@solvapay/auth 1.2.0 → 1.3.0-preview-3fd9d2205ea1113de9bbfb34ba7217629ccf40f0

package/dist/chunk-WVD7RQ6U.js

@@ -0,0 +1,134 @@
+// src/verify-token.ts
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+var ASYMMETRIC_ALGORITHMS = ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "EdDSA"];
+var TOKEN_NOT_VERIFIABLE = "No way to verify the authentication token. Set SOLVAPAY_JWT_SECRET (HS256 tokens), SOLVAPAY_JWKS_URL (ES256/RS256 tokens; derived from SUPABASE_URL on Supabase), or SOLVAPAY_AUTH_TRUST_GATEWAY=true if a gateway verifies every token before this handler.";
+function readEnv(name) {
+  const proc = globalThis.process;
+  const deno = globalThis.Deno;
+  const value = proc?.env?.[name] ?? deno?.env?.get(name);
+  return value && value.length > 0 ? value : void 0;
+}
+function supabaseJwksUrl() {
+  const base = readEnv("SUPABASE_URL");
+  return base ? `${base.replace(/\/+$/, "")}/auth/v1/.well-known/jwks.json` : void 0;
+}
+var jwksSets = /* @__PURE__ */ new Map();
+function jwksFor(url) {
+  let set = jwksSets.get(url);
+  if (!set) {
+    set = createRemoteJWKSet(new URL(url));
+    jwksSets.set(url, set);
+  }
+  return set;
+}
+async function verifyBearerToken(token, options = {}) {
+  const strict = readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+  const trustGateway = options.trustGateway ?? readEnv("SOLVAPAY_AUTH_TRUST_GATEWAY") === "true";
+  if (strict && trustGateway) {
+    return {
+      ok: false,
+      reason: "SOLVAPAY_AUTH_STRICT=true forbids trusting a gateway, but gateway trust is on. Turn one of them off."
+    };
+  }
+  let alg;
+  try {
+    alg = decodeProtectedHeader(token).alg;
+  } catch {
+    return { ok: false, reason: "Malformed authentication token" };
+  }
+  if (alg === "HS256") {
+    const secret = options.jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+    if (secret) {
+      try {
+        const { payload: payload2 } = await jwtVerify(token, new TextEncoder().encode(secret), {
+          algorithms: ["HS256"]
+        });
+        return { ok: true, payload: payload2, verifiedBy: "secret" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
+    }
+  } else if (typeof alg === "string" && ASYMMETRIC_ALGORITHMS.includes(alg)) {
+    const jwksUrl = options.jwksUrl || readEnv("SOLVAPAY_JWKS_URL") || supabaseJwksUrl();
+    if (jwksUrl) {
+      try {
+        const { payload: payload2 } = await jwtVerify(token, jwksFor(jwksUrl), {
+          algorithms: ASYMMETRIC_ALGORITHMS
+        });
+        return { ok: true, payload: payload2, verifiedBy: "jwks" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
+    }
+  } else {
+    return { ok: false, reason: `Unsupported authentication token algorithm: ${String(alg)}` };
+  }
+  if (!trustGateway) {
+    return { ok: false, reason: TOKEN_NOT_VERIFIABLE };
+  }
+  let payload;
+  try {
+    payload = decodeJwt(token);
+  } catch {
+    return { ok: false, reason: "Malformed authentication token" };
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1e3 <= Date.now()) {
+    return { ok: false, reason: "Invalid or expired authentication token" };
+  }
+  return { ok: true, payload, verifiedBy: "gateway" };
+}
+
+// src/next-utils.ts
+function extractBearerToken(request) {
+  const authHeader = request.headers.get("authorization");
+  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
+  const token = authHeader.slice(7).trim();
+  return token.length > 0 ? token : null;
+}
+async function resolveJwtPayload(token, jwtSecret) {
+  const verified = await verifyBearerToken(token, { jwtSecret });
+  return verified.ok ? verified.payload : null;
+}
+function getUserIdFromRequest(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  return request.headers.get(headerName);
+}
+async function getUserEmailFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  return typeof payload.email === "string" ? payload.email : null;
+}
+async function getUserNameFromRequest(request, options) {
+  const token = extractBearerToken(request);
+  if (!token) return null;
+  const payload = await resolveJwtPayload(token, options?.jwtSecret);
+  if (!payload) return null;
+  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
+  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
+  const claimName = typeof payload.name === "string" ? payload.name : null;
+  return metadataFullName || metadataName || claimName || null;
+}
+function requireUserId(request, options) {
+  const headerName = options?.headerName || "x-user-id";
+  const errorMessage = options?.errorMessage || "Unauthorized";
+  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
+  const userId = request.headers.get(headerName);
+  if (!userId) {
+    return new Response(JSON.stringify({ error: errorMessage, details: errorDetails }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" }
+    });
+  }
+  return userId;
+}
+
+export {
+  TOKEN_NOT_VERIFIABLE,
+  verifyBearerToken,
+  getUserIdFromRequest,
+  getUserEmailFromRequest,
+  getUserNameFromRequest,
+  requireUserId
+};

package/dist/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -35,10 +25,12 @@ __export(index_exports, {
   SOLVAPAY_USER_ID_HEADER: () => SOLVAPAY_USER_ID_HEADER,
   SolvapayAuthAdapter: () => SolvapayAuthAdapter,
   SolvapayOAuthClient: () => SolvapayOAuthClient,
+  TOKEN_NOT_VERIFIABLE: () => TOKEN_NOT_VERIFIABLE,
   getUserEmailFromRequest: () => getUserEmailFromRequest,
   getUserIdFromRequest: () => getUserIdFromRequest,
   getUserNameFromRequest: () => getUserNameFromRequest,
-  requireUserId: () => requireUserId
+  requireUserId: () => requireUserId,
+  verifyBearerToken: () => verifyBearerToken
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -180,68 +172,96 @@ var SolvapayOAuthClient = class {
   }
 };
 
-// src/next-utils.ts
-function base64UrlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
-  const base64 = padded + padding;
-  if (typeof atob === "function") {
-    const binary = atob(base64);
-    let result = "";
-    for (let i = 0; i < binary.length; i++) {
-      result += String.fromCharCode(binary.charCodeAt(i));
+// src/verify-token.ts
+var import_jose = require("jose");
+var ASYMMETRIC_ALGORITHMS = ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "EdDSA"];
+var TOKEN_NOT_VERIFIABLE = "No way to verify the authentication token. Set SOLVAPAY_JWT_SECRET (HS256 tokens), SOLVAPAY_JWKS_URL (ES256/RS256 tokens; derived from SUPABASE_URL on Supabase), or SOLVAPAY_AUTH_TRUST_GATEWAY=true if a gateway verifies every token before this handler.";
+function readEnv(name) {
+  const proc = globalThis.process;
+  const deno = globalThis.Deno;
+  const value = proc?.env?.[name] ?? deno?.env?.get(name);
+  return value && value.length > 0 ? value : void 0;
+}
+function supabaseJwksUrl() {
+  const base = readEnv("SUPABASE_URL");
+  return base ? `${base.replace(/\/+$/, "")}/auth/v1/.well-known/jwks.json` : void 0;
+}
+var jwksSets = /* @__PURE__ */ new Map();
+function jwksFor(url) {
+  let set = jwksSets.get(url);
+  if (!set) {
+    set = (0, import_jose.createRemoteJWKSet)(new URL(url));
+    jwksSets.set(url, set);
+  }
+  return set;
+}
+async function verifyBearerToken(token, options = {}) {
+  const strict = readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+  const trustGateway = options.trustGateway ?? readEnv("SOLVAPAY_AUTH_TRUST_GATEWAY") === "true";
+  if (strict && trustGateway) {
+    return {
+      ok: false,
+      reason: "SOLVAPAY_AUTH_STRICT=true forbids trusting a gateway, but gateway trust is on. Turn one of them off."
+    };
+  }
+  let alg;
+  try {
+    alg = (0, import_jose.decodeProtectedHeader)(token).alg;
+  } catch {
+    return { ok: false, reason: "Malformed authentication token" };
+  }
+  if (alg === "HS256") {
+    const secret = options.jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+    if (secret) {
+      try {
+        const { payload: payload2 } = await (0, import_jose.jwtVerify)(token, new TextEncoder().encode(secret), {
+          algorithms: ["HS256"]
+        });
+        return { ok: true, payload: payload2, verifiedBy: "secret" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
     }
-    try {
-      return decodeURIComponent(escape(result));
-    } catch {
-      return result;
+  } else if (typeof alg === "string" && ASYMMETRIC_ALGORITHMS.includes(alg)) {
+    const jwksUrl = options.jwksUrl || readEnv("SOLVAPAY_JWKS_URL") || supabaseJwksUrl();
+    if (jwksUrl) {
+      try {
+        const { payload: payload2 } = await (0, import_jose.jwtVerify)(token, jwksFor(jwksUrl), {
+          algorithms: ASYMMETRIC_ALGORITHMS
+        });
+        return { ok: true, payload: payload2, verifiedBy: "jwks" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
     }
+  } else {
+    return { ok: false, reason: `Unsupported authentication token algorithm: ${String(alg)}` };
   }
-  const BufferCtor = globalThis.Buffer;
-  if (BufferCtor) {
-    return BufferCtor.from(base64, "base64").toString("utf-8");
+  if (!trustGateway) {
+    return { ok: false, reason: TOKEN_NOT_VERIFIABLE };
   }
-  throw new Error("No base64 decoder available in this runtime");
-}
-function decodeJwtUnverified(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
+  let payload;
   try {
-    const json = base64UrlDecode(parts[1]);
-    const payload = JSON.parse(json);
-    if (typeof payload !== "object" || payload === null) return null;
-    return payload;
+    payload = (0, import_jose.decodeJwt)(token);
   } catch {
-    return null;
+    return { ok: false, reason: "Malformed authentication token" };
   }
+  if (typeof payload.exp === "number" && payload.exp * 1e3 <= Date.now()) {
+    return { ok: false, reason: "Invalid or expired authentication token" };
+  }
+  return { ok: true, payload, verifiedBy: "gateway" };
 }
+
+// src/next-utils.ts
 function extractBearerToken(request) {
   const authHeader = request.headers.get("authorization");
   if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
   const token = authHeader.slice(7).trim();
   return token.length > 0 ? token : null;
 }
-function readEnv(name) {
-  const proc = globalThis.process;
-  return proc?.env?.[name];
-}
-function isStrictMode() {
-  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
-}
 async function resolveJwtPayload(token, jwtSecret) {
-  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
-  if (secret) {
-    try {
-      const { jwtVerify } = await import("jose");
-      const key = new TextEncoder().encode(secret);
-      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
-      return payload;
-    } catch {
-      return null;
-    }
-  }
-  if (isStrictMode()) return null;
-  return decodeJwtUnverified(token);
+  const verified = await verifyBearerToken(token, { jwtSecret });
+  return verified.ok ? verified.payload : null;
 }
 function getUserIdFromRequest(request, options) {
   const headerName = options?.headerName || "x-user-id";
@@ -284,8 +304,10 @@ function requireUserId(request, options) {
   SOLVAPAY_USER_ID_HEADER,
   SolvapayAuthAdapter,
   SolvapayOAuthClient,
+  TOKEN_NOT_VERIFIABLE,
   getUserEmailFromRequest,
   getUserIdFromRequest,
   getUserNameFromRequest,
-  requireUserId
+  requireUserId,
+  verifyBearerToken
 });

package/dist/index.d.cts

@@ -1,6 +1,7 @@
 import { A as AuthAdapter, R as RequestLike } from './adapter-B2LYWIJl.cjs';
 export { a as AuthRequestHandleResult, S as ServerIdentity } from './adapter-B2LYWIJl.cjs';
 export { MockAuthAdapter, MockAuthAdapter as MockAuthAdapterType } from './mock.cjs';
+import { JWTPayload } from 'jose';
 export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId } from './next-utils.cjs';
 
 /**
@@ -78,4 +79,45 @@ declare class SolvapayOAuthClient {
     getUserInfo(accessToken: string, userInfoUrl?: string): Promise<Record<string, unknown>>;
 }
 
-export { AuthAdapter, RequestLike, SOLVAPAY_AUTHORIZATION_HEADER, SOLVAPAY_USER_ID_HEADER, SolvapayAuthAdapter, type SolvapayAuthAdapterConfig, SolvapayOAuthClient, type SolvapayOAuthConfig, type TokenResponse };
+/**
+ * Verifies a bearer token before a route trusts who it names.
+ *
+ * Every SolvaPay route helper that reads the user from `Authorization: Bearer`
+ * goes through `verifyBearerToken`. A token is trusted only when one of these
+ * says so, chosen by the token's `alg`:
+ *
+ * - **HS256** with a shared secret: `jwtSecret`, else `SOLVAPAY_JWT_SECRET`,
+ *   else `SUPABASE_JWT_SECRET`.
+ * - **ES256 / RS256 and other asymmetric algorithms** against a JWKS:
+ *   `jwksUrl`, else `SOLVAPAY_JWKS_URL`, else, on Supabase,
+ *   `${SUPABASE_URL}/auth/v1/.well-known/jwks.json`.
+ * - **A gateway that already verified it**, only when you say so:
+ *   `trustGateway`, or `SOLVAPAY_AUTH_TRUST_GATEWAY=true` (for example
+ *   Supabase Edge Functions with `verify_jwt = true`). The token is then read
+ *   without checking its signature, so turn this on only when nothing can
+ *   reach the handler without passing that gateway.
+ *
+ * With none of these, the token is refused: there is no unverified default.
+ * `SOLVAPAY_AUTH_STRICT=true` forbids gateway trust outright.
+ */
+
+type TokenVerification = {
+    ok: true;
+    payload: JWTPayload;
+    verifiedBy: 'secret' | 'jwks' | 'gateway';
+} | {
+    ok: false;
+    reason: string;
+};
+interface VerifyBearerTokenOptions {
+    /** HS256 secret; defaults to SOLVAPAY_JWT_SECRET, then SUPABASE_JWT_SECRET. */
+    jwtSecret?: string;
+    /** JWKS URL for ES256/RS256 tokens; defaults to SOLVAPAY_JWKS_URL, then Supabase's from SUPABASE_URL. */
+    jwksUrl?: string;
+    /** Trust a gateway that verified the token already; defaults to SOLVAPAY_AUTH_TRUST_GATEWAY=true. */
+    trustGateway?: boolean;
+}
+declare const TOKEN_NOT_VERIFIABLE: string;
+declare function verifyBearerToken(token: string, options?: VerifyBearerTokenOptions): Promise<TokenVerification>;
+
+export { AuthAdapter, RequestLike, SOLVAPAY_AUTHORIZATION_HEADER, SOLVAPAY_USER_ID_HEADER, SolvapayAuthAdapter, type SolvapayAuthAdapterConfig, SolvapayOAuthClient, type SolvapayOAuthConfig, TOKEN_NOT_VERIFIABLE, type TokenResponse, type TokenVerification, type VerifyBearerTokenOptions, verifyBearerToken };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import { A as AuthAdapter, R as RequestLike } from './adapter-B2LYWIJl.js';
 export { a as AuthRequestHandleResult, S as ServerIdentity } from './adapter-B2LYWIJl.js';
 export { MockAuthAdapter, MockAuthAdapter as MockAuthAdapterType } from './mock.js';
+import { JWTPayload } from 'jose';
 export { getUserEmailFromRequest, getUserIdFromRequest, getUserNameFromRequest, requireUserId } from './next-utils.js';
 
 /**
@@ -78,4 +79,45 @@ declare class SolvapayOAuthClient {
     getUserInfo(accessToken: string, userInfoUrl?: string): Promise<Record<string, unknown>>;
 }
 
-export { AuthAdapter, RequestLike, SOLVAPAY_AUTHORIZATION_HEADER, SOLVAPAY_USER_ID_HEADER, SolvapayAuthAdapter, type SolvapayAuthAdapterConfig, SolvapayOAuthClient, type SolvapayOAuthConfig, type TokenResponse };
+/**
+ * Verifies a bearer token before a route trusts who it names.
+ *
+ * Every SolvaPay route helper that reads the user from `Authorization: Bearer`
+ * goes through `verifyBearerToken`. A token is trusted only when one of these
+ * says so, chosen by the token's `alg`:
+ *
+ * - **HS256** with a shared secret: `jwtSecret`, else `SOLVAPAY_JWT_SECRET`,
+ *   else `SUPABASE_JWT_SECRET`.
+ * - **ES256 / RS256 and other asymmetric algorithms** against a JWKS:
+ *   `jwksUrl`, else `SOLVAPAY_JWKS_URL`, else, on Supabase,
+ *   `${SUPABASE_URL}/auth/v1/.well-known/jwks.json`.
+ * - **A gateway that already verified it**, only when you say so:
+ *   `trustGateway`, or `SOLVAPAY_AUTH_TRUST_GATEWAY=true` (for example
+ *   Supabase Edge Functions with `verify_jwt = true`). The token is then read
+ *   without checking its signature, so turn this on only when nothing can
+ *   reach the handler without passing that gateway.
+ *
+ * With none of these, the token is refused: there is no unverified default.
+ * `SOLVAPAY_AUTH_STRICT=true` forbids gateway trust outright.
+ */
+
+type TokenVerification = {
+    ok: true;
+    payload: JWTPayload;
+    verifiedBy: 'secret' | 'jwks' | 'gateway';
+} | {
+    ok: false;
+    reason: string;
+};
+interface VerifyBearerTokenOptions {
+    /** HS256 secret; defaults to SOLVAPAY_JWT_SECRET, then SUPABASE_JWT_SECRET. */
+    jwtSecret?: string;
+    /** JWKS URL for ES256/RS256 tokens; defaults to SOLVAPAY_JWKS_URL, then Supabase's from SUPABASE_URL. */
+    jwksUrl?: string;
+    /** Trust a gateway that verified the token already; defaults to SOLVAPAY_AUTH_TRUST_GATEWAY=true. */
+    trustGateway?: boolean;
+}
+declare const TOKEN_NOT_VERIFIABLE: string;
+declare function verifyBearerToken(token: string, options?: VerifyBearerTokenOptions): Promise<TokenVerification>;
+
+export { AuthAdapter, RequestLike, SOLVAPAY_AUTHORIZATION_HEADER, SOLVAPAY_USER_ID_HEADER, SolvapayAuthAdapter, type SolvapayAuthAdapterConfig, SolvapayOAuthClient, type SolvapayOAuthConfig, TOKEN_NOT_VERIFIABLE, type TokenResponse, type TokenVerification, type VerifyBearerTokenOptions, verifyBearerToken };

package/dist/index.js

@@ -2,11 +2,13 @@ import {
   MockAuthAdapter
 } from "./chunk-OETEFHW6.js";
 import {
+  TOKEN_NOT_VERIFIABLE,
   getUserEmailFromRequest,
   getUserIdFromRequest,
   getUserNameFromRequest,
-  requireUserId
-} from "./chunk-ESD73BSC.js";
+  requireUserId,
+  verifyBearerToken
+} from "./chunk-WVD7RQ6U.js";
 
 // src/constants.ts
 var SOLVAPAY_USER_ID_HEADER = "x-user-id";
@@ -136,8 +138,10 @@ export {
   SOLVAPAY_USER_ID_HEADER,
   SolvapayAuthAdapter,
   SolvapayOAuthClient,
+  TOKEN_NOT_VERIFIABLE,
   getUserEmailFromRequest,
   getUserIdFromRequest,
   getUserNameFromRequest,
-  requireUserId
+  requireUserId,
+  verifyBearerToken
 };

package/dist/next-utils.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/next-utils.ts
@@ -36,67 +26,97 @@ __export(next_utils_exports, {
   requireUserId: () => requireUserId
 });
 module.exports = __toCommonJS(next_utils_exports);
-function base64UrlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
-  const base64 = padded + padding;
-  if (typeof atob === "function") {
-    const binary = atob(base64);
-    let result = "";
-    for (let i = 0; i < binary.length; i++) {
-      result += String.fromCharCode(binary.charCodeAt(i));
+
+// src/verify-token.ts
+var import_jose = require("jose");
+var ASYMMETRIC_ALGORITHMS = ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "PS256", "PS384", "PS512", "EdDSA"];
+var TOKEN_NOT_VERIFIABLE = "No way to verify the authentication token. Set SOLVAPAY_JWT_SECRET (HS256 tokens), SOLVAPAY_JWKS_URL (ES256/RS256 tokens; derived from SUPABASE_URL on Supabase), or SOLVAPAY_AUTH_TRUST_GATEWAY=true if a gateway verifies every token before this handler.";
+function readEnv(name) {
+  const proc = globalThis.process;
+  const deno = globalThis.Deno;
+  const value = proc?.env?.[name] ?? deno?.env?.get(name);
+  return value && value.length > 0 ? value : void 0;
+}
+function supabaseJwksUrl() {
+  const base = readEnv("SUPABASE_URL");
+  return base ? `${base.replace(/\/+$/, "")}/auth/v1/.well-known/jwks.json` : void 0;
+}
+var jwksSets = /* @__PURE__ */ new Map();
+function jwksFor(url) {
+  let set = jwksSets.get(url);
+  if (!set) {
+    set = (0, import_jose.createRemoteJWKSet)(new URL(url));
+    jwksSets.set(url, set);
+  }
+  return set;
+}
+async function verifyBearerToken(token, options = {}) {
+  const strict = readEnv("SOLVAPAY_AUTH_STRICT") === "true";
+  const trustGateway = options.trustGateway ?? readEnv("SOLVAPAY_AUTH_TRUST_GATEWAY") === "true";
+  if (strict && trustGateway) {
+    return {
+      ok: false,
+      reason: "SOLVAPAY_AUTH_STRICT=true forbids trusting a gateway, but gateway trust is on. Turn one of them off."
+    };
+  }
+  let alg;
+  try {
+    alg = (0, import_jose.decodeProtectedHeader)(token).alg;
+  } catch {
+    return { ok: false, reason: "Malformed authentication token" };
+  }
+  if (alg === "HS256") {
+    const secret = options.jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
+    if (secret) {
+      try {
+        const { payload: payload2 } = await (0, import_jose.jwtVerify)(token, new TextEncoder().encode(secret), {
+          algorithms: ["HS256"]
+        });
+        return { ok: true, payload: payload2, verifiedBy: "secret" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
     }
-    try {
-      return decodeURIComponent(escape(result));
-    } catch {
-      return result;
+  } else if (typeof alg === "string" && ASYMMETRIC_ALGORITHMS.includes(alg)) {
+    const jwksUrl = options.jwksUrl || readEnv("SOLVAPAY_JWKS_URL") || supabaseJwksUrl();
+    if (jwksUrl) {
+      try {
+        const { payload: payload2 } = await (0, import_jose.jwtVerify)(token, jwksFor(jwksUrl), {
+          algorithms: ASYMMETRIC_ALGORITHMS
+        });
+        return { ok: true, payload: payload2, verifiedBy: "jwks" };
+      } catch {
+        return { ok: false, reason: "Invalid or expired authentication token" };
+      }
     }
+  } else {
+    return { ok: false, reason: `Unsupported authentication token algorithm: ${String(alg)}` };
   }
-  const BufferCtor = globalThis.Buffer;
-  if (BufferCtor) {
-    return BufferCtor.from(base64, "base64").toString("utf-8");
+  if (!trustGateway) {
+    return { ok: false, reason: TOKEN_NOT_VERIFIABLE };
   }
-  throw new Error("No base64 decoder available in this runtime");
-}
-function decodeJwtUnverified(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
+  let payload;
   try {
-    const json = base64UrlDecode(parts[1]);
-    const payload = JSON.parse(json);
-    if (typeof payload !== "object" || payload === null) return null;
-    return payload;
+    payload = (0, import_jose.decodeJwt)(token);
   } catch {
-    return null;
+    return { ok: false, reason: "Malformed authentication token" };
+  }
+  if (typeof payload.exp === "number" && payload.exp * 1e3 <= Date.now()) {
+    return { ok: false, reason: "Invalid or expired authentication token" };
   }
+  return { ok: true, payload, verifiedBy: "gateway" };
 }
+
+// src/next-utils.ts
 function extractBearerToken(request) {
   const authHeader = request.headers.get("authorization");
   if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
   const token = authHeader.slice(7).trim();
   return token.length > 0 ? token : null;
 }
-function readEnv(name) {
-  const proc = globalThis.process;
-  return proc?.env?.[name];
-}
-function isStrictMode() {
-  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
-}
 async function resolveJwtPayload(token, jwtSecret) {
-  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
-  if (secret) {
-    try {
-      const { jwtVerify } = await import("jose");
-      const key = new TextEncoder().encode(secret);
-      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
-      return payload;
-    } catch {
-      return null;
-    }
-  }
-  if (isStrictMode()) return null;
-  return decodeJwtUnverified(token);
+  const verified = await verifyBearerToken(token, { jwtSecret });
+  return verified.ok ? verified.payload : null;
 }
 function getUserIdFromRequest(request, options) {
   const headerName = options?.headerName || "x-user-id";

package/dist/next-utils.d.cts

@@ -46,13 +46,12 @@ declare function getUserIdFromRequest(request: Request, options?: {
 /**
  * Extract user email from a Bearer JWT in the Authorization header.
  *
- * When `SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET` is set (or the
- * equivalent `options.jwtSecret`), the token is verified via HS256.
- * Otherwise, the payload is decoded without verification — safe when the
- * platform gateway has already validated the token (e.g. Supabase Edge
- * Functions with `verify_jwt = true`, which is the default). Opt into
- * strict mode with `SOLVAPAY_AUTH_STRICT=true` to disable the
- * unverified-decode fallback.
+ * The token is verified first, as `verifyBearerToken` does: HS256 with
+ * `options.jwtSecret` / `SOLVAPAY_JWT_SECRET` / `SUPABASE_JWT_SECRET`,
+ * ES256/RS256 against `SOLVAPAY_JWKS_URL` (or Supabase's JWKS from
+ * `SUPABASE_URL`), or a gateway you trust with
+ * `SOLVAPAY_AUTH_TRUST_GATEWAY=true`. A token none of these verifies gives
+ * `null`.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options

package/dist/next-utils.d.ts

@@ -46,13 +46,12 @@ declare function getUserIdFromRequest(request: Request, options?: {
 /**
  * Extract user email from a Bearer JWT in the Authorization header.
  *
- * When `SOLVAPAY_JWT_SECRET` or `SUPABASE_JWT_SECRET` is set (or the
- * equivalent `options.jwtSecret`), the token is verified via HS256.
- * Otherwise, the payload is decoded without verification — safe when the
- * platform gateway has already validated the token (e.g. Supabase Edge
- * Functions with `verify_jwt = true`, which is the default). Opt into
- * strict mode with `SOLVAPAY_AUTH_STRICT=true` to disable the
- * unverified-decode fallback.
+ * The token is verified first, as `verifyBearerToken` does: HS256 with
+ * `options.jwtSecret` / `SOLVAPAY_JWT_SECRET` / `SUPABASE_JWT_SECRET`,
+ * ES256/RS256 against `SOLVAPAY_JWKS_URL` (or Supabase's JWKS from
+ * `SUPABASE_URL`), or a gateway you trust with
+ * `SOLVAPAY_AUTH_TRUST_GATEWAY=true`. A token none of these verifies gives
+ * `null`.
  *
  * @param request - Request object (works with NextRequest from next/server)
  * @param options - Configuration options

package/dist/next-utils.js

@@ -3,7 +3,7 @@ import {
   getUserIdFromRequest,
   getUserNameFromRequest,
   requireUserId
-} from "./chunk-ESD73BSC.js";
+} from "./chunk-WVD7RQ6U.js";
 export {
   getUserEmailFromRequest,
   getUserIdFromRequest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/auth",
-  "version": "1.2.0",
+  "version": "1.3.0-preview-3fd9d2205ea1113de9bbfb34ba7217629ccf40f0",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",

package/dist/chunk-ESD73BSC.js

@@ -1,104 +0,0 @@
-// src/next-utils.ts
-function base64UrlDecode(input) {
-  const padded = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padding = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
-  const base64 = padded + padding;
-  if (typeof atob === "function") {
-    const binary = atob(base64);
-    let result = "";
-    for (let i = 0; i < binary.length; i++) {
-      result += String.fromCharCode(binary.charCodeAt(i));
-    }
-    try {
-      return decodeURIComponent(escape(result));
-    } catch {
-      return result;
-    }
-  }
-  const BufferCtor = globalThis.Buffer;
-  if (BufferCtor) {
-    return BufferCtor.from(base64, "base64").toString("utf-8");
-  }
-  throw new Error("No base64 decoder available in this runtime");
-}
-function decodeJwtUnverified(token) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  try {
-    const json = base64UrlDecode(parts[1]);
-    const payload = JSON.parse(json);
-    if (typeof payload !== "object" || payload === null) return null;
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function extractBearerToken(request) {
-  const authHeader = request.headers.get("authorization");
-  if (!authHeader || !authHeader.toLowerCase().startsWith("bearer ")) return null;
-  const token = authHeader.slice(7).trim();
-  return token.length > 0 ? token : null;
-}
-function readEnv(name) {
-  const proc = globalThis.process;
-  return proc?.env?.[name];
-}
-function isStrictMode() {
-  return readEnv("SOLVAPAY_AUTH_STRICT") === "true";
-}
-async function resolveJwtPayload(token, jwtSecret) {
-  const secret = jwtSecret || readEnv("SOLVAPAY_JWT_SECRET") || readEnv("SUPABASE_JWT_SECRET");
-  if (secret) {
-    try {
-      const { jwtVerify } = await import("jose");
-      const key = new TextEncoder().encode(secret);
-      const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
-      return payload;
-    } catch {
-      return null;
-    }
-  }
-  if (isStrictMode()) return null;
-  return decodeJwtUnverified(token);
-}
-function getUserIdFromRequest(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  return request.headers.get(headerName);
-}
-async function getUserEmailFromRequest(request, options) {
-  const token = extractBearerToken(request);
-  if (!token) return null;
-  const payload = await resolveJwtPayload(token, options?.jwtSecret);
-  if (!payload) return null;
-  return typeof payload.email === "string" ? payload.email : null;
-}
-async function getUserNameFromRequest(request, options) {
-  const token = extractBearerToken(request);
-  if (!token) return null;
-  const payload = await resolveJwtPayload(token, options?.jwtSecret);
-  if (!payload) return null;
-  const metadataFullName = typeof payload.user_metadata?.full_name === "string" ? payload.user_metadata.full_name : null;
-  const metadataName = typeof payload.user_metadata?.name === "string" ? payload.user_metadata.name : null;
-  const claimName = typeof payload.name === "string" ? payload.name : null;
-  return metadataFullName || metadataName || claimName || null;
-}
-function requireUserId(request, options) {
-  const headerName = options?.headerName || "x-user-id";
-  const errorMessage = options?.errorMessage || "Unauthorized";
-  const errorDetails = options?.errorDetails || "User ID not found. Ensure middleware is configured.";
-  const userId = request.headers.get(headerName);
-  if (!userId) {
-    return new Response(JSON.stringify({ error: errorMessage, details: errorDetails }), {
-      status: 401,
-      headers: { "Content-Type": "application/json" }
-    });
-  }
-  return userId;
-}
-
-export {
-  getUserIdFromRequest,
-  getUserEmailFromRequest,
-  getUserNameFromRequest,
-  requireUserId
-};