@uln/auth 0.4.0 → 0.4.2

package/dist/client.d.ts

@@ -1,6 +1,7 @@
 export type { TokenPayload, VerifyConfig, PublicKeyEntry, CookieConfig } from "./types.ts";
 export { validateToken, importPublicKey } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export type { AuthCodeExchangeConfig } from "./middleware.ts";
 export { getAuthUser, redirectToLogin, handleCallback, getClientIP, checkBearerToken } from "./middleware.ts";
 import type { PublicKeyEntry } from "./types.ts";
 export declare function fetchPublicKeys(baseUrl: string): Promise<PublicKeyEntry[]>;

package/dist/client.js

@@ -130,11 +130,10 @@ async function getAuthUser(request, verifyConfig, cookieConfig) {
     return null;
   return validateToken(verifyConfig, token);
 }
-function redirectToLogin(currentUrl, responseType = "code") {
+function redirectToLogin(currentUrl) {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code")
-    loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 async function exchangeCode(code, redirectOrigin, config) {
@@ -154,36 +153,22 @@ async function handleCallback(request, verifyConfig, cookieConfig, exchangeConfi
   if (code) {
     if (!exchangeConfig)
       return redirectToLogin(url.origin);
-    const token2 = await exchangeCode(code, url.origin, exchangeConfig);
-    if (!token2)
-      return redirectToLogin(url.origin, "code");
-    const payload2 = await validateToken(verifyConfig, token2);
-    if (!payload2)
-      return redirectToLogin(url.origin, "code");
+    const token = await exchangeCode(code, url.origin, exchangeConfig);
+    if (!token)
+      return redirectToLogin(url.origin);
+    const payload = await validateToken(verifyConfig, token);
+    if (!payload)
+      return redirectToLogin(url.origin);
     url.searchParams.delete("code");
     return new Response(null, {
       status: 302,
       headers: {
         Location: url.toString(),
-        "Set-Cookie": makeSessionCookie(cookieConfig, token2)
+        "Set-Cookie": makeSessionCookie(cookieConfig, token)
       }
     });
   }
-  const token = url.searchParams.get("token");
-  if (!token)
-    return null;
-  const payload = await validateToken(verifyConfig, token);
-  if (!payload) {
-    return redirectToLogin(url.origin);
-  }
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token)
-    }
-  });
+  return null;
 }
 // src/client.ts
 async function fetchPublicKeys(baseUrl) {

package/dist/hono.d.ts

@@ -19,13 +19,11 @@ interface AuthOptions {
     cookie?: string;
     /** Cookie/token max age in seconds. Defaults to 86400 (24h). */
     maxAge?: number;
-    /** Redirect callback mode. "code" avoids putting signed tokens in URLs. Defaults to "code". */
-    responseType?: "code" | "token";
 }
 /**
  * Hono middleware that handles the full auth flow:
  *
- * 1. If `?token=` in URL → validate, set cookie, redirect to clean URL
+ * 1. If `?code=` in URL → exchange for token, set cookie, redirect to clean URL
  * 2. If session cookie present → validate, set `c.get("user")`
  * 3. If unauthenticated → redirect to auth.uln.industries/login
  *

package/dist/hono.js

@@ -198,7 +198,6 @@ function auth(options) {
   const authUrl = options?.authUrl ?? DEFAULT_AUTH_URL;
   const cookieName = options?.cookie ?? DEFAULT_COOKIE;
   const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
-  const responseType = options?.responseType ?? "code";
   const publicPaths = options?.public ?? [];
   const bindingName = options?.binding;
   const cookieConf = { name: cookieName, maxAgeSeconds: maxAge, secure: true };
@@ -244,21 +243,6 @@ function auth(options) {
         }
       });
     }
-    const incomingToken = url.searchParams.get("token");
-    if (incomingToken) {
-      const payload = await validate(incomingToken, c.env);
-      if (!payload) {
-        return c.text("Invalid token", 401);
-      }
-      url.searchParams.delete("token");
-      return new Response(null, {
-        status: 302,
-        headers: {
-          Location: url.toString(),
-          "Set-Cookie": makeSessionCookie(cookieConf, incomingToken)
-        }
-      });
-    }
     const cookieHeader = c.req.header("Cookie");
     if (cookieHeader) {
       const token = extractCookie(cookieHeader, cookieName);
@@ -282,8 +266,7 @@ function auth(options) {
     }
     const loginUrl = new URL("/login", authUrl);
     loginUrl.searchParams.set("redirect", c.req.url);
-    if (responseType === "code")
-      loginUrl.searchParams.set("response_type", "code");
+    loginUrl.searchParams.set("response_type", "code");
     return c.redirect(loginUrl.toString(), 302);
   };
 }

package/dist/index.js

@@ -130,11 +130,10 @@ async function getAuthUser(request, verifyConfig, cookieConfig) {
     return null;
   return validateToken(verifyConfig, token);
 }
-function redirectToLogin(currentUrl, responseType = "code") {
+function redirectToLogin(currentUrl) {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code")
-    loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 async function exchangeCode(code, redirectOrigin, config) {
@@ -154,36 +153,22 @@ async function handleCallback(request, verifyConfig, cookieConfig, exchangeConfi
   if (code) {
     if (!exchangeConfig)
       return redirectToLogin(url.origin);
-    const token2 = await exchangeCode(code, url.origin, exchangeConfig);
-    if (!token2)
-      return redirectToLogin(url.origin, "code");
-    const payload2 = await validateToken(verifyConfig, token2);
-    if (!payload2)
-      return redirectToLogin(url.origin, "code");
+    const token = await exchangeCode(code, url.origin, exchangeConfig);
+    if (!token)
+      return redirectToLogin(url.origin);
+    const payload = await validateToken(verifyConfig, token);
+    if (!payload)
+      return redirectToLogin(url.origin);
     url.searchParams.delete("code");
     return new Response(null, {
       status: 302,
       headers: {
         Location: url.toString(),
-        "Set-Cookie": makeSessionCookie(cookieConfig, token2)
+        "Set-Cookie": makeSessionCookie(cookieConfig, token)
       }
     });
   }
-  const token = url.searchParams.get("token");
-  if (!token)
-    return null;
-  const payload = await validateToken(verifyConfig, token);
-  if (!payload) {
-    return redirectToLogin(url.origin);
-  }
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token)
-    }
-  });
+  return null;
 }
 
 // src/password.ts

package/dist/middleware.d.ts

@@ -5,11 +5,11 @@ export interface AuthCodeExchangeConfig {
 export declare function getClientIP(request: Request): string;
 export declare function checkBearerToken(request: Request, expectedToken: string): boolean;
 export declare function getAuthUser(request: Request, verifyConfig: VerifyConfig, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
-export declare function redirectToLogin(currentUrl: string, responseType?: "code" | "token"): Response;
+export declare function redirectToLogin(currentUrl: string): Response;
 /**
  * Handle the auth callback on consuming sites.
- * If the request URL has a `?code=` or legacy `?token=` param, sets a session cookie,
- * and redirects to the same URL without the token param.
+ * If the request URL has a `?code=` param, exchanges it for a token,
+ * sets a session cookie, and redirects to the same URL without the code param.
  * Returns null if there's no callback param.
  */
 export declare function handleCallback(request: Request, verifyConfig: VerifyConfig, cookieConfig: CookieConfig, exchangeConfig?: AuthCodeExchangeConfig): Promise<Response | null>;

package/dist/middleware.js

@@ -130,11 +130,10 @@ async function getAuthUser(request, verifyConfig, cookieConfig) {
     return null;
   return validateToken(verifyConfig, token);
 }
-function redirectToLogin(currentUrl, responseType = "code") {
+function redirectToLogin(currentUrl) {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code")
-    loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 async function exchangeCode(code, redirectOrigin, config) {
@@ -154,36 +153,22 @@ async function handleCallback(request, verifyConfig, cookieConfig, exchangeConfi
   if (code) {
     if (!exchangeConfig)
       return redirectToLogin(url.origin);
-    const token2 = await exchangeCode(code, url.origin, exchangeConfig);
-    if (!token2)
-      return redirectToLogin(url.origin, "code");
-    const payload2 = await validateToken(verifyConfig, token2);
-    if (!payload2)
-      return redirectToLogin(url.origin, "code");
+    const token = await exchangeCode(code, url.origin, exchangeConfig);
+    if (!token)
+      return redirectToLogin(url.origin);
+    const payload = await validateToken(verifyConfig, token);
+    if (!payload)
+      return redirectToLogin(url.origin);
     url.searchParams.delete("code");
     return new Response(null, {
       status: 302,
       headers: {
         Location: url.toString(),
-        "Set-Cookie": makeSessionCookie(cookieConfig, token2)
+        "Set-Cookie": makeSessionCookie(cookieConfig, token)
       }
     });
   }
-  const token = url.searchParams.get("token");
-  if (!token)
-    return null;
-  const payload = await validateToken(verifyConfig, token);
-  if (!payload) {
-    return redirectToLogin(url.origin);
-  }
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token)
-    }
-  });
+  return null;
 }
 export {
   redirectToLogin,

package/dist/service.d.ts

@@ -13,13 +13,12 @@ export declare function verifyToken(authService: Fetcher, token: string): Promis
 export declare function getAuthUser(request: Request, authService: Fetcher, cookieConfig: CookieConfig): Promise<TokenPayload | null>;
 /**
  * Redirect to the centralized login page at auth.uln.industries.
- * Requests one-time auth-code callbacks by default so signed tokens are not sent through URLs.
+ * Requests one-time auth-code callbacks so signed tokens are not sent through URLs.
  */
-export declare function redirectToLogin(currentUrl: string, responseType?: "code" | "token"): Response;
+export declare function redirectToLogin(currentUrl: string): Response;
 /**
  * Handle an auth callback on a consuming Worker using the auth service binding.
  * Preferred `?code=` callbacks are exchanged for signed tokens before setting the local cookie.
- * Legacy `?token=` callbacks are still accepted during migration and are stripped immediately.
  * Returns null if the request has no auth callback parameters.
  */
 export declare function handleCallback(request: Request, authService: Fetcher, cookieConfig: CookieConfig): Promise<Response | null>;

package/dist/service.js

@@ -54,11 +54,10 @@ async function getAuthUser(request, authService, cookieConfig) {
     return null;
   return verifyToken(authService, token);
 }
-function redirectToLogin(currentUrl, responseType = "code") {
+function redirectToLogin(currentUrl) {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code")
-    loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 async function exchangeCode(authService, code, redirectOrigin) {
@@ -76,35 +75,22 @@ async function handleCallback(request, authService, cookieConfig) {
   const url = new URL(request.url);
   const code = url.searchParams.get("code");
   if (code) {
-    const token2 = await exchangeCode(authService, code, url.origin);
-    if (!token2)
-      return redirectToLogin(url.origin, "code");
-    const payload2 = await verifyToken(authService, token2);
-    if (!payload2)
-      return redirectToLogin(url.origin, "code");
+    const token = await exchangeCode(authService, code, url.origin);
+    if (!token)
+      return redirectToLogin(url.origin);
+    const payload = await verifyToken(authService, token);
+    if (!payload)
+      return redirectToLogin(url.origin);
     url.searchParams.delete("code");
     return new Response(null, {
       status: 302,
       headers: {
         Location: url.toString(),
-        "Set-Cookie": makeSessionCookie(cookieConfig, token2)
+        "Set-Cookie": makeSessionCookie(cookieConfig, token)
       }
     });
   }
-  const token = url.searchParams.get("token");
-  if (!token)
-    return null;
-  const payload = await verifyToken(authService, token);
-  if (!payload)
-    return redirectToLogin(url.origin, "code");
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token)
-    }
-  });
+  return null;
 }
 export {
   verifyToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uln/auth",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "type": "module",
   "exports": {
     ".": {
@@ -57,7 +57,7 @@
   },
   "peerDependencies": {
     "hono": "^4",
-    "typescript": "^5"
+    "typescript": "^5 || ^6"
   },
   "peerDependenciesMeta": {
     "hono": {

package/src/client.ts

@@ -1,6 +1,7 @@
 export type { TokenPayload, VerifyConfig, PublicKeyEntry, CookieConfig } from "./types.ts";
 export { validateToken, importPublicKey } from "./token.ts";
 export { makeSessionCookie, makeClearCookie, extractCookie } from "./cookie.ts";
+export type { AuthCodeExchangeConfig } from "./middleware.ts";
 export { getAuthUser, redirectToLogin, handleCallback, getClientIP, checkBearerToken } from "./middleware.ts";
 
 import { importPublicKey } from "./token.ts";

package/src/hono.ts

@@ -28,9 +28,6 @@ interface AuthOptions {
 
   /** Cookie/token max age in seconds. Defaults to 86400 (24h). */
   maxAge?: number;
-
-  /** Redirect callback mode. "code" avoids putting signed tokens in URLs. Defaults to "code". */
-  responseType?: "code" | "token";
 }
 
 const DEFAULT_AUTH_URL = "https://auth.uln.industries";
@@ -139,7 +136,7 @@ async function exchangeCodeWithBinding(code: string, redirectOrigin: string, bin
 /**
  * Hono middleware that handles the full auth flow:
  *
- * 1. If `?token=` in URL → validate, set cookie, redirect to clean URL
+ * 1. If `?code=` in URL → exchange for token, set cookie, redirect to clean URL
  * 2. If session cookie present → validate, set `c.get("user")`
  * 3. If unauthenticated → redirect to auth.uln.industries/login
  *
@@ -164,7 +161,6 @@ export function auth(options?: AuthOptions): MiddlewareHandler {
   const authUrl = options?.authUrl ?? DEFAULT_AUTH_URL;
   const cookieName = options?.cookie ?? DEFAULT_COOKIE;
   const maxAge = options?.maxAge ?? DEFAULT_MAX_AGE;
-  const responseType = options?.responseType ?? "code";
   const publicPaths = options?.public ?? [];
   const bindingName = options?.binding;
 
@@ -200,7 +196,7 @@ export function auth(options?: AuthOptions): MiddlewareHandler {
       return next();
     }
 
-    // Step 1: Handle ?code= callback (preferred login redirect landing)
+    // Step 1: Handle ?code= callback (login redirect landing)
     const incomingCode = url.searchParams.get("code");
     if (incomingCode) {
       const token = await exchangeCode(incomingCode, url.origin, c.env as Record<string, unknown>);
@@ -222,26 +218,7 @@ export function auth(options?: AuthOptions): MiddlewareHandler {
       });
     }
 
-    // Step 2: Handle legacy ?token= callback
-    const incomingToken = url.searchParams.get("token");
-    if (incomingToken) {
-      const payload = await validate(incomingToken, c.env as Record<string, unknown>);
-      if (!payload) {
-        return c.text("Invalid token", 401);
-      }
-
-      // Set cookie and redirect to clean URL (strip token param)
-      url.searchParams.delete("token");
-      return new Response(null, {
-        status: 302,
-        headers: {
-          Location: url.toString(),
-          "Set-Cookie": makeSessionCookie(cookieConf, incomingToken),
-        },
-      });
-    }
-
-    // Step 3: Check session cookie
+    // Step 2: Check session cookie
     const cookieHeader = c.req.header("Cookie");
     if (cookieHeader) {
       const token = extractCookie(cookieHeader, cookieName);
@@ -269,7 +246,7 @@ export function auth(options?: AuthOptions): MiddlewareHandler {
     // Step 5: Redirect to login
     const loginUrl = new URL("/login", authUrl);
     loginUrl.searchParams.set("redirect", c.req.url);
-    if (responseType === "code") loginUrl.searchParams.set("response_type", "code");
+    loginUrl.searchParams.set("response_type", "code");
     return c.redirect(loginUrl.toString(), 302);
   };
 }

package/src/middleware.ts

@@ -33,10 +33,10 @@ export async function getAuthUser(
   return validateToken(verifyConfig, token);
 }
 
-export function redirectToLogin(currentUrl: string, responseType: "code" | "token" = "code"): Response {
+export function redirectToLogin(currentUrl: string): Response {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code") loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 
@@ -57,8 +57,8 @@ async function exchangeCode(
 
 /**
  * Handle the auth callback on consuming sites.
- * If the request URL has a `?code=` or legacy `?token=` param, sets a session cookie,
- * and redirects to the same URL without the token param.
+ * If the request URL has a `?code=` param, exchanges it for a token,
+ * sets a session cookie, and redirects to the same URL without the code param.
  * Returns null if there's no callback param.
  */
 export async function handleCallback(
@@ -73,10 +73,10 @@ export async function handleCallback(
     if (!exchangeConfig) return redirectToLogin(url.origin);
 
     const token = await exchangeCode(code, url.origin, exchangeConfig);
-    if (!token) return redirectToLogin(url.origin, "code");
+    if (!token) return redirectToLogin(url.origin);
 
     const payload = await validateToken(verifyConfig, token);
-    if (!payload) return redirectToLogin(url.origin, "code");
+    if (!payload) return redirectToLogin(url.origin);
 
     url.searchParams.delete("code");
     return new Response(null, {
@@ -88,20 +88,5 @@ export async function handleCallback(
     });
   }
 
-  const token = url.searchParams.get("token");
-  if (!token) return null;
-
-  const payload = await validateToken(verifyConfig, token);
-  if (!payload) {
-    return redirectToLogin(url.origin);
-  }
-
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token),
-    },
-  });
+  return null;
 }

package/src/service.ts

@@ -58,12 +58,12 @@ export async function getAuthUser(
 
 /**
  * Redirect to the centralized login page at auth.uln.industries.
- * Requests one-time auth-code callbacks by default so signed tokens are not sent through URLs.
+ * Requests one-time auth-code callbacks so signed tokens are not sent through URLs.
  */
-export function redirectToLogin(currentUrl: string, responseType: "code" | "token" = "code"): Response {
+export function redirectToLogin(currentUrl: string): Response {
   const loginUrl = new URL("/login", "https://auth.uln.industries");
   loginUrl.searchParams.set("redirect", currentUrl);
-  if (responseType === "code") loginUrl.searchParams.set("response_type", "code");
+  loginUrl.searchParams.set("response_type", "code");
   return Response.redirect(loginUrl.toString(), 302);
 }
 
@@ -81,7 +81,6 @@ async function exchangeCode(authService: Fetcher, code: string, redirectOrigin:
 /**
  * Handle an auth callback on a consuming Worker using the auth service binding.
  * Preferred `?code=` callbacks are exchanged for signed tokens before setting the local cookie.
- * Legacy `?token=` callbacks are still accepted during migration and are stripped immediately.
  * Returns null if the request has no auth callback parameters.
  */
 export async function handleCallback(
@@ -94,10 +93,10 @@ export async function handleCallback(
   const code = url.searchParams.get("code");
   if (code) {
     const token = await exchangeCode(authService, code, url.origin);
-    if (!token) return redirectToLogin(url.origin, "code");
+    if (!token) return redirectToLogin(url.origin);
 
     const payload = await verifyToken(authService, token);
-    if (!payload) return redirectToLogin(url.origin, "code");
+    if (!payload) return redirectToLogin(url.origin);
 
     url.searchParams.delete("code");
     return new Response(null, {
@@ -109,18 +108,5 @@ export async function handleCallback(
     });
   }
 
-  const token = url.searchParams.get("token");
-  if (!token) return null;
-
-  const payload = await verifyToken(authService, token);
-  if (!payload) return redirectToLogin(url.origin, "code");
-
-  url.searchParams.delete("token");
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: url.toString(),
-      "Set-Cookie": makeSessionCookie(cookieConfig, token),
-    },
-  });
+  return null;
 }