@uln/auth 0.1.0

package/dist/service.js

@@ -0,0 +1,65 @@
+// @bun
+// src/cookie.ts
+function makeSessionCookie(config, token) {
+  const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function makeClearCookie(config) {
+  const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+  if (config.secure)
+    parts.push("Secure");
+  return parts.join("; ");
+}
+function extractCookie(cookieHeader, name) {
+  const prefix = `${name}=`;
+  for (const cookie of cookieHeader.split(";")) {
+    const trimmed = cookie.trim();
+    if (trimmed.startsWith(prefix)) {
+      return trimmed.substring(prefix.length);
+    }
+  }
+  return null;
+}
+
+// src/service.ts
+async function verifyToken(authService, token) {
+  const res = await authService.fetch("https://auth/api/verify-token", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ token })
+  });
+  if (!res.ok)
+    return null;
+  const data = await res.json();
+  return {
+    sub: data.user.id,
+    email: data.user.email,
+    name: data.user.name,
+    admin: data.user.admin,
+    scopes: data.user.scopes,
+    iat: 0,
+    exp: 0
+  };
+}
+async function getAuthUser(request, authService, cookieConfig) {
+  const cookieHeader = request.headers.get("Cookie");
+  if (!cookieHeader)
+    return null;
+  const token = extractCookie(cookieHeader, cookieConfig.name);
+  if (!token)
+    return null;
+  return verifyToken(authService, token);
+}
+function redirectToLogin(currentUrl) {
+  const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+  return Response.redirect(loginUrl, 302);
+}
+export {
+  verifyToken,
+  redirectToLogin,
+  makeSessionCookie,
+  makeClearCookie,
+  getAuthUser
+};

package/dist/token.d.ts

@@ -0,0 +1,10 @@
+import type { TokenConfig, TokenPayload } from "./types.ts";
+export interface CreateTokenInput {
+    id: string;
+    email: string;
+    name: string;
+    isAdmin: boolean;
+    scopes: string[];
+}
+export declare function createToken(config: TokenConfig, user: CreateTokenInput): Promise<string>;
+export declare function validateToken(config: TokenConfig, token: string): Promise<TokenPayload | null>;

package/dist/token.js

@@ -0,0 +1,76 @@
+// @bun
+// src/token.ts
+var encoder = new TextEncoder;
+function base64urlEncode(data) {
+  let binary = "";
+  for (const byte of data) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0;i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+async function hmacSign(secret, data) {
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return base64urlEncode(new Uint8Array(signature));
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+async function createToken(config, user) {
+  const now = Math.floor(Date.now() / 1000);
+  const payload = {
+    sub: user.id,
+    email: user.email,
+    name: user.name,
+    admin: user.isAdmin,
+    scopes: user.scopes,
+    iat: now,
+    exp: now + config.maxAgeSeconds
+  };
+  const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+  const sig = await hmacSign(config.secret, payloadB64);
+  return `${payloadB64}.${sig}`;
+}
+async function validateToken(config, token) {
+  const dotIndex = token.indexOf(".");
+  if (dotIndex === -1)
+    return null;
+  const payloadB64 = token.substring(0, dotIndex);
+  const sig = token.substring(dotIndex + 1);
+  const expectedSig = await hmacSign(config.secret, payloadB64);
+  if (!timingSafeEqual(sig, expectedSig))
+    return null;
+  try {
+    const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+    const payload = JSON.parse(decoded);
+    if (typeof payload.sub !== "string" || typeof payload.exp !== "number")
+      return null;
+    const now = Math.floor(Date.now() / 1000);
+    if (now > payload.exp)
+      return null;
+    return payload;
+  } catch {
+    return null;
+  }
+}
+export {
+  validateToken,
+  createToken
+};

package/dist/types.d.ts

@@ -0,0 +1,48 @@
+export interface User {
+    id: string;
+    email: string;
+    name: string;
+    passwordHash: string;
+    isAdmin: boolean;
+    emailVerified: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UserStore {
+    getUser(id: string): Promise<User | null>;
+    getUserByEmail(email: string): Promise<User | null>;
+    listUsers(): Promise<User[]>;
+    saveUser(user: User): Promise<void>;
+    deleteUser(id: string): Promise<void>;
+}
+export interface RateLimitEntry {
+    attempts: number;
+    firstAttempt: number;
+}
+export interface RateLimitStore {
+    get(key: string): Promise<RateLimitEntry | null>;
+    set(key: string, entry: RateLimitEntry, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export interface RateLimitConfig {
+    maxAttempts: number;
+    windowSeconds: number;
+}
+export interface TokenPayload {
+    sub: string;
+    email: string;
+    name: string;
+    admin: boolean;
+    scopes: string[];
+    iat: number;
+    exp: number;
+}
+export interface TokenConfig {
+    secret: string;
+    maxAgeSeconds: number;
+}
+export interface CookieConfig {
+    name: string;
+    maxAgeSeconds: number;
+    secure: boolean;
+}

package/dist/types.js

@@ -0,0 +1 @@
+// @bun

package/dist/users.d.ts

@@ -0,0 +1,9 @@
+import type { User, UserStore } from "./types.ts";
+export declare function createUser(store: UserStore, input: {
+    email: string;
+    name: string;
+    password?: string;
+    isAdmin?: boolean;
+}): Promise<User>;
+export declare function verifyUserCredentials(store: UserStore, email: string, password: string): Promise<User | null>;
+export declare function changePassword(store: UserStore, userId: string, newPassword: string): Promise<void>;

package/dist/users.js

@@ -0,0 +1,91 @@
+// @bun
+// src/password.ts
+var SALT_LENGTH = 32;
+var KEY_LENGTH = 64;
+var ITERATIONS = 1e5;
+function toHex(buffer) {
+  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function fromHex(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0;i < hex.length; i += 2) {
+    bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+async function deriveKey(password, salt) {
+  const encoder = new TextEncoder;
+  const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]);
+  return crypto.subtle.deriveBits({
+    name: "PBKDF2",
+    salt,
+    iterations: ITERATIONS,
+    hash: "SHA-256"
+  }, keyMaterial, KEY_LENGTH * 8);
+}
+async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+  const derived = await deriveKey(password, salt);
+  return `${toHex(salt.buffer)}:${toHex(derived)}`;
+}
+async function verifyPassword(password, storedHash) {
+  const separatorIndex = storedHash.indexOf(":");
+  if (separatorIndex === -1)
+    return false;
+  const saltHex = storedHash.substring(0, separatorIndex);
+  const keyHex = storedHash.substring(separatorIndex + 1);
+  const salt = fromHex(saltHex);
+  const expectedKey = fromHex(keyHex);
+  const derived = new Uint8Array(await deriveKey(password, salt));
+  if (derived.length !== expectedKey.length)
+    return false;
+  let diff = 0;
+  for (let i = 0;i < derived.length; i++) {
+    diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
+  }
+  return diff === 0;
+}
+
+// src/users.ts
+async function createUser(store, input) {
+  const existing = await store.getUserByEmail(input.email);
+  if (existing)
+    throw new Error(`User with email ${input.email} already exists`);
+  const now = new Date().toISOString();
+  const passwordHash = input.password ? await hashPassword(input.password) : await hashPassword(crypto.randomUUID());
+  const user = {
+    id: crypto.randomUUID(),
+    email: input.email.toLowerCase(),
+    name: input.name,
+    passwordHash,
+    isAdmin: input.isAdmin ?? false,
+    emailVerified: input.isAdmin ?? false,
+    createdAt: now,
+    updatedAt: now
+  };
+  await store.saveUser(user);
+  return user;
+}
+async function verifyUserCredentials(store, email, password) {
+  const user = await store.getUserByEmail(email.toLowerCase());
+  if (!user)
+    return null;
+  const valid = await verifyPassword(password, user.passwordHash);
+  return valid ? user : null;
+}
+async function changePassword(store, userId, newPassword) {
+  const user = await store.getUser(userId);
+  if (!user)
+    throw new Error(`User ${userId} not found`);
+  const updated = {
+    ...user,
+    passwordHash: await hashPassword(newPassword),
+    updatedAt: new Date().toISOString()
+  };
+  await store.saveUser(updated);
+}
+export {
+  verifyUserCredentials,
+  createUser,
+  changePassword
+};

package/package.json

@@ -0,0 +1,53 @@
+{
+	"name": "@uln/auth",
+	"version": "0.1.0",
+	"type": "module",
+	"exports": {
+		".": {
+			"bun": "./src/index.ts",
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		},
+		"./client": {
+			"bun": "./src/client.ts",
+			"import": "./dist/client.js",
+			"types": "./dist/client.d.ts"
+		},
+		"./service": {
+			"bun": "./src/service.ts",
+			"import": "./dist/service.js",
+			"types": "./dist/service.d.ts"
+		}
+	},
+	"files": [
+		"dist",
+		"src",
+		"!src/**/*.test.ts"
+	],
+	"scripts": {
+		"dev": "bunx vite",
+		"dev:worker": "cd worker && bunx wrangler dev",
+		"build": "bun run scripts/build.ts",
+		"check": "biome check --write .",
+		"test": "bun test",
+		"deploy": "bunx vite build && cd worker && bunx wrangler deploy",
+		"publish:check": "bun run scripts/publish.ts check",
+		"publish:release": "bun run scripts/publish.ts release"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^1.9.4",
+		"@cloudflare/workers-types": "^4.20260317.1",
+		"@types/bun": "latest",
+		"@types/react": "^19.2.14",
+		"@types/react-dom": "^19.2.3",
+		"@vitejs/plugin-react": "^6.0.1",
+		"hono": "^4.12.8",
+		"react": "^19.2.4",
+		"react-dom": "^19.2.4",
+		"react-router": "^7.13.1",
+		"vite": "^8.0.1"
+	},
+	"peerDependencies": {
+		"typescript": "^5"
+	}
+}

package/src/client.ts

@@ -0,0 +1,4 @@
+export type { TokenPayload, TokenConfig, CookieConfig } from "./types.ts";
+export { createToken, validateToken } from "./token.ts";
+export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export { getAuthUser, redirectToLogin, getClientIP, checkBearerToken } from "./middleware.ts";

package/src/cookie.ts

@@ -0,0 +1,24 @@
+import type { CookieConfig } from "./types.ts";
+
+export function makeSessionCookie(config: CookieConfig, token: string): string {
+	const parts = [`${config.name}=${token}`, `Max-Age=${config.maxAgeSeconds}`, "Path=/", "HttpOnly", "SameSite=Lax"];
+	if (config.secure) parts.push("Secure");
+	return parts.join("; ");
+}
+
+export function makeClearCookie(config: CookieConfig): string {
+	const parts = [`${config.name}=`, "Max-Age=0", "Path=/", "HttpOnly", "SameSite=Lax"];
+	if (config.secure) parts.push("Secure");
+	return parts.join("; ");
+}
+
+export function extractCookie(cookieHeader: string, name: string): string | null {
+	const prefix = `${name}=`;
+	for (const cookie of cookieHeader.split(";")) {
+		const trimmed = cookie.trim();
+		if (trimmed.startsWith(prefix)) {
+			return trimmed.substring(prefix.length);
+		}
+	}
+	return null;
+}

package/src/index.ts

@@ -0,0 +1,19 @@
+export type {
+	User,
+	UserStore,
+	RateLimitEntry,
+	RateLimitStore,
+	RateLimitConfig,
+	TokenPayload,
+	TokenConfig,
+	CookieConfig,
+} from "./types.ts";
+
+export { hashPassword, verifyPassword } from "./password.ts";
+export { createToken, validateToken } from "./token.ts";
+export type { CreateTokenInput } from "./token.ts";
+export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export { checkRateLimit, recordFailedAttempt, clearRateLimit } from "./rate-limit.ts";
+export type { RateLimitResult } from "./rate-limit.ts";
+export { getClientIP, checkBearerToken, getAuthUser, redirectToLogin } from "./middleware.ts";
+export { createUser, verifyUserCredentials, changePassword } from "./users.ts";

package/src/middleware.ts

@@ -0,0 +1,35 @@
+import { extractCookie } from "./cookie.ts";
+import { validateToken } from "./token.ts";
+import type { CookieConfig, TokenConfig, TokenPayload } from "./types.ts";
+
+export function getClientIP(request: Request): string {
+	return (
+		request.headers.get("cf-connecting-ip") ??
+		request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
+		"unknown"
+	);
+}
+
+export function checkBearerToken(request: Request, expectedToken: string): boolean {
+	const header = request.headers.get("Authorization");
+	return header === `Bearer ${expectedToken}`;
+}
+
+export async function getAuthUser(
+	request: Request,
+	tokenConfig: TokenConfig,
+	cookieConfig: CookieConfig,
+): Promise<TokenPayload | null> {
+	const cookieHeader = request.headers.get("Cookie");
+	if (!cookieHeader) return null;
+
+	const token = extractCookie(cookieHeader, cookieConfig.name);
+	if (!token) return null;
+
+	return validateToken(tokenConfig, token);
+}
+
+export function redirectToLogin(currentUrl: string): Response {
+	const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+	return Response.redirect(loginUrl, 302);
+}

package/src/password.ts

@@ -0,0 +1,57 @@
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 64;
+const ITERATIONS = 100_000;
+
+function toHex(buffer: ArrayBuffer): string {
+	return Array.from(new Uint8Array(buffer))
+		.map((b) => b.toString(16).padStart(2, "0"))
+		.join("");
+}
+
+function fromHex(hex: string): Uint8Array<ArrayBuffer> {
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) {
+		bytes[i / 2] = Number.parseInt(hex.substring(i, i + 2), 16);
+	}
+	return bytes;
+}
+
+async function deriveKey(password: string, salt: Uint8Array<ArrayBuffer>): Promise<ArrayBuffer> {
+	const encoder = new TextEncoder();
+	const keyMaterial = await crypto.subtle.importKey("raw", encoder.encode(password), "PBKDF2", false, ["deriveBits"]);
+	return crypto.subtle.deriveBits(
+		{
+			name: "PBKDF2",
+			salt,
+			iterations: ITERATIONS,
+			hash: "SHA-256",
+		},
+		keyMaterial,
+		KEY_LENGTH * 8,
+	);
+}
+
+export async function hashPassword(password: string): Promise<string> {
+	const salt = crypto.getRandomValues(new Uint8Array(SALT_LENGTH));
+	const derived = await deriveKey(password, salt);
+	return `${toHex(salt.buffer)}:${toHex(derived)}`;
+}
+
+export async function verifyPassword(password: string, storedHash: string): Promise<boolean> {
+	const separatorIndex = storedHash.indexOf(":");
+	if (separatorIndex === -1) return false;
+
+	const saltHex = storedHash.substring(0, separatorIndex);
+	const keyHex = storedHash.substring(separatorIndex + 1);
+	const salt = fromHex(saltHex);
+	const expectedKey = fromHex(keyHex);
+	const derived = new Uint8Array(await deriveKey(password, salt));
+
+	if (derived.length !== expectedKey.length) return false;
+
+	let diff = 0;
+	for (let i = 0; i < derived.length; i++) {
+		diff |= (derived[i] ?? 0) ^ (expectedKey[i] ?? 0);
+	}
+	return diff === 0;
+}

package/src/rate-limit.ts

@@ -0,0 +1,38 @@
+import type { RateLimitConfig, RateLimitStore } from "./types.ts";
+
+export interface RateLimitResult {
+	blocked: boolean;
+	remainingSeconds?: number;
+}
+
+export async function checkRateLimit(
+	store: RateLimitStore,
+	key: string,
+	config: RateLimitConfig,
+): Promise<RateLimitResult> {
+	const entry = await store.get(key);
+	if (!entry) return { blocked: false };
+
+	if (entry.attempts >= config.maxAttempts) {
+		const elapsed = Math.floor((Date.now() - entry.firstAttempt) / 1000);
+		const remaining = config.windowSeconds - elapsed;
+		if (remaining > 0) return { blocked: true, remainingSeconds: remaining };
+		await store.delete(key);
+		return { blocked: false };
+	}
+
+	return { blocked: false };
+}
+
+export async function recordFailedAttempt(store: RateLimitStore, key: string, config: RateLimitConfig): Promise<void> {
+	const entry = await store.get(key);
+	if (entry) {
+		await store.set(key, { attempts: entry.attempts + 1, firstAttempt: entry.firstAttempt }, config.windowSeconds);
+	} else {
+		await store.set(key, { attempts: 1, firstAttempt: Date.now() }, config.windowSeconds);
+	}
+}
+
+export async function clearRateLimit(store: RateLimitStore, key: string): Promise<void> {
+	await store.delete(key);
+}

package/src/service.ts

@@ -0,0 +1,54 @@
+import { extractCookie } from "./cookie.ts";
+import type { CookieConfig, TokenPayload } from "./types.ts";
+export { makeSessionCookie, makeClearCookie } from "./cookie.ts";
+export type { TokenPayload, CookieConfig } from "./types.ts";
+
+/**
+ * Validate a raw token string via the auth service binding.
+ * Returns the token payload or null if invalid.
+ */
+export async function verifyToken(authService: Fetcher, token: string): Promise<TokenPayload | null> {
+	const res = await authService.fetch("https://auth/api/verify-token", {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ token }),
+	});
+	if (!res.ok) return null;
+	const data: { user: { id: string; email: string; name: string; admin: boolean; scopes: string[] } } =
+		await res.json();
+	return {
+		sub: data.user.id,
+		email: data.user.email,
+		name: data.user.name,
+		admin: data.user.admin,
+		scopes: data.user.scopes,
+		iat: 0,
+		exp: 0,
+	};
+}
+
+/**
+ * Get the authenticated user from the session cookie via the auth service binding.
+ * Returns the token payload or null if not authenticated.
+ */
+export async function getAuthUser(
+	request: Request,
+	authService: Fetcher,
+	cookieConfig: CookieConfig,
+): Promise<TokenPayload | null> {
+	const cookieHeader = request.headers.get("Cookie");
+	if (!cookieHeader) return null;
+
+	const token = extractCookie(cookieHeader, cookieConfig.name);
+	if (!token) return null;
+
+	return verifyToken(authService, token);
+}
+
+/**
+ * Redirect to the centralized login page at auth.uln.industries.
+ */
+export function redirectToLogin(currentUrl: string): Response {
+	const loginUrl = `https://auth.uln.industries/login?redirect=${encodeURIComponent(currentUrl)}`;
+	return Response.redirect(loginUrl, 302);
+}

package/src/token.ts

@@ -0,0 +1,87 @@
+import type { TokenConfig, TokenPayload } from "./types.ts";
+
+const encoder = new TextEncoder();
+
+function base64urlEncode(data: Uint8Array): string {
+	let binary = "";
+	for (const byte of data) {
+		binary += String.fromCharCode(byte);
+	}
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function base64urlDecode(str: string): Uint8Array {
+	const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) {
+		bytes[i] = binary.charCodeAt(i);
+	}
+	return bytes;
+}
+
+async function hmacSign(secret: string, data: string): Promise<string> {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+		"sign",
+	]);
+	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+	return base64urlEncode(new Uint8Array(signature));
+}
+
+function timingSafeEqual(a: string, b: string): boolean {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) {
+		diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	}
+	return diff === 0;
+}
+
+export interface CreateTokenInput {
+	id: string;
+	email: string;
+	name: string;
+	isAdmin: boolean;
+	scopes: string[];
+}
+
+export async function createToken(config: TokenConfig, user: CreateTokenInput): Promise<string> {
+	const now = Math.floor(Date.now() / 1000);
+	const payload: TokenPayload = {
+		sub: user.id,
+		email: user.email,
+		name: user.name,
+		admin: user.isAdmin,
+		scopes: user.scopes,
+		iat: now,
+		exp: now + config.maxAgeSeconds,
+	};
+	const payloadB64 = base64urlEncode(encoder.encode(JSON.stringify(payload)));
+	const sig = await hmacSign(config.secret, payloadB64);
+	return `${payloadB64}.${sig}`;
+}
+
+export async function validateToken(config: TokenConfig, token: string): Promise<TokenPayload | null> {
+	const dotIndex = token.indexOf(".");
+	if (dotIndex === -1) return null;
+
+	const payloadB64 = token.substring(0, dotIndex);
+	const sig = token.substring(dotIndex + 1);
+
+	const expectedSig = await hmacSign(config.secret, payloadB64);
+	if (!timingSafeEqual(sig, expectedSig)) return null;
+
+	try {
+		const decoded = new TextDecoder().decode(base64urlDecode(payloadB64));
+		const payload = JSON.parse(decoded) as TokenPayload;
+
+		if (typeof payload.sub !== "string" || typeof payload.exp !== "number") return null;
+
+		const now = Math.floor(Date.now() / 1000);
+		if (now > payload.exp) return null;
+
+		return payload;
+	} catch {
+		return null;
+	}
+}