@serialsubscriptions/platform-integration 0.0.8-5.2 → 0.0.8-5.3

package/lib/session/SessionManager.d.ts

@@ -42,10 +42,18 @@ export declare class SessionManager {
     private auth?;
     private _sessionId?;
     private authConfig?;
+    private bearerSession?;
+    private pendingBearerToken?;
     private static inFlightRefresh;
     private freshnessOnce;
     /** Accepts AuthConfig or SSIRequestConfig (e.g. from getRequestConfig(req)). */
     constructor(storage: SSIStorage, authConfig?: AuthConfigInput);
+    /**
+     * Create a session from environment: cookie or Authorization: Bearer JWT.
+     * When a Request is passed and contains "Authorization: Bearer <token>", the token is verified
+     * (valid and not expired); a session id is generated but not cached. Cookie is used only when
+     * no Bearer header is present.
+     */
     static fromEnv(): SessionManager;
     static fromEnv(cookieHeader: string | null, authConfig?: AuthConfigInput): SessionManager;
     static fromEnv(request: Request, authConfig?: AuthConfigInput): SessionManager;
@@ -70,6 +78,17 @@ export declare class SessionManager {
     static fromEnvAsync(cookieHeader: string | null, authConfig?: AuthConfigInput): Promise<SessionManager>;
     static fromEnvAsync(request: Request, authConfig?: AuthConfigInput): Promise<SessionManager>;
     static fromEnvAsync(authConfig: AuthConfigInput): Promise<SessionManager>;
+    /**
+     * Parse Authorization: Bearer <token> from Request or Headers.
+     * Returns the JWT string or null if missing/invalid format.
+     */
+    private static parseBearerToken;
+    /**
+     * Verify the Bearer JWT and set ephemeral session (not cached).
+     * When token is provided (async path), generates a new sessionId.
+     * When called with no args, uses pendingBearerToken (sync path, lazy verification).
+     */
+    private verifyAndSetBearerSession;
     private parseCookies;
     get sessionId(): string | undefined;
     /** Cryptographically strong, URL-safe session id */
@@ -112,11 +131,13 @@ export declare class SessionManager {
     /**
      * Get session data by key. For 'claims', decodes the id_token payload
      * WITHOUT verification (use your verifier upstream for security).
+     * Bearer JWT sessions: returns from verified ephemeral data (not cached).
      */
     getSessionData(sessionId: string, dataKey: SessionDataKey): Promise<KVValue | null>;
     private ensureFreshOnce;
     /**
      * Delete all keys under this session object (id/access/refresh).
+     * For Bearer sessions, clears in-memory state only (nothing was cached).
      */
     clearSession(sessionId: string): Promise<string>;
     /**

package/lib/session/SessionManager.js

@@ -57,9 +57,16 @@ class SessionManager {
         }
         const session = new SessionManager(SSIStorage_1.SSIStorage.fromEnv(), actualAuthConfig);
         if (cookieHeaderOrRequest instanceof Request) {
-            const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
-            if (cookieHeader) {
-                session._sessionId = session.parseCookies(cookieHeader);
+            const bearerToken = SessionManager.parseBearerToken(cookieHeaderOrRequest);
+            if (bearerToken) {
+                session._sessionId = session.generateSessionId();
+                session.pendingBearerToken = bearerToken;
+            }
+            else {
+                const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
+                if (cookieHeader) {
+                    session._sessionId = session.parseCookies(cookieHeader);
+                }
             }
         }
         else if (cookieHeaderOrRequest) {
@@ -84,34 +91,89 @@ class SessionManager {
         }
         const session = new SessionManager(SSIStorage_1.SSIStorage.fromEnv(), actualAuthConfig);
         if (cookieHeaderOrRequest instanceof Request) {
-            const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
-            if (cookieHeader) {
-                session._sessionId = session.parseCookies(cookieHeader);
+            const bearerToken = SessionManager.parseBearerToken(cookieHeaderOrRequest);
+            if (bearerToken) {
+                await session.verifyAndSetBearerSession(bearerToken);
+            }
+            else {
+                const cookieHeader = cookieHeaderOrRequest.headers.get('cookie');
+                if (cookieHeader) {
+                    session._sessionId = session.parseCookies(cookieHeader);
+                }
             }
         }
         else if (cookieHeaderOrRequest) {
             session._sessionId = session.parseCookies(cookieHeaderOrRequest);
         }
         else {
-            // When called with no arguments, try to auto-detect cookie header from Next.js context
+            // When called with no arguments, try to auto-detect from Next.js context
             try {
-                // Dynamic import of next/headers - only available in Next.js server context
                 const { headers } = await import('next/headers');
                 const headersList = await headers();
                 if (headersList && typeof headersList.get === 'function') {
-                    const cookieHeader = headersList.get('cookie');
-                    if (cookieHeader) {
-                        session._sessionId = session.parseCookies(cookieHeader);
+                    const authHeader = headersList.get('authorization');
+                    const bearerToken = authHeader?.trim().toLowerCase().startsWith('bearer ')
+                        ? authHeader.trim().slice(7).trim() || null
+                        : null;
+                    if (bearerToken) {
+                        await session.verifyAndSetBearerSession(bearerToken);
+                    }
+                    else {
+                        const cookieHeader = headersList.get('cookie');
+                        if (cookieHeader) {
+                            session._sessionId = session.parseCookies(cookieHeader);
+                        }
                     }
                 }
             }
             catch {
                 // Not in Next.js context or headers() not available - silently continue
-                // This is expected when called outside of Next.js or when creating new sessions
             }
         }
         return session;
     }
+    /**
+     * Parse Authorization: Bearer <token> from Request or Headers.
+     * Returns the JWT string or null if missing/invalid format.
+     */
+    static parseBearerToken(requestOrHeaders) {
+        const auth = requestOrHeaders instanceof Request
+            ? requestOrHeaders.headers.get('authorization')
+            : requestOrHeaders.get('authorization');
+        if (!auth || typeof auth !== 'string')
+            return null;
+        const trimmed = auth.trim();
+        if (!trimmed.toLowerCase().startsWith('bearer '))
+            return null;
+        const token = trimmed.slice(7).trim();
+        return token || null;
+    }
+    /**
+     * Verify the Bearer JWT and set ephemeral session (not cached).
+     * When token is provided (async path), generates a new sessionId.
+     * When called with no args, uses pendingBearerToken (sync path, lazy verification).
+     */
+    async verifyAndSetBearerSession(token) {
+        const raw = token ?? this.pendingBearerToken;
+        if (!raw)
+            return;
+        const auth = this.getAuth();
+        let claims;
+        try {
+            claims = (await auth.verifyAndDecodeJwt(raw));
+        }
+        catch {
+            this._sessionId = undefined;
+            this.pendingBearerToken = undefined;
+            throw new Error('Invalid or expired Bearer JWT');
+        }
+        const exp = typeof claims.exp === 'number' ? claims.exp : 0;
+        const sessionId = token ? this.generateSessionId() : this._sessionId;
+        if (token)
+            this._sessionId = sessionId;
+        this.bearerSession = { sessionId, accessToken: raw, claims, exp };
+        this.pendingBearerToken = undefined;
+    }
     parseCookies(header) {
         const cookieName = process.env.SSI_COOKIE_NAME ?? 'ssi_session';
         for (const part of header.split(/;\s*/)) {
@@ -212,8 +274,43 @@ class SessionManager {
     /**
      * Get session data by key. For 'claims', decodes the id_token payload
      * WITHOUT verification (use your verifier upstream for security).
+     * Bearer JWT sessions: returns from verified ephemeral data (not cached).
      */
     async getSessionData(sessionId, dataKey) {
+        if (this.bearerSession?.sessionId === sessionId) {
+            const b = this.bearerSession;
+            if (dataKey === 'claims')
+                return b.claims;
+            if (dataKey === 'access_token')
+                return b.accessToken;
+            if (dataKey === 'id_token')
+                return b.accessToken;
+            if (dataKey === 'refresh_token')
+                return null;
+            return null;
+        }
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            try {
+                await this.verifyAndSetBearerSession();
+            }
+            catch {
+                this._sessionId = undefined;
+                this.pendingBearerToken = undefined;
+                return null;
+            }
+            if (this.bearerSession?.sessionId === sessionId) {
+                const b = this.bearerSession;
+                if (dataKey === 'claims')
+                    return b.claims;
+                if (dataKey === 'access_token')
+                    return b.accessToken;
+                if (dataKey === 'id_token')
+                    return b.accessToken;
+                if (dataKey === 'refresh_token')
+                    return null;
+                return null;
+            }
+        }
         const keyToCheck = dataKey === 'claims' ? 'id_token' : dataKey;
         try {
             await this.ensureFreshOnce(sessionId);
@@ -249,6 +346,11 @@ class SessionManager {
         return value;
     }
     ensureFreshOnce(sessionId) {
+        if (this.bearerSession?.sessionId === sessionId)
+            return Promise.resolve();
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            return this.verifyAndSetBearerSession();
+        }
         const existing = this.freshnessOnce.get(sessionId);
         if (existing)
             return existing;
@@ -319,9 +421,17 @@ class SessionManager {
     }
     /**
      * Delete all keys under this session object (id/access/refresh).
+     * For Bearer sessions, clears in-memory state only (nothing was cached).
      */
     async clearSession(sessionId) {
         const deleteCookieHeader = this.buildSessionCookie('', { maxAge: 0 });
+        if (this.bearerSession?.sessionId === sessionId || (this.pendingBearerToken && this._sessionId === sessionId)) {
+            this.bearerSession = undefined;
+            this.pendingBearerToken = undefined;
+            if (this._sessionId === sessionId)
+                this._sessionId = undefined;
+            return deleteCookieHeader;
+        }
         const keys = (await this.storage.keysForObject(sessionId)) ?? [];
         if (!keys.length)
             return deleteCookieHeader;
@@ -348,11 +458,33 @@ class SessionManager {
     }
     /** Returns remaining TTL in seconds for this session's id_token, or null if none */
     async getSessionTtlSeconds(sessionId) {
+        if (this.bearerSession?.sessionId === sessionId) {
+            const secs = this.bearerSession.exp - Math.floor(Date.now() / 1000);
+            return Math.max(0, secs);
+        }
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            await this.verifyAndSetBearerSession();
+            if (this.bearerSession?.sessionId === sessionId) {
+                const secs = this.bearerSession.exp - Math.floor(Date.now() / 1000);
+                return Math.max(0, secs);
+            }
+        }
         return this.storage.getRemainingTtl(sessionId, 'id_token');
     }
     async getVerifiedClaims(sessionId) {
         if (!sessionId)
             return null;
+        if (this.bearerSession?.sessionId === sessionId)
+            return this.bearerSession.claims;
+        if (this.pendingBearerToken && this._sessionId === sessionId) {
+            try {
+                await this.verifyAndSetBearerSession();
+                return this.bearerSession?.sessionId === sessionId ? this.bearerSession.claims : null;
+            }
+            catch {
+                return null;
+            }
+        }
         try {
             await this.ensureFreshOnce(sessionId);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@serialsubscriptions/platform-integration",
-    "version": "0.0.85.2",
+    "version": "0.0.85.3",
     "description": "Serial Subscriptions Libraries",
     "main": "lib/index.js",
     "types": "lib/index.d.ts",