@solvapay/auth 1.0.8-preview.8 → 1.0.8

package/dist/chunk-ESD73BSC.js

@@ -0,0 +1,104 @@
+// src/next-utils.ts
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
+  }
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
+  }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function extractBearerToken(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+async function resolveJwtPayload(token, jwtSecret) {
+  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+  if (secret) {
+    try {
+      const { jwtVerify } = await import("jose");
+      const key = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+      return payload;
+    } catch {
+      return null;
+    }
+  }
+  if (isStrictMode()) return null;
+  return decodeJwtUnverified(token);
+}
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  return typeof payload.email === "string" ? payload.email : null;
+}
+async function getUserNameFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function requireUserId(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  const errorMessage = options?.errorMessage || "Unauthorized";
+  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
+  const userId = request.headers.get(headerName);
+  if (!userId) {
+    return new Response(JSON.stringify({ error: errorMessage, details: errorDetails }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return userId;
+}
+
+export {
+  getUserIdFromRequest,
+  getUserEmailFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+};

package/dist/index.cjs

@@ -175,59 +175,88 @@ var SolvapayOAuthClient = class {
 };
 
 // src/next-utils.ts
-function getUserIdFromRequest(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  return request.headers.get(headerName);
-}
-async function getUserEmailFromRequest(request, options) {
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
   }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
   }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
   try {
-    const { jwtVerify } = await import("jose");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
-      return null;
-    }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    return payload.email ? String(payload.email) : null;
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
   } catch {
     return null;
   }
 }
-async function getUserNameFromRequest(request, options) {
+function extractBearerToken(request) {
   const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
-  }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
-  }
-  try {
-    const { jwtVerify } = await import("jose");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+async function resolveJwtPayload(token, jwtSecret) {
+  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+  if (secret) {
+    try {
+      const { jwtVerify } = await import("jose");
+      const key = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+      return payload;
+    } catch {
       return null;
     }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    const payloadWithMetadata = payload;
-    const name = payloadWithMetadata.user_metadata?.full_name || payloadWithMetadata.user_metadata?.name || payloadWithMetadata.name || null;
-    return name ? String(name) : null;
-  } catch {
-    return null;
   }
+  if (isStrictMode()) return null;
+  return decodeJwtUnverified(token);
+}
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  return typeof payload.email === "string" ? payload.email : null;
+}
+async function getUserNameFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
 }
 function requireUserId(request, options) {
   const headerName = options?.headerName || "x-user-id";

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   getUserIdFromRequest,
   getUserNameFromRequest,
   requireUserId
-} from "./chunk-IOLE5BMD.js";
+} from "./chunk-ESD73BSC.js";
 
 // src/solvapay.ts
 var SolvapayAuthAdapter = class {

package/dist/next-utils.cjs

@@ -36,59 +36,88 @@ __export(next_utils_exports, {
   requireUserId: () => requireUserId
 });
 module.exports = __toCommonJS(next_utils_exports);
-function getUserIdFromRequest(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  return request.headers.get(headerName);
-}
-async function getUserEmailFromRequest(request, options) {
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
+function base64UrlDecode(input) {
+  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+  const base64 = padded + padding;
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    let result = "";
+    for (let i = 0; i < binary.length; i++) {
+      result += String.fromCharCode(binary.charCodeAt(i));
+    }
+    try {
+      return decodeURIComponent(escape(result));
+    } catch {
+      return result;
+    }
   }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
+  const BufferCtor = globalThis.Buffer;
+  if (BufferCtor) {
+    return BufferCtor.from(base64, "base64").toString("utf-8");
   }
+  throw new Error("No base64 decoder available in this runtime");
+}
+function decodeJwtUnverified(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
   try {
-    const { jwtVerify } = await import("jose");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
-      return null;
-    }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    return payload.email ? String(payload.email) : null;
+    const json = base64UrlDecode(parts[1]);
+    const payload = JSON.parse(json);
+    if (typeof payload !== "object" || payload === null) return null;
+    return payload;
   } catch {
     return null;
   }
 }
-async function getUserNameFromRequest(request, options) {
+function extractBearerToken(request) {
   const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return null;
-  }
-  const token = authHeader.slice(7);
-  if (!token) {
-    return null;
-  }
-  try {
-    const { jwtVerify } = await import("jose");
-    const jwtSecret = options?.jwtSecret || process.env.SUPABASE_JWT_SECRET;
-    if (!jwtSecret) {
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+function readEnv(name) {
+  const proc = globalThis.process;
+  return proc?.env?.[name];
+}
+function isStrictMode() {
+  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+}
+async function resolveJwtPayload(token, jwtSecret) {
+  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+  if (secret) {
+    try {
+      const { jwtVerify } = await import("jose");
+      const key = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+      return payload;
+    } catch {
       return null;
     }
-    const secret = new TextEncoder().encode(jwtSecret);
-    const { payload } = await jwtVerify(token, secret, {
-      algorithms: ["HS256"]
-    });
-    const payloadWithMetadata = payload;
-    const name = payloadWithMetadata.user_metadata?.full_name || payloadWithMetadata.user_metadata?.name || payloadWithMetadata.name || null;
-    return name ? String(name) : null;
-  } catch {
-    return null;
   }
+  if (isStrictMode()) return null;
+  return decodeJwtUnverified(token);
+}
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  return typeof payload.email === "string" ? payload.email : null;
+}
+async function getUserNameFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
 }
 function requireUserId(request, options) {
   const headerName = options?.headerName || "x-user-id";

package/dist/next-utils.d.cts

@@ -44,35 +44,21 @@ declare function getUserIdFromRequest(request: Request, options?: {
     headerName?: string;
 }): string | null;
 /**
- * Extract user email from Supabase JWT token in Authorization header.
+ * Extract user email from a Bearer JWT in the Authorization header.
  *
- * Parses and validates a Supabase JWT token from the Authorization header
- * and extracts the email claim. Returns null if the token is missing, invalid,
- * or expired.
- *
- * Uses dynamic imports for Edge runtime compatibility.
+ * When `SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET` is set (or the
+ * equivalent `options.jwtSecret`), the token is verified via HS256.
+ * Otherwise, the payload is decoded without verification — safe when the
+ * platform gateway has already validated the token (e.g. Supabase Edge
+ * Functions with `verify_jwt = true`, which is the default). Opt into
+ * strict mode with `SOLVAPAY_AUTH_STRICT=true` to disable the
+ * unverified-decode fallback.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options
- * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @param options.jwtSecret - JWT secret (defaults to SOLVAPAY_JWT_SECRET / SUPABASE_JWT_SECRET env var)
  * @returns User email string or null if not found
  *
- * @example
- * ```typescript
- * import { NextRequest, NextResponse } from 'next/server';
- * import { getUserEmailFromRequest } from '@solvapay/auth';
- *
- * export async function GET(request: NextRequest) {
- *   const email = await getUserEmailFromRequest(request);
- *
- *   if (!email) {
- *     return NextResponse.json({ error: 'Email not found' }, { status: 401 });
- *   }
- *
- *   return NextResponse.json({ email });
- * }
- * ```
- *
  * @see {@link getUserNameFromRequest} for extracting user name
  * @since 1.0.0
  */
@@ -80,33 +66,20 @@ declare function getUserEmailFromRequest(request: Request, options?: {
     jwtSecret?: string;
 }): Promise<string | null>;
 /**
- * Extract user name from Supabase JWT token in Authorization header.
+ * Extract user name from a Bearer JWT in the Authorization header.
  *
- * Parses and validates a Supabase JWT token from the Authorization header
- * and extracts the name from user metadata. Checks multiple possible locations:
+ * Checks multiple possible locations:
  * - `user_metadata.full_name`
  * - `user_metadata.name`
  * - `name` claim
  *
- * Returns null if the token is missing, invalid, or name is not found.
+ * See {@link getUserEmailFromRequest} for the verification/fallback model.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options
- * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @param options.jwtSecret - JWT secret (defaults to SOLVAPAY_JWT_SECRET / SUPABASE_JWT_SECRET env var)
  * @returns User name string or null if not found
  *
- * @example
- * ```typescript
- * import { NextRequest, NextResponse } from 'next/server';
- * import { getUserNameFromRequest } from '@solvapay/auth';
- *
- * export async function GET(request: NextRequest) {
- *   const name = await getUserNameFromRequest(request);
- *
- *   return NextResponse.json({ name: name || 'Guest' });
- * }
- * ```
- *
  * @see {@link getUserEmailFromRequest} for extracting user email
  * @since 1.0.0
  */

package/dist/next-utils.d.ts

@@ -44,35 +44,21 @@ declare function getUserIdFromRequest(request: Request, options?: {
     headerName?: string;
 }): string | null;
 /**
- * Extract user email from Supabase JWT token in Authorization header.
+ * Extract user email from a Bearer JWT in the Authorization header.
  *
- * Parses and validates a Supabase JWT token from the Authorization header
- * and extracts the email claim. Returns null if the token is missing, invalid,
- * or expired.
- *
- * Uses dynamic imports for Edge runtime compatibility.
+ * When `SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET` is set (or the
+ * equivalent `options.jwtSecret`), the token is verified via HS256.
+ * Otherwise, the payload is decoded without verification — safe when the
+ * platform gateway has already validated the token (e.g. Supabase Edge
+ * Functions with `verify_jwt = true`, which is the default). Opt into
+ * strict mode with `SOLVAPAY_AUTH_STRICT=true` to disable the
+ * unverified-decode fallback.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options
- * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @param options.jwtSecret - JWT secret (defaults to SOLVAPAY_JWT_SECRET / SUPABASE_JWT_SECRET env var)
  * @returns User email string or null if not found
  *
- * @example
- * ```typescript
- * import { NextRequest, NextResponse } from 'next/server';
- * import { getUserEmailFromRequest } from '@solvapay/auth';
- *
- * export async function GET(request: NextRequest) {
- *   const email = await getUserEmailFromRequest(request);
- *
- *   if (!email) {
- *     return NextResponse.json({ error: 'Email not found' }, { status: 401 });
- *   }
- *
- *   return NextResponse.json({ email });
- * }
- * ```
- *
  * @see {@link getUserNameFromRequest} for extracting user name
  * @since 1.0.0
  */
@@ -80,33 +66,20 @@ declare function getUserEmailFromRequest(request: Request, options?: {
     jwtSecret?: string;
 }): Promise<string | null>;
 /**
- * Extract user name from Supabase JWT token in Authorization header.
+ * Extract user name from a Bearer JWT in the Authorization header.
  *
- * Parses and validates a Supabase JWT token from the Authorization header
- * and extracts the name from user metadata. Checks multiple possible locations:
+ * Checks multiple possible locations:
  * - `user_metadata.full_name`
  * - `user_metadata.name`
  * - `name` claim
  *
- * Returns null if the token is missing, invalid, or name is not found.
+ * See {@link getUserEmailFromRequest} for the verification/fallback model.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options
- * @param options.jwtSecret - Supabase JWT secret (defaults to SUPABASE_JWT_SECRET env var)
+ * @param options.jwtSecret - JWT secret (defaults to SOLVAPAY_JWT_SECRET / SUPABASE_JWT_SECRET env var)
  * @returns User name string or null if not found
  *
- * @example
- * ```typescript
- * import { NextRequest, NextResponse } from 'next/server';
- * import { getUserNameFromRequest } from '@solvapay/auth';
- *
- * export async function GET(request: NextRequest) {
- *   const name = await getUserNameFromRequest(request);
- *
- *   return NextResponse.json({ name: name || 'Guest' });
- * }
- * ```
- *
  * @see {@link getUserEmailFromRequest} for extracting user email
  * @since 1.0.0
  */

package/dist/next-utils.js

@@ -3,7 +3,7 @@ import {
   getUserIdFromRequest,
   getUserNameFromRequest,
   requireUserId
-} from "./chunk-IOLE5BMD.js";
+} from "./chunk-ESD73BSC.js";
 export {
   getUserEmailFromRequest,
   getUserIdFromRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/auth",
-  "version": "1.0.8-preview.8",
+  "version": "1.0.8",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",

package/dist/adapter-4HTpALyc.d.cts

@@ -1,32 +0,0 @@
-/**
- * Auth Adapter Interface
- *
- * Defines the contract for authentication adapters that extract user IDs from requests.
- * Implementations should never throw - return null if authentication fails or is missing.
- */
-/**
- * Request-like object that has headers
- */
-interface RequestLike {
-    headers: Headers | {
-        get(name: string): string | null;
-    };
-}
-/**
- * Auth adapter interface for extracting user IDs from requests
- */
-interface AuthAdapter {
-    /**
-     * Extract the authenticated user ID from a request
-     *
-     * @param req - Request object or object with headers
-     * @returns The user ID string if authenticated, null otherwise
-     *
-     * @remarks
-     * This method should never throw. If authentication fails or is missing,
-     * return null and let the caller decide how to handle unauthenticated requests.
-     */
-    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
-}
-
-export type { AuthAdapter as A, RequestLike as R };

package/dist/adapter-4HTpALyc.d.ts

@@ -1,32 +0,0 @@
-/**
- * Auth Adapter Interface
- *
- * Defines the contract for authentication adapters that extract user IDs from requests.
- * Implementations should never throw - return null if authentication fails or is missing.
- */
-/**
- * Request-like object that has headers
- */
-interface RequestLike {
-    headers: Headers | {
-        get(name: string): string | null;
-    };
-}
-/**
- * Auth adapter interface for extracting user IDs from requests
- */
-interface AuthAdapter {
-    /**
-     * Extract the authenticated user ID from a request
-     *
-     * @param req - Request object or object with headers
-     * @returns The user ID string if authenticated, null otherwise
-     *
-     * @remarks
-     * This method should never throw. If authentication fails or is missing,
-     * return null and let the caller decide how to handle unauthenticated requests.
-     */
-    getUserIdFromRequest(req: Request | RequestLike): Promise<string | null>;
-}
-
-export type { AuthAdapter as A, RequestLike as R };