@usegraft/auth 0.1.1 → 0.2.0

package/README.md

@@ -0,0 +1,47 @@
+# @usegraft/auth
+
+> Graft verifies identity; it does not mint it. Turn a request into a scoped actor by verifying bearer JWTs against trusted issuers.
+
+Part of [Graft](https://github.com/AndersonDesign1/graft), a CMS built so an AI agent is the primary operator.
+
+## Install
+
+```bash
+npm i @usegraft/auth
+```
+
+## Resolve an actor
+
+```ts
+import { createActorResolver, betterAuthIssuer } from "@usegraft/auth";
+
+const resolveActor = createActorResolver({
+  issuers: [betterAuthIssuer("https://example.com")],
+});
+```
+
+Hand that to `graft serve`, the MCP handler, or the functions handler. It verifies the bearer JWT against the issuer's JWKS via OIDC discovery and returns a `FunctionActor` carrying a stable id and the scopes from the standard `scope` claim.
+
+Because it verifies rather than issues, an external IdP drops in unchanged. A Better Auth instance your app hosts and an enterprise IdP take the same path.
+
+## Require scopes
+
+```ts
+import { requireScopes } from "@usegraft/auth";
+
+export const listSubmissions = defineFunction({
+  name: "listSubmissions",
+  authorize: requireScopes("submissions:read"),
+  // …
+});
+```
+
+Being signed in earns nothing. An account gets scopes because something granted them, which is the whole point: open sign-up plus implicit scopes means one free registration reads everything.
+
+## Environment
+
+`GRAFT_TRUSTED_ISSUERS` for OIDC issuers, `GRAFT_DEV_TOKEN` and `GRAFT_DEV_SCOPES` for a static local identity. Anonymous MCP is refused unless `GRAFT_MCP_ALLOW_ANONYMOUS=1`, which nothing sets for you.
+
+---
+
+MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/feat/core/packages/auth/CHANGELOG.md) · [Security policy](https://github.com/AndersonDesign1/graft/blob/feat/core/SECURITY.md)

package/dist/index.js

@@ -58,12 +58,20 @@ var IssuerVerifier = class {
     try {
       ({ payload } = await jwtVerify(token, getKey, {
         issuer: this.config.issuer,
-        audience: this.config.audience
+        audience: this.config.audience,
+        // jose treats `sub` as optional, so a signature-valid token without one
+        // used to authenticate as an actor with `id: undefined` — which then
+        // collapsed into an IP-keyed rate bucket, wrote null actor ids to the
+        // audit log, and filed approvals nobody could be held to.
+        requiredClaims: ["sub"]
       }));
     } catch (err) {
       const code = err.code ?? "verification failed";
       throw tokenInvalid(`${code} (issuer "${this.config.issuer}")`);
     }
+    if (payload.sub === void 0) {
+      throw tokenInvalid(`token carries no "sub" claim (issuer "${this.config.issuer}")`);
+    }
     return {
       kind: this.config.actorKind ?? "agent",
       id: payload.sub,

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "@usegraft/auth",
-  "version": "0.1.1",
+  "version": "0.2.0",
+  "description": "Turn a request into a scoped actor by verifying bearer JWTs against trusted OIDC issuers. Graft verifies identity, it does not mint it.",
+  "keywords": [
+    "agent",
+    "ai",
+    "auth",
+    "better-auth",
+    "cms",
+    "graft",
+    "headless-cms",
+    "jwt",
+    "mcp",
+    "oidc",
+    "scopes",
+    "typescript"
+  ],
+  "homepage": "https://github.com/AndersonDesign1/graft#readme",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -24,8 +40,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@usegraft/contracts": "0.1.1",
-    "@usegraft/core": "0.1.1",
+    "@usegraft/contracts": "0.2.0",
+    "@usegraft/core": "0.2.0",
     "jose": "^6.0.0"
   },
   "engines": {
@@ -35,7 +51,6 @@
     "build": "tsup src/index.ts --format esm --dts --clean",
     "dev": "tsup src/index.ts --format esm --watch",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "lint": "oxlint ."
+    "test": "vitest run"
   }
 }