@uln/auth 0.1.0 → 0.2.0

package/dist/client.d.ts

@@ -1,4 +1,6 @@
-export type { TokenPayload, TokenConfig, CookieConfig } from "./types.ts";
-export { createToken, validateToken } from "./token.ts";
+export type { TokenPayload, VerifyConfig, PublicKeyEntry, CookieConfig } from "./types.ts";
+export { validateToken, importPublicKey } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
 export { getAuthUser, redirectToLogin, getClientIP, checkBearerToken } from "./middleware.ts";
+import type { PublicKeyEntry } from "./types.ts";
+export declare function fetchPublicKeys(baseUrl: string): Promise<PublicKeyEntry[]>;

package/dist/client.js

@@ -41,21 +41,24 @@ function base64urlDecode(str) {
   }
   return bytes;
 }
-async function hmacSign(secret, data) {
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign"
-  ]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-  return base64urlEncode(new Uint8Array(signature));
+var ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" };
+async function generateKeyPair() {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair))
+    throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
 }
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0;i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
+async function importPrivateKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
+}
+async function importPublicKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
 async function createToken(config, user) {
   const now = Math.floor(Date.now() / 1000);
@@ -65,34 +68,49 @@ async function createToken(config, user) {
     name: user.name,
     admin: user.isAdmin,
     scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
     iat: now,
     exp: now + config.maxAgeSeconds
   };
   const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
-  const sig = await hmacSign(config.secret, payloadB64);
-  return `${payloadB64}.${sig}`;
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
 }
 async function validateToken(config, token) {
   const dotIndex = token.indexOf(".");
   if (dotIndex === -1)
     return null;
   const payloadB64 = token.substring(0, dotIndex);
-  const sig = token.substring(dotIndex + 1);
-  const expectedSig = await hmacSign(config.secret, payloadB64);
-  if (!timingSafeEqual(sig, expectedSig))
-    return null;
+  const sigB64 = token.substring(dotIndex + 1);
+  let payload;
   try {
     const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-    const payload = JSON.parse(decoded);
-    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
-      return null;
-    const now = Math.floor(Date.now() / 1000);
-    if (now > payload.exp)
+    payload = JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp)
+    return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry)
+    return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid)
       return null;
-    return payload;
   } catch {
     return null;
   }
+  return payload;
 }
 
 // src/middleware.ts
@@ -103,27 +121,39 @@ function checkBearerToken(request, expectedToken) {
   const header = request.headers.get("Authorization");
   return header === `Bearer ${expectedToken}`;
 }
-async function getAuthUser(request, tokenConfig, cookieConfig) {
+async function getAuthUser(request, verifyConfig, cookieConfig) {
   const cookieHeader = request.headers.get("Cookie");
   if (!cookieHeader)
     return null;
   const token = extractCookie(cookieHeader, cookieConfig.name);
   if (!token)
     return null;
-  return validateToken(tokenConfig, token);
+  return validateToken(verifyConfig, token);
 }
 function redirectToLogin(currentUrl) {
   const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
   return Response.redirect(loginUrl, 302);
 }
+// src/client.ts
+async function fetchPublicKeys(baseUrl) {
+  const res = await fetch(`${baseUrl}/.well-known/jwk.json`);
+  if (!res.ok)
+    throw new Error(`Failed to fetch JWKS from ${baseUrl}: ${res.status}`);
+  const jwks = await res.json();
+  return Promise.all(jwks.keys.map(async (jwk) => ({
+    kid: jwk.kid,
+    key: await importPublicKey(jwk)
+  })));
+}
 export {
   validateToken,
   redirectToLogin,
   makeSessionCookie,
   makeClearCookie,
+  importPublicKey,
   getClientIP,
   getAuthUser,
+  fetchPublicKeys,
   extractCookie,
-  createToken,
   checkBearerToken
 };

package/dist/hono.d.ts

@@ -0,0 +1,50 @@
+import type { Context, MiddlewareHandler } from "hono";
+import type { TokenPayload } from "./types.ts";
+interface AuthOptions {
+    /**
+     * Service binding name (e.g. "AUTH"). If provided, validates tokens
+     * via the auth worker service binding instead of fetching public keys.
+     */
+    binding?: string;
+    /**
+     * Paths that don't require authentication. Supports exact matches
+     * and trailing wildcard (e.g. "/api/public/*").
+     */
+    public?: string[];
+    /**
+     * Auth service base URL. Defaults to "https://auth.uln.industries".
+     */
+    authUrl?: string;
+    /** Cookie name. Defaults to "uln_auth". */
+    cookie?: string;
+    /** Cookie/token max age in seconds. Defaults to 86400 (24h). */
+    maxAge?: number;
+}
+/**
+ * Hono middleware that handles the full auth flow:
+ *
+ * 1. If `?token=` in URL → validate, set cookie, redirect to clean URL
+ * 2. If session cookie present → validate, set `c.get("user")`
+ * 3. If unauthenticated → redirect to auth.uln.industries/login
+ *
+ * Usage:
+ * ```ts
+ * import { auth } from "@uln/auth/hono";
+ *
+ * // Public key validation (default — no config needed):
+ * app.use("/*", auth());
+ *
+ * // Service binding (if on same CF account):
+ * app.use("/*", auth({ binding: "AUTH" }));
+ *
+ * // With public paths:
+ * app.use("/*", auth({ public: ["/health", "/api/public/*"] }));
+ *
+ * // Access user in handlers:
+ * app.get("/me", (c) => c.json(c.get("user")));
+ * ```
+ */
+export declare function auth(options?: AuthOptions): MiddlewareHandler;
+/** Type-safe helper to get the authenticated user from context. */
+export declare function getUser(c: Context): TokenPayload;
+export type { TokenPayload } from "./types.ts";

package/dist/hono.js

@@ -0,0 +1,242 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+
+// src/token.ts
+var encoder = new TextEncoder;
+function base64urlEncode(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+var ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" };
+async function generateKeyPair() {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair))
+    throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
+}
+async function importPrivateKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
+}
+async function importPublicKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
+}
+async function createToken(config, user) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
+    iat: now,
+    exp: now + config.maxAgeSeconds
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
+}
+async function validateToken(config, token) {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1)
+    return null;
+  const payloadB64 = token.substring(0, dotIndex);
+  const sigB64 = token.substring(dotIndex + 1);
+  let payload;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    payload = JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp)
+    return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry)
+    return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid)
+      return null;
+  } catch {
+    return null;
+  }
+  return payload;
+}
+
+// src/hono.ts
+var DEFAULT_AUTH_URL = "https://auth.uln.industries";
+var DEFAULT_COOKIE = "uln_auth";
+var DEFAULT_MAX_AGE = 86400;
+function isPublicPath(pathname, patterns) {
+  for (const pattern of patterns) {
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -1);
+      if (pathname === prefix.slice(0, -1) || pathname.startsWith(prefix))
+        return true;
+    } else if (pathname === pattern) {
+      return true;
+    }
+  }
+  return false;
+}
+var cachedKeys = null;
+var cachedAt = 0;
+var CACHE_TTL = 3600000;
+async function getPublicKeys(authUrl) {
+  if (cachedKeys && Date.now() - cachedAt < CACHE_TTL) {
+    return cachedKeys;
+  }
+  const res = await fetch(`${authUrl}/.well-known/jwk.json`);
+  if (!res.ok)
+    throw new Error(`Failed to fetch JWKS from ${authUrl}: ${res.status}`);
+  const jwks = await res.json();
+  cachedKeys = await Promise.all(jwks.keys.map(async (jwk) => ({
+    kid: jwk.kid,
+    key: await importPublicKey(jwk)
+  })));
+  cachedAt = Date.now();
+  return cachedKeys;
+}
+async function validateWithPublicKeys(token, authUrl, maxAge) {
+  const publicKeys = await getPublicKeys(authUrl);
+  return validateToken({ publicKeys, maxAgeSeconds: maxAge }, token);
+}
+async function validateWithBinding(token, binding) {
+  const res = await binding.fetch("https://auth/api/verify-token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token })
+  });
+  if (!res.ok)
+    return null;
+  const data = await res.json();
+  return {
+    sub: data.user.id,
+    email: data.user.email,
+    name: data.user.name,
+    admin: data.user.admin,
+    scopes: data.user.scopes,
+    flags: data.user.flags,
+    kid: data.user.kid,
+    iat: 0,
+    exp: 0
+  };
+}
+function auth(options) {
+  const authUrl = options?.authUrl ?? DEFAULT_AUTH_URL;
+  const cookieName = options?.cookie ?? DEFAULT_COOKIE;
+  const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
+  const publicPaths = options?.public ?? [];
+  const bindingName = options?.binding;
+  const cookieConf = { name: cookieName, maxAgeSeconds: maxAge, secure: true };
+  async function validate(token, env) {
+    if (bindingName) {
+      const binding = env[bindingName];
+      if (!binding)
+        throw new Error(`Service binding "${bindingName}" not found in env`);
+      return validateWithBinding(token, binding);
+    }
+    return validateWithPublicKeys(token, authUrl, maxAge);
+  }
+  return async (c, next) => {
+    const url = new URL(c.req.url);
+    if (isPublicPath(url.pathname, publicPaths)) {
+      return next();
+    }
+    const incomingToken = url.searchParams.get("token");
+    if (incomingToken) {
+      const payload = await validate(incomingToken, c.env);
+      if (!payload) {
+        return c.text("Invalid token", 401);
+      }
+      url.searchParams.delete("token");
+      return new Response(null, {
+        status: 302,
+        headers: {
+          Location: url.toString(),
+          "Set-Cookie": makeSessionCookie(cookieConf, incomingToken)
+        }
+      });
+    }
+    const cookieHeader = c.req.header("Cookie");
+    if (cookieHeader) {
+      const token = extractCookie(cookieHeader, cookieName);
+      if (token) {
+        const payload = await validate(token, c.env);
+        if (payload) {
+          c.set("user", payload);
+          return next();
+        }
+      }
+    }
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      const token = authHeader.substring(7);
+      const payload = await validate(token, c.env);
+      if (payload) {
+        c.set("user", payload);
+        return next();
+      }
+      return c.json({ error: "Invalid token" }, 401);
+    }
+    const loginUrl = `${authUrl}/login?redirect=${encodeURIComponent(c.req.url)}`;
+    return c.redirect(loginUrl, 302);
+  };
+}
+function getUser(c) {
+  return c.get("user");
+}
+export {
+  getUser,
+  auth
+};

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export type { User, UserStore, RateLimitEntry, RateLimitStore, RateLimitConfig, TokenPayload, TokenConfig, CookieConfig, } from "./types.ts";
+export type { User, UserStore, RateLimitEntry, RateLimitStore, RateLimitConfig, TokenPayload, SigningConfig, VerifyConfig, PublicKeyEntry, CookieConfig, } from "./types.ts";
 export { hashPassword, verifyPassword } from "./password.ts";
-export { createToken, validateToken } from "./token.ts";
+export { createToken, validateToken, generateKeyPair, importPrivateKey, importPublicKey } from "./token.ts";
 export type { CreateTokenInput } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
 export { checkRateLimit, recordFailedAttempt, clearRateLimit } from "./rate-limit.ts";

package/dist/index.js

@@ -41,21 +41,24 @@ function base64urlDecode(str) {
   }
   return bytes;
 }
-async function hmacSign(secret, data) {
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign"
-  ]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-  return base64urlEncode(new Uint8Array(signature));
-}
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0;i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
+var ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" };
+async function generateKeyPair() {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair))
+    throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
+}
+async function importPrivateKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
+}
+async function importPublicKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
 async function createToken(config, user) {
   const now = Math.floor(Date.now() / 1000);
@@ -65,34 +68,49 @@ async function createToken(config, user) {
     name: user.name,
     admin: user.isAdmin,
     scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
     iat: now,
     exp: now + config.maxAgeSeconds
   };
   const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
-  const sig = await hmacSign(config.secret, payloadB64);
-  return `${payloadB64}.${sig}`;
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
 }
 async function validateToken(config, token) {
   const dotIndex = token.indexOf(".");
   if (dotIndex === -1)
     return null;
   const payloadB64 = token.substring(0, dotIndex);
-  const sig = token.substring(dotIndex + 1);
-  const expectedSig = await hmacSign(config.secret, payloadB64);
-  if (!timingSafeEqual(sig, expectedSig))
-    return null;
+  const sigB64 = token.substring(dotIndex + 1);
+  let payload;
   try {
     const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-    const payload = JSON.parse(decoded);
-    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
-      return null;
-    const now = Math.floor(Date.now() / 1000);
-    if (now > payload.exp)
+    payload = JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp)
+    return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry)
+    return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid)
       return null;
-    return payload;
   } catch {
     return null;
   }
+  return payload;
 }
 
 // src/middleware.ts
@@ -103,14 +121,14 @@ function checkBearerToken(request, expectedToken) {
   const header = request.headers.get("Authorization");
   return header === `Bearer ${expectedToken}`;
 }
-async function getAuthUser(request, tokenConfig, cookieConfig) {
+async function getAuthUser(request, verifyConfig, cookieConfig) {
   const cookieHeader = request.headers.get("Cookie");
   if (!cookieHeader)
     return null;
   const token = extractCookie(cookieHeader, cookieConfig.name);
   if (!token)
     return null;
-  return validateToken(tokenConfig, token);
+  return validateToken(verifyConfig, token);
 }
 function redirectToLogin(currentUrl) {
   const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
@@ -237,9 +255,12 @@ export {
   recordFailedAttempt,
   makeSessionCookie,
   makeClearCookie,
+  importPublicKey,
+  importPrivateKey,
   hashPassword,
   getClientIP,
   getAuthUser,
+  generateKeyPair,
   extractCookie,
   createUser,
   createToken,

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
-import type { CookieConfig, TokenConfig, TokenPayload } from "./types.ts";
+import type { CookieConfig, TokenPayload, VerifyConfig } from "./types.ts";
 export declare function getClientIP(request: Request): string;
 export declare function checkBearerToken(request: Request, expectedToken: string): boolean;
-export declare function getAuthUser(request: Request, tokenConfig: TokenConfig, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
+export declare function getAuthUser(request: Request, verifyConfig: VerifyConfig, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
 export declare function redirectToLogin(currentUrl: string): Response;