@shad-claiborne/hono-middleware-oidc 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shad Claiborne
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,29 @@
+# This package is not intended for production environments.
+`wrangler configuration`
+```json
+"vars": {
+        "HONO_OIDC_ISSUER": "https://some-idp",
+        "HONO_OIDC_CLIENT_ID": "client-id",
+        "HONO_OIDC_CLIENT_SECRET": "client-secret",
+        "HONO_OIDC_REDIRECT_URI": "https://your-authenticated-app/auth/callback",
+        "HONO_OIDC_COOKIE_SECRET": "cookie-secret",
+        "HONO_OIDC_ID_TOKEN_COOKIE": "id-token",
+        "HONO_OIDC_REFRESH_TOKEN_COOKIE": "refresh-token",
+        "HONO_OIDC_ACCESS_TOKEN_COOKIE": "access-token",
+        "HONO_OIDC_CODE_VERIFIER_COOKIE": "code-verifier"
+}
+```
+### Usage
+```ts
+app.use('*', except('/auth/callback', withIdentity));
+
+app.use('/auth/callback', forAuthorization);
+
+app.get('/async/api/identity', async (c) => {
+    return c.json(c.get('identity'));
+});
+
+app.get('/', async (c) => {
+    return c.text('hello world');
+});
+```

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export declare const withIdentity: import("hono/types").MiddlewareHandler<any, string, {}, Response | (Response & import("hono/types").TypedResponse<undefined, 302, "redirect">)>;
+export declare const forAuthorization: import("hono/types").MiddlewareHandler<any, string, {}, Response & import("hono/types").TypedResponse<undefined, 302, "redirect">>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -0,0 +1,82 @@
+import { deleteCookie, getSignedCookie, setSignedCookie } from "hono/cookie";
+import { createMiddleware } from "hono/factory";
+import { createIdentityProvider, } from "@shad-claiborne/basic-oidc";
+import randomstring from "randomstring";
+import { env } from "hono/adapter";
+export const withIdentity = createMiddleware(async (c, next) => {
+    const { HONO_OIDC_ISSUER, HONO_OIDC_CLIENT_ID, HONO_OIDC_CLIENT_SECRET, HONO_OIDC_REDIRECT_URI, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_ACCESS_TOKEN_COOKIE, HONO_OIDC_REFRESH_TOKEN_COOKIE, HONO_OIDC_ID_TOKEN_COOKIE, HONO_OIDC_CODE_VERIFIER_COOKIE, } = env(c);
+    const provider = await createIdentityProvider(HONO_OIDC_ISSUER);
+    const client = provider.createClient(HONO_OIDC_CLIENT_ID, HONO_OIDC_CLIENT_SECRET);
+    const tokenSet = {
+        id_token: await getSignedCookie(c, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_ID_TOKEN_COOKIE),
+        access_token: await getSignedCookie(c, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_ACCESS_TOKEN_COOKIE),
+        refresh_token: await getSignedCookie(c, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_REFRESH_TOKEN_COOKIE),
+    };
+    let id;
+    try {
+        id = await provider.getIdentity(client, tokenSet);
+    }
+    catch (err) {
+        id = null;
+    }
+    if (id === null) {
+        try {
+            const tokenResponse = await client.refreshAccess(tokenSet);
+            id = await provider.getIdentity(client, tokenResponse);
+            if (tokenResponse.access_token)
+                await setSignedCookie(c, HONO_OIDC_ACCESS_TOKEN_COOKIE, tokenResponse.access_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+            if (tokenResponse.refresh_token)
+                await setSignedCookie(c, HONO_OIDC_REFRESH_TOKEN_COOKIE, tokenResponse.refresh_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+            if (tokenResponse.id_token)
+                await setSignedCookie(c, HONO_OIDC_ID_TOKEN_COOKIE, tokenResponse.id_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+        }
+        catch (err) {
+            const stateId = randomstring.generate(5);
+            const state = { originUrl: c.req.url };
+            await setSignedCookie(c, `_authstate-${stateId}`, JSON.stringify(state), HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+            const codeVerifier = randomstring.generate(16);
+            await setSignedCookie(c, HONO_OIDC_CODE_VERIFIER_COOKIE, codeVerifier, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+            const authRequest = client
+                .newAuthorizationRequest()
+                .setRedirectUri(HONO_OIDC_REDIRECT_URI)
+                .setResponseMode("query")
+                .setResponseType("code id_token")
+                .setScope(["profile"])
+                .setCodeChallenge(codeVerifier)
+                .setState(stateId);
+            const authRequestURL = authRequest.toURL();
+            return c.redirect(authRequestURL.toString());
+        }
+    }
+    c.set("identity", id);
+    await next();
+});
+export const forAuthorization = createMiddleware(async (c) => {
+    const { HONO_OIDC_ISSUER, HONO_OIDC_CLIENT_ID, HONO_OIDC_CLIENT_SECRET, HONO_OIDC_REDIRECT_URI, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_ACCESS_TOKEN_COOKIE, HONO_OIDC_REFRESH_TOKEN_COOKIE, HONO_OIDC_ID_TOKEN_COOKIE, HONO_OIDC_CODE_VERIFIER_COOKIE, } = env(c);
+    const provider = await createIdentityProvider(HONO_OIDC_ISSUER);
+    const client = provider.createClient(HONO_OIDC_CLIENT_ID, HONO_OIDC_CLIENT_SECRET);
+    const requestURL = new URL(c.req.url), requestParams = requestURL.searchParams;
+    const authResponse = Object.fromEntries(requestParams);
+    const stateId = requestParams.get("state");
+    if (stateId === undefined)
+        throw new Error("state missing from authorization response");
+    const stateCookie = `_authstate-${stateId}`;
+    const stateJson = await getSignedCookie(c, HONO_OIDC_COOKIE_SECRET, stateCookie);
+    deleteCookie(c, stateCookie);
+    if (stateJson === false || stateJson === undefined)
+        throw new Error("state cookie failed");
+    const state = JSON.parse(stateJson);
+    const codeVerifier = await getSignedCookie(c, HONO_OIDC_COOKIE_SECRET, HONO_OIDC_CODE_VERIFIER_COOKIE);
+    deleteCookie(c, HONO_OIDC_CODE_VERIFIER_COOKIE);
+    if (codeVerifier === false || codeVerifier === undefined)
+        throw new Error("code verifier cookie failed");
+    const tokenResponse = await client.requestAccess(authResponse, { codeVerifier, redirectUri: HONO_OIDC_REDIRECT_URI });
+    if (tokenResponse.access_token)
+        await setSignedCookie(c, HONO_OIDC_ACCESS_TOKEN_COOKIE, tokenResponse.access_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+    if (tokenResponse.refresh_token)
+        await setSignedCookie(c, HONO_OIDC_REFRESH_TOKEN_COOKIE, tokenResponse.refresh_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+    if (tokenResponse.id_token)
+        await setSignedCookie(c, HONO_OIDC_ID_TOKEN_COOKIE, tokenResponse.id_token, HONO_OIDC_COOKIE_SECRET, { httpOnly: true, secure: true, sameSite: "strict" });
+    return c.redirect(state.originUrl);
+});
+//# sourceMappingURL=index.js.map

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@shad-claiborne/hono-middleware-oidc",
+  "version": "1.0.0",
+  "description": "OIDC middleware for Hono",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./identity-provider": {
+      "import": "./dist/identity-provider/index.js",
+      "types": "./dist/identity-provider/index.d.ts"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest"
+  },
+  "keywords": [
+    "hono",
+    "honojs",
+    "openid",
+    "oauth"
+  ],
+  "author": "Shad Claiborne <me@shadclaiborne.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/shad-claiborne/hono-middleware-oidc.git"
+  },
+  "devDependencies": {
+    "@types/axios": "^0.9.36",
+    "@types/crypto-js": "^4.2.2",
+    "@types/node": "^25.0.6",
+    "@types/randomstring": "^1.3.0",
+    "dotenv": "^17.2.3",
+    "msw": "^2.12.7",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.17"
+  },
+  "dependencies": {
+    "@shad-claiborne/basic-oidc": "^1.1.9",
+    "axios": "^1.13.2",
+    "crypto-js": "^4.2.0",
+    "hono": "^4.11.3",
+    "randomstring": "^1.3.1"
+  }
+}