(): string | undefined;
     /** Cryptographically strong, URL-safe session id */
@@ -112,11 +131,13 @@ export declare class SessionManager {
     /**
      * Get session data by key. For 'claims', decodes the id_token payload
      * WITHOUT verification (use your verifier upstream for security).
+     * Bearer JWT sessions: returns from verified ephemeral data (not cached).
      */
     getSessionData(sessionId: string, dataKey: SessionDataKey): Promise<KVValue | null>;
     private ensureFreshOnce;
     /**
      * Delete all keys under this session object (id/access/refresh).
+     * For Bearer sessions, clears in-memory state only (nothing was cached).
      */
     clearSession(sessionId: string): Promise<string>;
     /**

package/lib/session/SessionManager.js

@@ -57,9 +57,16 @@ class SessionManager {
         }
         const session = new SessionManager(SSIStorage_1.SSIStorage.fromEnv(), actualAuthConfig);
         if (cookieHeaderOrRequest instanceof Request) {
-            const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
-            if (cookieHeader) {
-                session._sessionId = session.parseCookies(cookieHeader);
+            const bearerToken = SessionManager.parseBearerToken(cookieHeaderOrRequest);
+            if (bearerToken) {
+                session._sessionId = session.generateSessionId();
+                session.pendingBearerToken = bearerToken;
+            }
+            else {
+                const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
+                if (cookieHeader) {
+                    session._sessionId = session.parseCookies(cookieHeader);
+                }
             }
         }
         else if (cookieHeaderOrRequest) {
@@ -84,34 +91,89 @@ class SessionManager {
         }
         const session = new SessionManager(SSIStorage_1.SSIStorage.fromEnv(), actualAuthConfig);
         if (cookieHeaderOrRequest instanceof Request) {
-            const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
-            if (cookieHeader) {
-                session._sessionId = session.parseCookies(cookieHeader);
+            const bearerToken = SessionManager.parseBearerToken(cookieHeaderOrRequest);
+            if (bearerToken) {
+                await session.verifyAndSetBearerSession(bearerToken);
+            }
+            else {
+                const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
+                if (cookieHeader) {
+                    session._sessionId = session.parseCookies(cookieHeader);
+                }
             }
         }
         else if (cookieHeaderOrRequest) {
             session._sessionId = session.parseCookies(cookieHeaderOrRequest);
         }
         else {
-            // When called with no arguments, try to auto-detect cookie header from Next.js context
+            // When called with no arguments, try to auto-detect from Next.js context
             try {
-                // Dynamic import of next/headers - only available in Next.js server context
                 const { headers } = await import('next/headers');
                 const headersList = await headers();
                 if (headersList && typeof headersList.get === 'function') {
-                    const cookieHeader = headersList.get('cookie');
-                    if (cookieHeader) {
-                        session._sessionId = session.parseCookies(cookieHeader);
+                    const authHeader = headersList.get('authorization');
+                    const bearerToken = authHeader?.trim().toLowerCase().startsWith('bearer ')
+                        ? authHeader.trim().slice(7).trim() || null
+                        : null;
+                    if (bearerToken) {
+                        await session.verifyAndSetBearerSession(bearerToken);
+                    }
+                    else {
+                        const cookieHeader = headersList.get('cookie');
+                        if (cookieHeader) {
+                            session._sessionId = session.parseCookies(cookieHeader);
+                        }
                     }
                 }
             }
             catch {
                 // Not in Next.js context or headers() not available - silently continue
-                // This is expected when called outside of Next.js or when creating new sessions
             }
         }
         return session;
     }
+    /**
+     * Parse Authorization: Bearer <token> from Request or Headers.
+     * Returns the JWT string or null if missing/invalid format.
+     */
+    static parseBearerToken(requestOrHeaders) {
+        const auth = requestOrHeaders instanceof Request
+            ? requestOrHeaders.headers.get('authorization')
+            : requestOrHeaders.get('authorization');
+        if (!auth || typeof auth !== 'string')
+            return null;
+        const trimmed = auth.trim();
+        if (!trimmed.toLowerCase().startsWith('bearer '))
+            return null;
+        const token = trimmed.slice(7).trim();
+        return token || null;
+    }
+    /**
+     * Verify the Bearer JWT and set ephemeral session (not cached).
+     * When token is provided (async path), generates a new sessionId.
+     * When called with no args, uses pendingBearerToken (sync path, lazy verification).
+     */
+    async verifyAndSetBearerSession(token) {
+        const raw = token ?? this.pendingBearerToken;
+        if (!raw)
+            return;
+        const auth = this.getAuth();
+        let claims;
+        try {
+            claims = (await auth.verifyAndDecodeJwt(raw));
+        }
+        catch {
+            this._sessionId = undefined;
+            this.pendingBearerToken = undefined;
+            throw new Error('Invalid or expired Bearer JWT');
+        }
+        const exp = typeof claims.exp === 'number' ? claims.exp : 0;
+        const sessionId = token ? this.generateSessionId() : this._sessionId;
+        if (token)
+            this._sessionId = sessionId;
+        this.bearerSession = { sessionId, accessToken: raw, claims, exp };
+        this.pendingBearerToken = undefined;
+    }
     parseCookies(header) {
         const cookieName = process.env.SSI_COOKIE_NAME ?? 'ssi_session';
         for (const part of header.split(/;\s*/)) {
@@ -212,8 +274,43 @@ class SessionManager {
     /**
      * Get session data by key. For 'claims', decodes the id_token payload
      * WITHOUT verification (use your verifier upstream for security).
+     * Bearer JWT sessions: returns from verified ephemeral data (not cached).
      */
     async getSessionData(sessionId, dataKey) {
+        if (this.bearerSession?.sessionId === sessionId) {
+            const b = this.bearerSession;
+            if (dataKey === 'claims')
+                return b.claims;
+            if (dataKey === 'access_token')
+                return b.accessToken;
+            if (dataKey === 'id_token')
+                return b.accessToken;
+            if (dataKey === 'refresh_token')
+                return null;
+            return null;
+        }
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            try {
+                await this.verifyAndSetBearerSession();
+            }
+            catch {
+                this._sessionId = undefined;
+                this.pendingBearerToken = undefined;
+                return null;
+            }
+            if (this.bearerSession?.sessionId === sessionId) {
+                const b = this.bearerSession;
+                if (dataKey === 'claims')
+                    return b.claims;
+                if (dataKey === 'access_token')
+                    return b.accessToken;
+                if (dataKey === 'id_token')
+                    return b.accessToken;
+                if (dataKey === 'refresh_token')
+                    return null;
+                return null;
+            }
+        }
         const keyToCheck = dataKey === 'claims' ? 'id_token' : dataKey;
         try {
             await this.ensureFreshOnce(sessionId);
@@ -249,6 +346,11 @@ class SessionManager {
         return value;
     }
     ensureFreshOnce(sessionId) {
+        if (this.bearerSession?.sessionId === sessionId)
+            return Promise.resolve();
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            return this.verifyAndSetBearerSession();
+        }
         const existing = this.freshnessOnce.get(sessionId);
         if (existing)
             return existing;
@@ -319,9 +421,17 @@ class SessionManager {
     }
     /**
      * Delete all keys under this session object (id/access/refresh).
+     * For Bearer sessions, clears in-memory state only (nothing was cached).
      */
     async clearSession(sessionId) {
         const deleteCookieHeader = this.buildSessionCookie('', { maxAge: 0 });
+        if (this.bearerSession?.sessionId === sessionId || (this.pendingBearerToken && this._sessionId === sessionId)) {
+            this.bearerSession = undefined;
+            this.pendingBearerToken = undefined;
+            if (this._sessionId === sessionId)
+                this._sessionId = undefined;
+            return deleteCookieHeader;
+        }
         const keys = (await this.storage.keysForObject(sessionId)) ?? [];
         if (!keys.length)
             return deleteCookieHeader;
@@ -348,11 +458,33 @@ class SessionManager {
     }
     /** Returns remaining TTL in seconds for this session's id_token, or null if none */
     async getSessionTtlSeconds(sessionId) {
+        if (this.bearerSession?.sessionId === sessionId) {
+            const secs = this.bearerSession.exp - Math.floor(Date.now() / 1000);
+            return Math.max(0, secs);
+        }
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            await this.verifyAndSetBearerSession();
+            if (this.bearerSession?.sessionId === sessionId) {
+                const secs = this.bearerSession.exp - Math.floor(Date.now() / 1000);
+                return Math.max(0, secs);
+            }
+        }
         return this.storage.getRemainingTtl(sessionId, 'id_token');
     }
     async getVerifiedClaims(sessionId) {
         if (!sessionId)
             return null;
+        if (this.bearerSession?.sessionId === sessionId)
+            return this.bearerSession.claims;
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            try {
+                await this.verifyAndSetBearerSession();
+                return this.bearerSession?.sessionId === sessionId ? this.bearerSession.claims : null;
+            }
+            catch {
+                return null;
+            }
+        }
         try {
             await this.ensureFreshOnce(sessionId);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@serialsubscriptions/platform-integration",
-    "version": "0.0.85.1",
+    "version": "0.0.85.3",
     "description": "Serial Subscriptions Libraries",
     "main": "lib/index.js",
     "types": "lib/index.d.ts",