@uln/auth 0.1.0 → 0.2.0

package/dist/middleware.js

@@ -41,21 +41,24 @@ function base64urlDecode(str) {
   }
   return bytes;
 }
-async function hmacSign(secret, data) {
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign"
-  ]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-  return base64urlEncode(new Uint8Array(signature));
+var ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" };
+async function generateKeyPair() {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair))
+    throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
 }
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0;i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
+async function importPrivateKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
+}
+async function importPublicKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
 async function createToken(config, user) {
   const now = Math.floor(Date.now() / 1000);
@@ -65,34 +68,49 @@ async function createToken(config, user) {
     name: user.name,
     admin: user.isAdmin,
     scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
     iat: now,
     exp: now + config.maxAgeSeconds
   };
   const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
-  const sig = await hmacSign(config.secret, payloadB64);
-  return `${payloadB64}.${sig}`;
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
 }
 async function validateToken(config, token) {
   const dotIndex = token.indexOf(".");
   if (dotIndex === -1)
     return null;
   const payloadB64 = token.substring(0, dotIndex);
-  const sig = token.substring(dotIndex + 1);
-  const expectedSig = await hmacSign(config.secret, payloadB64);
-  if (!timingSafeEqual(sig, expectedSig))
-    return null;
+  const sigB64 = token.substring(dotIndex + 1);
+  let payload;
   try {
     const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-    const payload = JSON.parse(decoded);
-    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
-      return null;
-    const now = Math.floor(Date.now() / 1000);
-    if (now > payload.exp)
+    payload = JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp)
+    return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry)
+    return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid)
       return null;
-    return payload;
   } catch {
     return null;
   }
+  return payload;
 }
 
 // src/middleware.ts
@@ -103,14 +121,14 @@ function checkBearerToken(request, expectedToken) {
   const header = request.headers.get("Authorization");
   return header === `Bearer ${expectedToken}`;
 }
-async function getAuthUser(request, tokenConfig, cookieConfig) {
+async function getAuthUser(request, verifyConfig, cookieConfig) {
   const cookieHeader = request.headers.get("Cookie");
   if (!cookieHeader)
     return null;
   const token = extractCookie(cookieHeader, cookieConfig.name);
   if (!token)
     return null;
-  return validateToken(tokenConfig, token);
+  return validateToken(verifyConfig, token);
 }
 function redirectToLogin(currentUrl) {
   const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;

package/dist/service.js

@@ -39,6 +39,8 @@ async function verifyToken(authService, token) {
     name: data.user.name,
     admin: data.user.admin,
     scopes: data.user.scopes,
+    flags: data.user.flags,
+    kid: data.user.kid,
     iat: 0,
     exp: 0
   };

package/dist/token.d.ts

@@ -1,10 +1,18 @@
-import type { TokenConfig, TokenPayload } from "./types.ts";
+import type { SigningConfig, TokenPayload, VerifyConfig } from "./types.ts";
+export declare function generateKeyPair(): Promise<{
+    kid: string;
+    privateKeyJwk: JsonWebKey;
+    publicKeyJwk: JsonWebKey;
+}>;
+export declare function importPrivateKey(jwk: JsonWebKey): Promise<CryptoKey>;
+export declare function importPublicKey(jwk: JsonWebKey): Promise<CryptoKey>;
 export interface CreateTokenInput {
     id: string;
     email: string;
     name: string;
     isAdmin: boolean;
     scopes: string[];
+    flags: Record<string, string[]>;
 }
-export declare function createToken(config: TokenConfig, user: CreateTokenInput): Promise<string>;
-export declare function validateToken(config: TokenConfig, token: string): Promise<TokenPayload | null>;
+export declare function createToken(config: SigningConfig, user: CreateTokenInput): Promise<string>;
+export declare function validateToken(config: VerifyConfig, token: string): Promise<TokenPayload | null>;

package/dist/token.js

@@ -17,21 +17,24 @@ function base64urlDecode(str) {
   }
   return bytes;
 }
-async function hmacSign(secret, data) {
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign"
-  ]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
-  return base64urlEncode(new Uint8Array(signature));
+var ECDSA_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN_PARAMS = { name: "ECDSA", hash: "SHA-256" };
+async function generateKeyPair() {
+  const kid = crypto.randomUUID().slice(0, 8);
+  const keyPair = await crypto.subtle.generateKey(ECDSA_PARAMS, true, ["sign", "verify"]);
+  if (!("privateKey" in keyPair))
+    throw new Error("Expected CryptoKeyPair from ECDSA generateKey");
+  const privateExport = await crypto.subtle.exportKey("jwk", keyPair.privateKey);
+  const publicExport = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  if (privateExport instanceof ArrayBuffer || publicExport instanceof ArrayBuffer)
+    throw new Error("Expected JWK from exportKey");
+  return { kid, privateKeyJwk: privateExport, publicKeyJwk: publicExport };
 }
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length)
-    return false;
-  let diff = 0;
-  for (let i = 0;i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
+async function importPrivateKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["sign"]);
+}
+async function importPublicKey(jwk) {
+  return crypto.subtle.importKey("jwk", jwk, ECDSA_PARAMS, false, ["verify"]);
 }
 async function createToken(config, user) {
   const now = Math.floor(Date.now() / 1000);
@@ -41,36 +44,54 @@ async function createToken(config, user) {
     name: user.name,
     admin: user.isAdmin,
     scopes: user.scopes,
+    flags: user.flags,
+    kid: config.kid,
     iat: now,
     exp: now + config.maxAgeSeconds
   };
   const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
-  const sig = await hmacSign(config.secret, payloadB64);
-  return `${payloadB64}.${sig}`;
+  const payloadBytes = encoder.encode(payloadB64);
+  const signature = await crypto.subtle.sign(SIGN_PARAMS, config.privateKey, payloadBytes);
+  const sigB64 = base64urlEncode(new Uint8Array(signature));
+  return `${payloadB64}.${sigB64}`;
 }
 async function validateToken(config, token) {
   const dotIndex = token.indexOf(".");
   if (dotIndex === -1)
     return null;
   const payloadB64 = token.substring(0, dotIndex);
-  const sig = token.substring(dotIndex + 1);
-  const expectedSig = await hmacSign(config.secret, payloadB64);
-  if (!timingSafeEqual(sig, expectedSig))
-    return null;
+  const sigB64 = token.substring(dotIndex + 1);
+  let payload;
   try {
     const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
-    const payload = JSON.parse(decoded);
-    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
-      return null;
-    const now = Math.floor(Date.now() / 1000);
-    if (now > payload.exp)
+    payload = JSON.parse(decoded);
+  } catch {
+    return null;
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number" || typeof payload.kid !== "string") {
+    return null;
+  }
+  const now = Math.floor(Date.now() / 1000);
+  if (now > payload.exp)
+    return null;
+  const entry = config.publicKeys.find((k) => k.kid === payload.kid);
+  if (!entry)
+    return null;
+  try {
+    const signatureBytes = base64urlDecode(sigB64);
+    const payloadBytes = encoder.encode(payloadB64);
+    const valid = await crypto.subtle.verify(SIGN_PARAMS, entry.key, signatureBytes, payloadBytes);
+    if (!valid)
       return null;
-    return payload;
   } catch {
     return null;
   }
+  return payload;
 }
 export {
   validateToken,
+  importPublicKey,
+  importPrivateKey,
+  generateKeyPair,
   createToken
 };

package/dist/types.d.ts

@@ -34,11 +34,22 @@ export interface TokenPayload {
     name: string;
     admin: boolean;
     scopes: string[];
+    flags: Record<string, string[]>;
+    kid: string;
     iat: number;
     exp: number;
 }
-export interface TokenConfig {
-    secret: string;
+export interface PublicKeyEntry {
+    kid: string;
+    key: CryptoKey;
+}
+export interface SigningConfig {
+    privateKey: CryptoKey;
+    kid: string;
+    maxAgeSeconds: number;
+}
+export interface VerifyConfig {
+    publicKeys: PublicKeyEntry[];
     maxAgeSeconds: number;
 }
 export interface CookieConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@uln/auth",
-	"version": "0.1.0",
+	"version": "0.2.0",
 	"type": "module",
 	"exports": {
 		".": {
@@ -17,6 +17,11 @@
 			"bun": "./src/service.ts",
 			"import": "./dist/service.js",
 			"types": "./dist/service.d.ts"
+		},
+		"./hono": {
+			"bun": "./src/hono.ts",
+			"import": "./dist/hono.js",
+			"types": "./dist/hono.d.ts"
 		}
 	},
 	"files": [
@@ -26,11 +31,11 @@
 	],
 	"scripts": {
 		"dev": "bunx vite",
-		"dev:worker": "cd worker && bunx wrangler dev",
+		"dev:worker": "bunx wrangler dev",
 		"build": "bun run scripts/build.ts",
 		"check": "biome check --write .",
 		"test": "bun test",
-		"deploy": "bunx vite build && cd worker && bunx wrangler deploy",
+		"deploy": "bunx wrangler deploy",
 		"publish:check": "bun run scripts/publish.ts check",
 		"publish:release": "bun run scripts/publish.ts release"
 	},
@@ -48,6 +53,12 @@
 		"vite": "^8.0.1"
 	},
 	"peerDependencies": {
+		"hono": "^4",
 		"typescript": "^5"
+	},
+	"peerDependenciesMeta": {
+		"hono": {
+			"optional": true
+		}
 	}
 }

package/src/client.ts

@@ -1,4 +1,19 @@
-export type { TokenPayload, TokenConfig, CookieConfig } from "./types.ts";
-export { createToken, validateToken } from "./token.ts";
+export type { TokenPayload, VerifyConfig, PublicKeyEntry, CookieConfig } from "./types.ts";
+export { validateToken, importPublicKey } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
 export { getAuthUser, redirectToLogin, getClientIP, checkBearerToken } from "./middleware.ts";
+
+import { importPublicKey } from "./token.ts";
+import type { PublicKeyEntry } from "./types.ts";
+
+export async function fetchPublicKeys(baseUrl: string): Promise<PublicKeyEntry[]> {
+  const res = await fetch(`${baseUrl}/.well-known/jwk.json`);
+  if (!res.ok) throw new Error(`Failed to fetch JWKS from ${baseUrl}: ${res.status}`);
+  const jwks = (await res.json()) as { keys: (JsonWebKey & { kid: string })[] };
+  return Promise.all(
+    jwks.keys.map(async (jwk) => ({
+      kid: jwk.kid,
+      key: await importPublicKey(jwk),
+    })),
+  );
+}

package/src/cookie.ts

@@ -1,24 +1,24 @@
 import type { CookieConfig } from "./types.ts";
 
 export function makeSessionCookie(config: CookieConfig, token: string): string {
-	const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
-	if (config.secure) parts.push("Secure");
-	return parts.join("; ");
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure) parts.push("Secure");
+  return parts.join("; ");
 }
 
 export function makeClearCookie(config: CookieConfig): string {
-	const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
-	if (config.secure) parts.push("Secure");
-	return parts.join("; ");
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure) parts.push("Secure");
+  return parts.join("; ");
 }
 
 export function extractCookie(cookieHeader: string, name: string): string | null {
-	const prefix = `${name}=`;
-	for (const cookie of cookieHeader.split(";")) {
-		const trimmed = cookie.trim();
-		if (trimmed.startsWith(prefix)) {
-			return trimmed.substring(prefix.length);
-		}
-	}
-	return null;
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
 }

package/src/hono.ts

@@ -0,0 +1,215 @@
+import type { Context, MiddlewareHandler } from "hono";
+import { extractCookie } from "./cookie.ts";
+import { makeSessionCookie } from "./cookie.ts";
+import { importPublicKey } from "./token.ts";
+import { validateToken } from "./token.ts";
+import type { CookieConfig, PublicKeyEntry, TokenPayload } from "./types.ts";
+
+interface AuthOptions {
+  /**
+   * Service binding name (e.g. "AUTH"). If provided, validates tokens
+   * via the auth worker service binding instead of fetching public keys.
+   */
+  binding?: string;
+
+  /**
+   * Paths that don't require authentication. Supports exact matches
+   * and trailing wildcard (e.g. "/api/public/*").
+   */
+  public?: string[];
+
+  /**
+   * Auth service base URL. Defaults to "https://auth.uln.industries".
+   */
+  authUrl?: string;
+
+  /** Cookie name. Defaults to "uln_auth". */
+  cookie?: string;
+
+  /** Cookie/token max age in seconds. Defaults to 86400 (24h). */
+  maxAge?: number;
+}
+
+const DEFAULT_AUTH_URL = "https://auth.uln.industries";
+const DEFAULT_COOKIE = "uln_auth";
+const DEFAULT_MAX_AGE = 86400;
+
+function isPublicPath(pathname: string, patterns: string[]): boolean {
+  for (const pattern of patterns) {
+    if (pattern.endsWith("/*")) {
+      const prefix = pattern.slice(0, -1);
+      if (pathname === prefix.slice(0, -1) || pathname.startsWith(prefix)) return true;
+    } else if (pathname === pattern) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// --- Public key caching (client mode) ---
+
+let cachedKeys: PublicKeyEntry[] | null = null;
+let cachedAt = 0;
+const CACHE_TTL = 3600_000; // 1 hour
+
+async function getPublicKeys(authUrl: string): Promise<PublicKeyEntry[]> {
+  if (cachedKeys && Date.now() - cachedAt < CACHE_TTL) {
+    return cachedKeys;
+  }
+  const res = await fetch(`${authUrl}/.well-known/jwk.json`);
+  if (!res.ok) throw new Error(`Failed to fetch JWKS from ${authUrl}: ${res.status}`);
+  const jwks = (await res.json()) as { keys: (JsonWebKey & { kid: string })[] };
+  cachedKeys = await Promise.all(
+    jwks.keys.map(async (jwk) => ({
+      kid: jwk.kid,
+      key: await importPublicKey(jwk),
+    })),
+  );
+  cachedAt = Date.now();
+  return cachedKeys;
+}
+
+// --- Token validation ---
+
+async function validateWithPublicKeys(token: string, authUrl: string, maxAge: number): Promise<TokenPayload | null> {
+  const publicKeys = await getPublicKeys(authUrl);
+  return validateToken({ publicKeys, maxAgeSeconds: maxAge }, token);
+}
+
+async function validateWithBinding(token: string, binding: Fetcher): Promise<TokenPayload | null> {
+  const res = await binding.fetch("https://auth/api/verify-token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token }),
+  });
+  if (!res.ok) return null;
+  const data = (await res.json()) as {
+    user: {
+      id: string;
+      email: string;
+      name: string;
+      admin: boolean;
+      scopes: string[];
+      flags: Record<string, string[]>;
+      kid: string;
+    };
+  };
+  return {
+    sub: data.user.id,
+    email: data.user.email,
+    name: data.user.name,
+    admin: data.user.admin,
+    scopes: data.user.scopes,
+    flags: data.user.flags,
+    kid: data.user.kid,
+    iat: 0,
+    exp: 0,
+  };
+}
+
+/**
+ * Hono middleware that handles the full auth flow:
+ *
+ * 1. If `?token=` in URL → validate, set cookie, redirect to clean URL
+ * 2. If session cookie present → validate, set `c.get("user")`
+ * 3. If unauthenticated → redirect to auth.uln.industries/login
+ *
+ * Usage:
+ * ```ts
+ * import { auth } from "@uln/auth/hono";
+ *
+ * // Public key validation (default — no config needed):
+ * app.use("/*", auth());
+ *
+ * // Service binding (if on same CF account):
+ * app.use("/*", auth({ binding: "AUTH" }));
+ *
+ * // With public paths:
+ * app.use("/*", auth({ public: ["/health", "/api/public/*"] }));
+ *
+ * // Access user in handlers:
+ * app.get("/me", (c) => c.json(c.get("user")));
+ * ```
+ */
+export function auth(options?: AuthOptions): MiddlewareHandler {
+  const authUrl = options?.authUrl ?? DEFAULT_AUTH_URL;
+  const cookieName = options?.cookie ?? DEFAULT_COOKIE;
+  const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
+  const publicPaths = options?.public ?? [];
+  const bindingName = options?.binding;
+
+  const cookieConf: CookieConfig = { name: cookieName, maxAgeSeconds: maxAge, secure: true };
+
+  async function validate(token: string, env: Record<string, unknown>): Promise<TokenPayload | null> {
+    if (bindingName) {
+      const binding = env[bindingName] as Fetcher | undefined;
+      if (!binding) throw new Error(`Service binding "${bindingName}" not found in env`);
+      return validateWithBinding(token, binding);
+    }
+    return validateWithPublicKeys(token, authUrl, maxAge);
+  }
+
+  return async (c, next) => {
+    const url = new URL(c.req.url);
+
+    // Public paths bypass auth
+    if (isPublicPath(url.pathname, publicPaths)) {
+      return next();
+    }
+
+    // Step 1: Handle ?token= callback (login redirect landing)
+    const incomingToken = url.searchParams.get("token");
+    if (incomingToken) {
+      const payload = await validate(incomingToken, c.env as Record<string, unknown>);
+      if (!payload) {
+        return c.text("Invalid token", 401);
+      }
+
+      // Set cookie and redirect to clean URL (strip token param)
+      url.searchParams.delete("token");
+      return new Response(null, {
+        status: 302,
+        headers: {
+          Location: url.toString(),
+          "Set-Cookie": makeSessionCookie(cookieConf, incomingToken),
+        },
+      });
+    }
+
+    // Step 2: Check session cookie
+    const cookieHeader = c.req.header("Cookie");
+    if (cookieHeader) {
+      const token = extractCookie(cookieHeader, cookieName);
+      if (token) {
+        const payload = await validate(token, c.env as Record<string, unknown>);
+        if (payload) {
+          c.set("user", payload);
+          return next();
+        }
+      }
+    }
+
+    // Step 3: Check Authorization header
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      const token = authHeader.substring(7);
+      const payload = await validate(token, c.env as Record<string, unknown>);
+      if (payload) {
+        c.set("user", payload);
+        return next();
+      }
+      return c.json({ error: "Invalid token" }, 401);
+    }
+
+    // Step 4: Redirect to login
+    const loginUrl = `${authUrl}/login?redirect=${encodeURIComponent(c.req.url)}`;
+    return c.redirect(loginUrl, 302);
+  };
+}
+
+/** Type-safe helper to get the authenticated user from context. */
+export function getUser(c: Context): TokenPayload {
+  return c.get("user") as TokenPayload;
+}
+
+export type { TokenPayload } from "./types.ts";

package/src/index.ts

@@ -1,16 +1,18 @@
 export type {
-	User,
-	UserStore,
-	RateLimitEntry,
-	RateLimitStore,
-	RateLimitConfig,
-	TokenPayload,
-	TokenConfig,
-	CookieConfig,
+  User,
+  UserStore,
+  RateLimitEntry,
+  RateLimitStore,
+  RateLimitConfig,
+  TokenPayload,
+  SigningConfig,
+  VerifyConfig,
+  PublicKeyEntry,
+  CookieConfig,
 } from "./types.ts";
 
 export { hashPassword, verifyPassword } from "./password.ts";
-export { createToken, validateToken } from "./token.ts";
+export { createToken, validateToken, generateKeyPair, importPrivateKey, importPublicKey } from "./token.ts";
 export type { CreateTokenInput } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
 export { checkRateLimit, recordFailedAttempt, clearRateLimit } from "./rate-limit.ts";