@solvapay/auth 1.0.8-preview.6 → 1.0.8-preview.8

package/dist/src/next-utils.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Next.js Route Utilities
+ *
+ * Helper functions for common patterns in Next.js API routes.
+ * These utilities work with authenticated requests where user IDs
+ * have been extracted and set in headers (e.g., by middleware).
+ *
+ * Note: These functions work with the standard web Request API
+ * and can be used with Next.js NextRequest (which extends Request)
+ */
+/**
+ * Extract user ID from request headers.
+ *
+ * Checks for the 'x-user-id' header which is commonly set by authentication
+ * middleware after successful authentication. This header is typically set
+ * by Next.js middleware that validates JWT tokens or session cookies.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.headerName - Custom header name (default: 'x-user-id')
+ * @returns User ID string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserIdFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const userId = getUserIdFromRequest(request);
+ *
+ *   if (!userId) {
+ *     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+ *   }
+ *
+ *   // Use userId...
+ *   return NextResponse.json({ userId });
+ * }
+ * ```
+ *
+ * @see {@link requireUserId} for a version that returns an error response
+ * @since 1.0.0
+ */
+export declare function getUserIdFromRequest(request: Request, options?: {
+    headerName?: string;
+}): string | null;
+/**
+ * Extract user email from Supabase JWT token in Authorization header.
+ *
+ * Parses and validates a Supabase JWT token from the Authorization header
+ * and extracts the email claim. Returns null if the token is missing, invalid,
+ * or expired.
+ *
+ * Uses dynamic imports for Edge runtime compatibility.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @returns User email string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserEmailFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const email = await getUserEmailFromRequest(request);
+ *
+ *   if (!email) {
+ *     return NextResponse.json({ error: 'Email not found' }, { status: 401 });
+ *   }
+ *
+ *   return NextResponse.json({ email });
+ * }
+ * ```
+ *
+ * @see {@link getUserNameFromRequest} for extracting user name
+ * @since 1.0.0
+ */
+export declare function getUserEmailFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Extract user name from Supabase JWT token in Authorization header.
+ *
+ * Parses and validates a Supabase JWT token from the Authorization header
+ * and extracts the name from user metadata. Checks multiple possible locations:
+ * - `user_metadata.full_name`
+ * - `user_metadata.name`
+ * - `name` claim
+ *
+ * Returns null if the token is missing, invalid, or name is not found.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @returns User name string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserNameFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const name = await getUserNameFromRequest(request);
+ *
+ *   return NextResponse.json({ name: name || 'Guest' });
+ * }
+ * ```
+ *
+ * @see {@link getUserEmailFromRequest} for extracting user email
+ * @since 1.0.0
+ */
+export declare function getUserNameFromRequest(request: Request, options?: {
+    jwtSecret?: string;
+}): Promise<string | null>;
+/**
+ * Require user ID from request headers or return an error response.
+ *
+ * This is a convenience function that combines `getUserIdFromRequest()` with
+ * error handling. If the user ID is not found, it returns a Response object
+ * with a 401 status that can be directly returned from Next.js route handlers.
+ *
+ * Returns a standard Response object that works with Next.js (NextResponse
+ * extends Response, so this is fully compatible).
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.headerName - Custom header name (default: 'x-user-id')
+ * @param options.errorMessage - Custom error message (default: 'Unauthorized')
+ * @param options.errorDetails - Custom error details (default: 'User ID not found. Ensure middleware is configured.')
+ * @returns Either the user ID string or a Response error object with 401 status
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { requireUserId } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const userIdOrError = requireUserId(request);
+ *
+ *   if (userIdOrError instanceof Response) {
+ *     return userIdOrError; // Returns 401 error
+ *   }
+ *
+ *   // userIdOrError is now a string
+ *   const userId = userIdOrError;
+ *   // Use userId...
+ * }
+ * ```
+ *
+ * @see {@link getUserIdFromRequest} for a version that returns null instead of error
+ * @since 1.0.0
+ */
+export declare function requireUserId(request: Request, options?: {
+    headerName?: string;
+    errorMessage?: string;
+    errorDetails?: string;
+}): string | Response;
+//# sourceMappingURL=next-utils.d.ts.map

package/dist/src/next-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-utils.d.ts","sourceRoot":"","sources":["../../src/next-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GACA,MAAM,GAAG,IAAI,CAGf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgCxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqCxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA,MAAM,GAAG,QAAQ,CAgBnB"}

package/dist/src/next-utils.js

@@ -0,0 +1,222 @@
+/**
+ * Next.js Route Utilities
+ *
+ * Helper functions for common patterns in Next.js API routes.
+ * These utilities work with authenticated requests where user IDs
+ * have been extracted and set in headers (e.g., by middleware).
+ *
+ * Note: These functions work with the standard web Request API
+ * and can be used with Next.js NextRequest (which extends Request)
+ */
+/**
+ * Extract user ID from request headers.
+ *
+ * Checks for the 'x-user-id' header which is commonly set by authentication
+ * middleware after successful authentication. This header is typically set
+ * by Next.js middleware that validates JWT tokens or session cookies.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.headerName - Custom header name (default: 'x-user-id')
+ * @returns User ID string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserIdFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const userId = getUserIdFromRequest(request);
+ *
+ *   if (!userId) {
+ *     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+ *   }
+ *
+ *   // Use userId...
+ *   return NextResponse.json({ userId });
+ * }
+ * ```
+ *
+ * @see {@link requireUserId} for a version that returns an error response
+ * @since 1.0.0
+ */
+export function getUserIdFromRequest(request, options) {
+    const headerName = options?.headerName || 'x-user-id';
+    return request.headers.get(headerName);
+}
+/**
+ * Extract user email from Supabase JWT token in Authorization header.
+ *
+ * Parses and validates a Supabase JWT token from the Authorization header
+ * and extracts the email claim. Returns null if the token is missing, invalid,
+ * or expired.
+ *
+ * Uses dynamic imports for Edge runtime compatibility.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @returns User email string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserEmailFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const email = await getUserEmailFromRequest(request);
+ *
+ *   if (!email) {
+ *     return NextResponse.json({ error: 'Email not found' }, { status: 401 });
+ *   }
+ *
+ *   return NextResponse.json({ email });
+ * }
+ * ```
+ *
+ * @see {@link getUserNameFromRequest} for extracting user name
+ * @since 1.0.0
+ */
+export async function getUserEmailFromRequest(request, options) {
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return null;
+    }
+    const token = authHeader.slice(7);
+    if (!token) {
+        return null;
+    }
+    try {
+        // Dynamic import to avoid requiring jose if not used (Edge-compatible)
+        const { jwtVerify } = await import('jose');
+        const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+        if (!jwtSecret) {
+            return null;
+        }
+        const secret = new TextEncoder().encode(jwtSecret);
+        const { payload } = await jwtVerify(token, secret, {
+            algorithms: ['HS256'],
+        });
+        // Extract email from payload (Supabase stores email in 'email' claim)
+        return payload.email ? String(payload.email) : null;
+    }
+    catch {
+        // Return null on any error (invalid token, expired, etc.)
+        return null;
+    }
+}
+/**
+ * Extract user name from Supabase JWT token in Authorization header.
+ *
+ * Parses and validates a Supabase JWT token from the Authorization header
+ * and extracts the name from user metadata. Checks multiple possible locations:
+ * - `user_metadata.full_name`
+ * - `user_metadata.name`
+ * - `name` claim
+ *
+ * Returns null if the token is missing, invalid, or name is not found.
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @returns User name string or null if not found
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { getUserNameFromRequest } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const name = await getUserNameFromRequest(request);
+ *
+ *   return NextResponse.json({ name: name || 'Guest' });
+ * }
+ * ```
+ *
+ * @see {@link getUserEmailFromRequest} for extracting user email
+ * @since 1.0.0
+ */
+export async function getUserNameFromRequest(request, options) {
+    const authHeader = request.headers.get('authorization');
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        return null;
+    }
+    const token = authHeader.slice(7);
+    if (!token) {
+        return null;
+    }
+    try {
+        // Dynamic import to avoid requiring jose if not used (Edge-compatible)
+        const { jwtVerify } = await import('jose');
+        const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
+        if (!jwtSecret) {
+            return null;
+        }
+        const secret = new TextEncoder().encode(jwtSecret);
+        const { payload } = await jwtVerify(token, secret, {
+            algorithms: ['HS256'],
+        });
+        // Extract name from payload (Supabase stores name in 'user_metadata.full_name' or 'user_metadata.name' or 'name' claim)
+        const name = payload.user_metadata?.full_name ||
+            payload.user_metadata?.name ||
+            payload.name ||
+            null;
+        return name ? String(name) : null;
+    }
+    catch {
+        // Return null on any error (invalid token, expired, etc.)
+        return null;
+    }
+}
+/**
+ * Require user ID from request headers or return an error response.
+ *
+ * This is a convenience function that combines `getUserIdFromRequest()` with
+ * error handling. If the user ID is not found, it returns a Response object
+ * with a 401 status that can be directly returned from Next.js route handlers.
+ *
+ * Returns a standard Response object that works with Next.js (NextResponse
+ * extends Response, so this is fully compatible).
+ *
+ * @param request - Request object (works with NextRequest from next/server)
+ * @param options - Configuration options
+ * @param options.headerName - Custom header name (default: 'x-user-id')
+ * @param options.errorMessage - Custom error message (default: 'Unauthorized')
+ * @param options.errorDetails - Custom error details (default: 'User ID not found. Ensure middleware is configured.')
+ * @returns Either the user ID string or a Response error object with 401 status
+ *
+ * @example
+ * ```typescript
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { requireUserId } from '@solvapay/auth';
+ *
+ * export async function GET(request: NextRequest) {
+ *   const userIdOrError = requireUserId(request);
+ *
+ *   if (userIdOrError instanceof Response) {
+ *     return userIdOrError; // Returns 401 error
+ *   }
+ *
+ *   // userIdOrError is now a string
+ *   const userId = userIdOrError;
+ *   // Use userId...
+ * }
+ * ```
+ *
+ * @see {@link getUserIdFromRequest} for a version that returns null instead of error
+ * @since 1.0.0
+ */
+export function requireUserId(request, options) {
+    const headerName = options?.headerName || 'x-user-id';
+    const errorMessage = options?.errorMessage || 'Unauthorized';
+    const errorDetails = options?.errorDetails || 'User ID not found. Ensure middleware is configured.';
+    const userId = request.headers.get(headerName);
+    if (!userId) {
+        return new Response(JSON.stringify({ error: errorMessage, details: errorDetails }), {
+            status: 401,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+    return userId;
+}
+//# sourceMappingURL=next-utils.js.map

package/dist/src/next-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-utils.js","sourceRoot":"","sources":["../../src/next-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,OAEC;IAED,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAA;IACrD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,OAEC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QAE1C,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACvE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YACjD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAA;QAEF,sEAAsE;QACtE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgB,EAChB,OAEC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAEvD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QAE1C,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;QACvE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE;YACjD,UAAU,EAAE,CAAC,OAAO,CAAC;SACtB,CAAC,CAAA;QAEF,wHAAwH;QACxH,MAAM,IAAI,GACP,OAAe,CAAC,aAAa,EAAE,SAAS;YACxC,OAAe,CAAC,aAAa,EAAE,IAAI;YACnC,OAAe,CAAC,IAAI;YACrB,IAAI,CAAA;QACN,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,OAIC;IAED,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,WAAW,CAAA;IACrD,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,cAAc,CAAA;IAC5D,MAAM,YAAY,GAChB,OAAO,EAAE,YAAY,IAAI,qDAAqD,CAAA;IAEhF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAE9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE;YAClF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/solvapay.d.ts

@@ -0,0 +1,65 @@
+/**
+ * SolvaPay Auth Adapter
+ *
+ * Validates SolvaPay OAuth tokens by calling the userinfo endpoint.
+ * Suitable for validating opaque tokens issued by SolvaPay's hosted OAuth service.
+ */
+import type { AuthAdapter, RequestLike } from './adapter';
+export interface SolvapayAuthAdapterConfig {
+    /**
+     * SolvaPay API Base URL (e.g. https://api.solvapay.com)
+     */
+    apiBaseUrl: string;
+}
+/**
+ * SolvaPay authentication adapter
+ *
+ * Validates tokens by calling the SolvaPay userinfo endpoint.
+ * This is required for opaque tokens which cannot be verified offline.
+ */
+export declare class SolvapayAuthAdapter implements AuthAdapter {
+    private apiBaseUrl;
+    constructor(config: SolvapayAuthAdapterConfig);
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+/**
+ * SolvaPay OAuth Client Helpers
+ */
+export interface SolvapayOAuthConfig {
+    clientId: string;
+    clientSecret?: string;
+    authUrl: string;
+    tokenUrl: string;
+    redirectUri: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+}
+export declare class SolvapayOAuthClient {
+    private config;
+    constructor(config: SolvapayOAuthConfig);
+    /**
+     * Get the URL to redirect the user to for login
+     */
+    getAuthorizationUrl(options?: {
+        state?: string;
+        scope?: string;
+    }): string;
+    /**
+     * Exchange an authorization code for an access token
+     */
+    exchangeCodeForToken(code: string): Promise<TokenResponse>;
+    /**
+     * Revoke a token (Sign Out)
+     */
+    revokeToken(token: string): Promise<void>;
+    /**
+     * Get user info using access token
+     */
+    getUserInfo(accessToken: string, userInfoUrl?: string): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=solvapay.d.ts.map

package/dist/src/solvapay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"solvapay.d.ts","sourceRoot":"","sources":["../../src/solvapay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEzD,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,UAAU,CAAQ;gBAEd,MAAM,EAAE,yBAAyB;IAIvC,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAmC/E;AAED;;GAEG;AAEH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,mBAAmB;IAClB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,mBAAmB;IAE/C;;OAEG;IACH,mBAAmB,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAa7E;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA6BhE;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B/C;;OAEG;IACG,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAqB/F"}

package/dist/src/solvapay.js

@@ -0,0 +1,143 @@
+/**
+ * SolvaPay Auth Adapter
+ *
+ * Validates SolvaPay OAuth tokens by calling the userinfo endpoint.
+ * Suitable for validating opaque tokens issued by SolvaPay's hosted OAuth service.
+ */
+/**
+ * SolvaPay authentication adapter
+ *
+ * Validates tokens by calling the SolvaPay userinfo endpoint.
+ * This is required for opaque tokens which cannot be verified offline.
+ */
+export class SolvapayAuthAdapter {
+    apiBaseUrl;
+    constructor(config) {
+        this.apiBaseUrl = config.apiBaseUrl.replace(/\/$/, '');
+    }
+    async getUserIdFromRequest(req) {
+        try {
+            const headers = 'headers' in req ? req.headers : req;
+            const authHeader = headers.get('authorization');
+            if (!authHeader || !authHeader.startsWith('Bearer ')) {
+                return null;
+            }
+            const token = authHeader.slice(7);
+            if (!token) {
+                return null;
+            }
+            // Call SolvaPay userinfo endpoint to validate token and get user ID
+            const response = await fetch(`${this.apiBaseUrl}/v1/customer/auth/userinfo`, {
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    'Content-Type': 'application/json',
+                },
+            });
+            if (!response.ok) {
+                return null;
+            }
+            const userInfo = await response.json();
+            // Return subject (User ID) or customer reference
+            return userInfo.sub || userInfo.id || userInfo.customerRef || null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+export class SolvapayOAuthClient {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Get the URL to redirect the user to for login
+     */
+    getAuthorizationUrl(options = {}) {
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+        });
+        if (options.state)
+            params.append('state', options.state);
+        if (options.scope)
+            params.append('scope', options.scope);
+        return `${this.config.authUrl}?${params.toString()}`;
+    }
+    /**
+     * Exchange an authorization code for an access token
+     */
+    async exchangeCodeForToken(code) {
+        const body = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+        });
+        if (this.config.clientSecret) {
+            body.append('client_secret', this.config.clientSecret);
+        }
+        const response = await fetch(this.config.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+            },
+            body: body.toString(),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new Error(`Failed to exchange code: ${response.status} ${text}`);
+        }
+        return response.json();
+    }
+    /**
+     * Revoke a token (Sign Out)
+     */
+    async revokeToken(token) {
+        // Note: Standard RFC7009 revocation endpoint is usually /oauth/revoke
+        // Assuming SolvaPay follows this or uses a specific endpoint.
+        // Constructing revocation URL based on tokenUrl pattern if not explicitly provided,
+        // or using a known path relative to apiBaseUrl if available.
+        // For now, assuming it's near the token endpoint.
+        const revokeUrl = this.config.tokenUrl.replace('/token', '/revoke');
+        const body = new URLSearchParams({
+            token,
+            client_id: this.config.clientId,
+        });
+        if (this.config.clientSecret) {
+            body.append('client_secret', this.config.clientSecret);
+        }
+        await fetch(revokeUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: body.toString(),
+        });
+    }
+    /**
+     * Get user info using access token
+     */
+    async getUserInfo(accessToken, userInfoUrl) {
+        // If userInfoUrl is not provided, try to guess from tokenUrl or config
+        // But typically this client is used alongside the adapter which knows the base URL
+        if (!userInfoUrl) {
+            throw new Error('userInfoUrl is required');
+        }
+        const response = await fetch(userInfoUrl, {
+            method: 'GET',
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: 'application/json',
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to fetch user info: ${response.status}`);
+        }
+        return response.json();
+    }
+}
+//# sourceMappingURL=solvapay.js.map

package/dist/src/solvapay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"solvapay.js","sourceRoot":"","sources":["../../src/solvapay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACtB,UAAU,CAAQ;IAE1B,YAAY,MAAiC;QAC3C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAA0B;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;YACpD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAE/C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAA;YACb,CAAC;YAED,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,4BAA4B,EAAE;gBAC3E,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,cAAc,EAAE,kBAAkB;iBACnC;aACF,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAEtC,iDAAiD;YACjD,OAAO,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAA;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF;AAsBD,MAAM,OAAO,mBAAmB;IACV;IAApB,YAAoB,MAA2B;QAA3B,WAAM,GAAN,MAAM,CAAqB;IAAG,CAAC;IAEnD;;OAEG;IACH,mBAAmB,CAAC,UAA8C,EAAE;QAClE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QACxD,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;QAExD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IACtD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;SACtC,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,sEAAsE;QACtE,8DAA8D;QAC9D,oFAAoF;QACpF,6DAA6D;QAC7D,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAEnE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAChC,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACxD,CAAC;QAED,MAAM,KAAK,CAAC,SAAS,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,WAAoB;QACvD,uEAAuE;QACvE,mFAAmF;QACnF,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAClE,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAsC,CAAA;IAC9D,CAAC;CACF"}

package/dist/src/supabase.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Supabase Auth Adapter
+ *
+ * Extracts user ID from Supabase JWT tokens using HS256 verification.
+ * Works in both Node.js and Edge runtimes (uses dynamic import for jose).
+ */
+import type { AuthAdapter, RequestLike } from './adapter';
+export interface SupabaseAuthAdapterConfig {
+    /**
+     * Supabase JWT secret (from Supabase dashboard: Settings → API → JWT Secret)
+     */
+    jwtSecret: string;
+}
+/**
+ * Supabase authentication adapter
+ *
+ * Verifies Supabase JWT tokens and extracts the user ID from the `sub` claim.
+ * Uses dynamic import for jose to keep the package lean and Edge-compatible.
+ *
+ * @example
+ * ```ts
+ * import { SupabaseAuthAdapter } from '@solvapay/auth/supabase';
+ *
+ * const auth = new SupabaseAuthAdapter({
+ *   jwtSecret: process.env.SUPABASE_JWT_SECRET!
+ * });
+ *
+ * const userId = await auth.getUserIdFromRequest(request);
+ * if (!userId) {
+ *   return new Response('Unauthorized', { status: 401 });
+ * }
+ * ```
+ */
+export declare class SupabaseAuthAdapter implements AuthAdapter {
+    private jwtSecret;
+    constructor(config: SupabaseAuthAdapterConfig);
+    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
+}
+//# sourceMappingURL=supabase.d.ts.map

package/dist/src/supabase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supabase.d.ts","sourceRoot":"","sources":["../../src/supabase.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEzD,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,SAAS,CAAY;gBAEjB,MAAM,EAAE,yBAAyB;IAOvC,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CA8B/E"}