@v8r/auth 0.0.0-stage → 0.1.1

package/dist/client-id.d.ts

@@ -0,0 +1,3 @@
+export declare const CLIENT_ID_LENGTH = 32;
+export declare function clientIdFor(namespace: string): string;
+export declare function namespaceFromClientId(clientId: string): string | null;

package/dist/client-id.js

@@ -0,0 +1,21 @@
+export const CLIENT_ID_LENGTH = 32;
+const NAMESPACE_PATTERN = /^[a-z0-9][a-z0-9-]{1,30}$/;
+export function clientIdFor(namespace) {
+    if (!NAMESPACE_PATTERN.test(namespace)) {
+        throw new Error("Invalid namespace.");
+    }
+    return namespace.padEnd(CLIENT_ID_LENGTH, "_");
+}
+export function namespaceFromClientId(clientId) {
+    if (clientId.length !== CLIENT_ID_LENGTH || !clientId.endsWith("_")) {
+        return null;
+    }
+    const namespace = clientId.replace(/_+$/u, "");
+    if (!NAMESPACE_PATTERN.test(namespace)) {
+        return null;
+    }
+    if (clientIdFor(namespace) !== clientId) {
+        return null;
+    }
+    return namespace;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { CLIENT_ID_LENGTH, clientIdFor, namespaceFromClientId, } from "./client-id.js";
+export { PRODUCTION_CONTROL_PLANE, PRODUCTION_ISSUER, getCdnCredentials, jwksFor, verifyIdToken, type V8rUser, } from "./verify.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export { CLIENT_ID_LENGTH, clientIdFor, namespaceFromClientId, } from "./client-id.js";
+export { PRODUCTION_CONTROL_PLANE, PRODUCTION_ISSUER, getCdnCredentials, jwksFor, verifyIdToken, } from "./verify.js";

package/dist/next.d.ts

@@ -0,0 +1,22 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { type V8rUser } from "./verify.js";
+export type V8rAuthConfig = {
+    namespace: string;
+    token: string;
+    issuer?: string;
+    controlPlaneOrigin?: string;
+};
+export declare function createV8rAuth(config: V8rAuthConfig): {
+    clientId: string;
+    getUser: () => Promise<V8rUser | null>;
+    handlers: {
+        GET: (request: NextRequest) => Promise<NextResponse<unknown>>;
+        POST: (request: NextRequest) => Promise<NextResponse<unknown>>;
+    };
+    signIn(): never;
+    signOut(): never;
+    getCdnCredentials(options?: {
+        ttlSeconds?: number;
+        paths?: string[];
+    }): Promise<Record<string, unknown>>;
+};

package/dist/next.js

@@ -0,0 +1,221 @@
+import { createHash, randomBytes } from "node:crypto";
+import { EncryptJWT, jwtDecrypt } from "jose";
+import { cookies } from "next/headers";
+import { redirect } from "next/navigation";
+import { NextResponse } from "next/server";
+import { clientIdFor } from "./client-id.js";
+import { PRODUCTION_CONTROL_PLANE, PRODUCTION_ISSUER, getCdnCredentials, jwksFor, verifyIdToken, } from "./verify.js";
+const SESSION_COOKIE = "v8r_session";
+const PKCE_COOKIE = "v8r_pkce";
+const SCOPES = "openid profile email offline_access";
+function keyFor(token) {
+    return createHash("sha256").update(token).digest();
+}
+function base64Url(bytes) {
+    return bytes
+        .toString("base64")
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+async function seal(token, payload) {
+    return new EncryptJWT(payload)
+        .setProtectedHeader({ alg: "dir", enc: "A256GCM" })
+        .setIssuedAt()
+        .setExpirationTime("30d")
+        .encrypt(keyFor(token));
+}
+async function open(token, sealed) {
+    try {
+        const { payload } = await jwtDecrypt(sealed, keyFor(token));
+        if (typeof payload.refreshToken !== "string" ||
+            typeof payload.idToken !== "string") {
+            return null;
+        }
+        return { refreshToken: payload.refreshToken, idToken: payload.idToken };
+    }
+    catch {
+        return null;
+    }
+}
+function cookieOptions(maxAge) {
+    return {
+        httpOnly: true,
+        sameSite: "lax",
+        secure: process.env.NODE_ENV === "production",
+        path: "/",
+        maxAge,
+    };
+}
+function requestOrigin(request) {
+    const proto = request.headers.get("x-forwarded-proto") ??
+        request.nextUrl.protocol.replace(":", "");
+    const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+    return `${proto}://${host}`;
+}
+async function exchange(issuer, body) {
+    const response = await fetch(`${issuer}/oauth2/token`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    return (await response.json());
+}
+export function createV8rAuth(config) {
+    const clientId = clientIdFor(config.namespace);
+    const issuer = config.issuer ?? PRODUCTION_ISSUER;
+    const controlPlaneOrigin = config.controlPlaneOrigin ?? PRODUCTION_CONTROL_PLANE;
+    async function readSession() {
+        const jar = await cookies();
+        const sealed = jar.get(SESSION_COOKIE)?.value;
+        if (!sealed) {
+            return null;
+        }
+        return open(config.token, sealed);
+    }
+    async function writeSession(jar, payload) {
+        jar.set(SESSION_COOKIE, await seal(config.token, payload), cookieOptions(60 * 60 * 24 * 30));
+    }
+    async function canWriteCookies(jar, current) {
+        try {
+            if (current) {
+                jar.set(SESSION_COOKIE, current, cookieOptions(60 * 60 * 24 * 30));
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async function userFromIdToken(idToken) {
+        return verifyIdToken(idToken, {
+            issuer,
+            audience: clientId,
+            key: jwksFor(issuer),
+        });
+    }
+    async function refresh(session) {
+        const tokens = await exchange(issuer, new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: session.refreshToken,
+            client_id: clientId,
+            client_secret: config.token,
+        }));
+        if (!tokens.id_token || !tokens.refresh_token) {
+            return null;
+        }
+        return { idToken: tokens.id_token, refreshToken: tokens.refresh_token };
+    }
+    async function getUser() {
+        const session = await readSession();
+        if (!session) {
+            return null;
+        }
+        try {
+            const user = await userFromIdToken(session.idToken);
+            const payload = JSON.parse(Buffer.from(session.idToken.split(".")[1] ?? "", "base64url").toString());
+            const exp = payload.exp ?? 0;
+            if (exp * 1000 - Date.now() > 60_000) {
+                return user;
+            }
+            const jar = await cookies();
+            if (!(await canWriteCookies(jar, jar.get(SESSION_COOKIE)?.value))) {
+                return exp * 1000 > Date.now() ? user : null;
+            }
+            const next = await refresh(session);
+            if (!next) {
+                return exp * 1000 > Date.now() ? user : null;
+            }
+            await writeSession(jar, next);
+            return userFromIdToken(next.idToken);
+        }
+        catch {
+            return null;
+        }
+    }
+    async function GET(request) {
+        const path = request.nextUrl.pathname;
+        if (path.endsWith("/sign-in")) {
+            const verifier = base64Url(randomBytes(32));
+            const challenge = base64Url(createHash("sha256").update(verifier).digest());
+            const state = base64Url(randomBytes(16));
+            const redirectUri = `${requestOrigin(request)}/api/v8r/callback`;
+            const authorize = new URL(`${issuer}/oauth2/authorize`);
+            authorize.searchParams.set("response_type", "code");
+            authorize.searchParams.set("client_id", clientId);
+            authorize.searchParams.set("redirect_uri", redirectUri);
+            authorize.searchParams.set("scope", SCOPES);
+            authorize.searchParams.set("state", state);
+            authorize.searchParams.set("code_challenge", challenge);
+            authorize.searchParams.set("code_challenge_method", "S256");
+            const response = NextResponse.redirect(authorize);
+            response.cookies.set(PKCE_COOKIE, JSON.stringify({ verifier, state, redirectUri }), cookieOptions(600));
+            return response;
+        }
+        if (path.endsWith("/callback")) {
+            const jar = await cookies();
+            const stored = jar.get(PKCE_COOKIE)?.value;
+            const code = request.nextUrl.searchParams.get("code");
+            const state = request.nextUrl.searchParams.get("state");
+            if (!stored || !code || !state) {
+                return NextResponse.redirect(new URL("/", request.url));
+            }
+            const pkce = JSON.parse(stored);
+            if (pkce.state !== state) {
+                return NextResponse.redirect(new URL("/", request.url));
+            }
+            const tokens = await exchange(issuer, new URLSearchParams({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: pkce.redirectUri,
+                client_id: clientId,
+                client_secret: config.token,
+                code_verifier: pkce.verifier,
+            }));
+            const response = NextResponse.redirect(new URL("/", request.url));
+            response.cookies.delete(PKCE_COOKIE);
+            if (tokens.id_token && tokens.refresh_token) {
+                response.cookies.set(SESSION_COOKIE, await seal(config.token, {
+                    idToken: tokens.id_token,
+                    refreshToken: tokens.refresh_token,
+                }), cookieOptions(60 * 60 * 24 * 30));
+            }
+            return response;
+        }
+        if (path.endsWith("/sign-out")) {
+            const session = await readSession();
+            const response = NextResponse.redirect(session
+                ? `${issuer}/oauth2/end-session?${new URLSearchParams({
+                    id_token_hint: session.idToken,
+                    post_logout_redirect_uri: `${requestOrigin(request)}/`,
+                    client_id: clientId,
+                })}`
+                : new URL("/", request.url));
+            response.cookies.delete(SESSION_COOKIE);
+            return response;
+        }
+        return NextResponse.json({ error: "Not found." }, { status: 404 });
+    }
+    return {
+        clientId,
+        getUser,
+        handlers: {
+            GET,
+            POST: GET,
+        },
+        signIn() {
+            redirect("/api/v8r/sign-in");
+        },
+        signOut() {
+            redirect("/api/v8r/sign-out");
+        },
+        getCdnCredentials(options) {
+            return getCdnCredentials({
+                token: config.token,
+                controlPlaneOrigin,
+                ttlSeconds: options?.ttlSeconds,
+                paths: options?.paths,
+            });
+        },
+    };
+}

package/dist/verify.d.ts

@@ -0,0 +1,22 @@
+import { type JWTVerifyGetKey } from "jose";
+export declare const PRODUCTION_ISSUER = "https://auth.v8r.app/api/id";
+export declare const PRODUCTION_CONTROL_PLANE = "https://www.v8r.dev";
+export type V8rUser = {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    name: string | null;
+    image: string | null;
+};
+export declare function verifyIdToken(token: string, options: {
+    issuer: string;
+    audience: string;
+    key: JWTVerifyGetKey;
+}): Promise<V8rUser>;
+export declare function jwksFor(issuer: string): import("jose").RemoteJWKSet;
+export declare function getCdnCredentials(options: {
+    token: string;
+    controlPlaneOrigin?: string;
+    ttlSeconds?: number;
+    paths?: string[];
+}): Promise<Record<string, unknown>>;

package/dist/verify.js

@@ -0,0 +1,47 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+export const PRODUCTION_ISSUER = "https://auth.v8r.app/api/id";
+export const PRODUCTION_CONTROL_PLANE = "https://www.v8r.dev";
+export async function verifyIdToken(token, options) {
+    const { payload } = await jwtVerify(token, options.key, {
+        issuer: options.issuer,
+        audience: options.audience,
+    });
+    if (!payload.sub) {
+        throw new Error("ID token is missing sub.");
+    }
+    return {
+        id: payload.sub,
+        email: typeof payload.email === "string" ? payload.email : "",
+        emailVerified: payload.email_verified === true,
+        name: typeof payload.name === "string" ? payload.name : null,
+        image: typeof payload.picture === "string" ? payload.picture : null,
+    };
+}
+const jwksCache = new Map();
+export function jwksFor(issuer) {
+    const existing = jwksCache.get(issuer);
+    if (existing) {
+        return existing;
+    }
+    const jwks = createRemoteJWKSet(new URL(`${issuer}/jwks`));
+    jwksCache.set(issuer, jwks);
+    return jwks;
+}
+export async function getCdnCredentials(options) {
+    const origin = options.controlPlaneOrigin ?? PRODUCTION_CONTROL_PLANE;
+    const response = await fetch(`${origin}/api/cdn/credentials`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${options.token}`,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({
+            ttlSeconds: options.ttlSeconds,
+            paths: options.paths,
+        }),
+    });
+    if (!response.ok) {
+        throw new Error(`CDN credentials failed (${response.status}).`);
+    }
+    return response.json();
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@v8r/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "private": false,
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/patrickhulce/v8r.dev.git",
+    "directory": "packages/auth"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    }
+  },
+  "dependencies": {
+    "jose": "^6.2.12"
+  },
+  "peerDependencies": {
+    "next": ">=16"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "@types/react": "^19",
+    "next": "16.3.1",
+    "react": "19.2.8",
+    "tsx": "^4.23.12",
+    "typescript": "^5"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsx --test \"src/**/*.test.ts\""
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.