@zephkelly/nuxt-authkit 0.0.1

package/dist/runtime/strategy/jwt/index.js

@@ -0,0 +1,748 @@
+import { BaseStrategy } from "../base.js";
+import { RESERVED_CLAIMS } from "../../types/token.js";
+import { NitroStorage } from "../../storage/nitro.js";
+import { useRuntimeConfig } from "#imports";
+import { getCookie, setCookie, deleteCookie } from "h3";
+import { timingSafeEqual } from "node:crypto";
+import { consola } from "consola";
+import { JWTCrypto, JWTCryptoError } from "./jwt-crypto.js";
+import { uuidv7 } from "../../utils/uuid.js";
+import { storeContextData, getContextData } from "../../utils/context-helpers.js";
+const ACCESS_TOKEN_LIFETIME_WARN_THRESHOLD = 24 * 60 * 60;
+export class JWTStrategy extends BaseStrategy {
+  jwtCrypto;
+  jwtConfig;
+  constructor(callbacks) {
+    const runtimeConfig = useRuntimeConfig();
+    const defaultConfig = runtimeConfig.nuxtAuthkit.strategy;
+    const fullConfig = {
+      ...defaultConfig,
+      storage: new NitroStorage(
+        // @ts-expect-error
+        useStorage(
+          "nuxt-authkit"
+        )
+      )
+    };
+    super(fullConfig, callbacks);
+    this.jwtConfig = fullConfig;
+    this.assertNoReservedClaims(this.jwtConfig.jwt?.claims);
+    this.jwtCrypto = new JWTCrypto({
+      privateKey: this.jwtConfig.jwt?.privateKey,
+      publicKey: this.jwtConfig.jwt?.publicKey,
+      algorithm: this.jwtConfig.jwt?.algorithm || "RS256"
+    });
+    this.warnOnWeakConfiguration();
+  }
+  async authenticate(credentials, event, options) {
+    if (!event) {
+      throw this.createError(
+        "EVENT_UNAVAILABLE",
+        "Unable to access the current event context"
+      );
+    }
+    try {
+      const authenticationResult = this.getStructuredAuthenticateResult(await this.callbacks.onAuthenticate(
+        credentials,
+        event
+      ));
+      const userIdentifier = authenticationResult?.id;
+      if (!userIdentifier) {
+        return {
+          success: false,
+          error: {
+            code: "INVALID_CREDENTIALS",
+            message: "Invalid credentials",
+            recoverable: true
+          }
+        };
+      }
+      const tokens = await this.generateTokens(
+        userIdentifier,
+        true,
+        authenticationResult?.roles,
+        authenticationResult?.claims,
+        uuidv7(),
+        options
+      );
+      await this.callbacks.onStoreRefreshToken(tokens.refreshToken, userIdentifier, event);
+      if (this.jwtConfig.tokens.refresh?.cookie) {
+        if (!tokens.refreshToken) {
+          throw this.createError(
+            "UNKNOWN_ERROR",
+            "Refresh token creation failed"
+          );
+        }
+        this.issueRefreshHttpOnlyCookie(
+          event,
+          tokens.refreshToken
+        );
+        const result2 = {
+          success: true,
+          tokens: {
+            ...tokens,
+            refreshToken: void 0
+          }
+        };
+        await this.notifyAuthenticated(result2, event);
+        return result2;
+      }
+      const result = {
+        success: true,
+        tokens
+      };
+      await this.notifyAuthenticated(result, event);
+      return result;
+    } catch (error) {
+      return this.handleError(error, event);
+    }
+  }
+  verify(event, options) {
+    try {
+      if (!event) {
+        throw this.createError(
+          "EVENT_UNAVAILABLE",
+          "Unable to access the current event context"
+        );
+      }
+      const isAmbientVerification = !options?.accessToken && !options?.ignoreExpiration;
+      if (isAmbientVerification) {
+        const cached = getContextData(event, "jwt-verify-result");
+        if (cached) {
+          return cached;
+        }
+      }
+      const accessToken = options?.accessToken ? options.accessToken : this.getAuthBearerToken(event);
+      if (!accessToken) {
+        return this.invalidToken("Invalid access token");
+      }
+      const accessPayload = this.decodeToken(accessToken);
+      if (!accessPayload || !accessPayload.sub) {
+        return this.invalidToken("Invalid access token");
+      }
+      const claimError = this.validateClaims(accessPayload, "access", {
+        ignoreExpiration: options?.ignoreExpiration
+      });
+      if (claimError) {
+        return { valid: false, error: claimError };
+      }
+      const shouldRefresh = this.shouldRefreshToken(accessPayload);
+      const response = {
+        valid: true,
+        payload: accessPayload,
+        shouldRefresh
+      };
+      if (isAmbientVerification) {
+        storeContextData(event, "jwt-verify-result", response);
+      }
+      return response;
+    } catch (error) {
+      return {
+        valid: false,
+        error: this.extractAuthError(error)
+      };
+    }
+  }
+  /**
+   * Verify a bare access token, with no request context.
+   *
+   * `verify()` resolves the token from the ambient H3 event, which does not
+   * exist for a WebSocket peer, a queue worker, or a signed asset URL carrying
+   * its own token. Those callers have a token and nothing else, and this is the
+   * entry point for them.
+   *
+   * Claim validation is identical to `verify()` — in particular `typ` must be
+   * `'access'`, so a refresh token cannot be replayed here to open a socket.
+   */
+  verifyToken(accessToken) {
+    try {
+      if (!accessToken) {
+        return this.invalidToken("Invalid access token");
+      }
+      const payload = this.decodeToken(accessToken);
+      if (!payload || !payload.sub) {
+        return this.invalidToken("Invalid access token");
+      }
+      const claimError = this.validateClaims(payload, "access");
+      if (claimError) {
+        return { valid: false, error: claimError };
+      }
+      return {
+        valid: true,
+        payload,
+        shouldRefresh: this.shouldRefreshToken(payload)
+      };
+    } catch (error) {
+      return {
+        valid: false,
+        error: this.extractAuthError(error)
+      };
+    }
+  }
+  /**
+   * Mint a token pair for a user directly, without presenting credentials.
+   *
+   * `authenticate()` is the credential path and always runs `onAuthenticate`.
+   * This is the path for the flows where the app has *already* established who
+   * the user is by some other means — an OAuth callback, an accepted invite, an
+   * admin impersonating a user, a device-linking handshake — and needs to hand
+   * out a session for a subject it chose itself.
+   *
+   * It is a session-minting primitive with no authentication of its own: the
+   * caller is asserting the identity. Never reach it from an unauthenticated
+   * route without first proving the subject some other way.
+   *
+   * Starts a fresh rotation family, so it is a real new session rather than a
+   * graft onto an existing one.
+   */
+  async issueTokens(userId, event, options) {
+    if (!event) {
+      throw this.createError(
+        "EVENT_UNAVAILABLE",
+        "Unable to access the current event context"
+      );
+    }
+    try {
+      const tokens = await this.generateTokens(
+        userId,
+        true,
+        options?.roles,
+        options?.claims,
+        uuidv7(),
+        options
+      );
+      if (!tokens.refreshToken) {
+        throw this.createError(
+          "UNKNOWN_ERROR",
+          "Refresh token creation failed"
+        );
+      }
+      await this.callbacks.onStoreRefreshToken(tokens.refreshToken, userId, event);
+      if (this.jwtConfig.tokens.refresh?.cookie) {
+        this.issueRefreshHttpOnlyCookie(event, tokens.refreshToken);
+        const result2 = {
+          success: true,
+          tokens: {
+            ...tokens,
+            refreshToken: void 0
+          }
+        };
+        await this.notifyAuthenticated(result2, event);
+        return result2;
+      }
+      const result = {
+        success: true,
+        tokens
+      };
+      await this.notifyAuthenticated(result, event);
+      return result;
+    } catch (error) {
+      return this.handleError(error, event);
+    }
+  }
+  async refresh(event, options) {
+    try {
+      if (!event) {
+        throw this.createError(
+          "EVENT_UNAVAILABLE",
+          "Unable to access the current event context"
+        );
+      }
+      const requestedRefreshToken = this.readRefreshHttpOnlyCookie(event);
+      if (!requestedRefreshToken) {
+        return this.invalidRefresh("REFRESH_TOKEN_INVALID", "Invalid refresh token");
+      }
+      const payload = this.decodeToken(requestedRefreshToken);
+      if (!payload || !payload.sub) {
+        return this.invalidRefresh("REFRESH_TOKEN_INVALID", "Invalid refresh token");
+      }
+      const claimError = this.validateClaims(payload, "refresh");
+      if (claimError) {
+        return {
+          success: false,
+          error: {
+            code: claimError.code === "TOKEN_EXPIRED" ? "REFRESH_TOKEN_EXPIRED" : "REFRESH_TOKEN_INVALID",
+            message: claimError.code === "TOKEN_EXPIRED" ? "Refresh token has expired" : "Invalid refresh token",
+            recoverable: false
+          }
+        };
+      }
+      const lookup = this.normaliseRefreshLookup(
+        await this.callbacks.onGetRefreshToken(requestedRefreshToken, payload.sub, event),
+        requestedRefreshToken
+      );
+      if (!lookup.valid) {
+        if (lookup.gracePeriodRace) {
+          return {
+            success: false,
+            error: {
+              code: "REFRESH_TOKEN_RACE",
+              message: "Refresh token was rotated by a concurrent request. Retry.",
+              recoverable: true
+            }
+          };
+        }
+        if (lookup.reused && payload.family && this.callbacks.onRevokeTokenFamily) {
+          consola.warn(
+            `[nuxt-authkit] Refresh token reuse detected for user ${payload.sub} (family ${payload.family}). Revoking family.`
+          );
+          await this.callbacks.onRevokeTokenFamily(payload.family, payload.sub, event);
+        }
+        if (this.jwtConfig.tokens.refresh?.cookie) {
+          this.revokeRefreshHttpOnlyCookie(event);
+        }
+        return this.invalidRefresh("REFRESH_TOKEN_INVALID", "Invalid refresh token");
+      }
+      const roles = await this.resolveRolesForRefresh(lookup, payload, event);
+      const claims = lookup.claims ?? this.extractCustomClaims(payload);
+      const shouldRotate = this.shouldRotate(options);
+      const family = payload.family || uuidv7();
+      const tokens = await this.generateTokens(
+        payload.sub,
+        shouldRotate,
+        roles,
+        claims,
+        family,
+        lookup.refreshExpiresIn ? { refreshExpiresIn: lookup.refreshExpiresIn } : void 0
+      );
+      if (shouldRotate && tokens.refreshToken) {
+        await this.callbacks.onStoreRefreshToken(tokens.refreshToken, payload.sub, event);
+        await this.removeStoredRefreshToken(requestedRefreshToken, payload.sub, event);
+        if (this.jwtConfig.tokens.refresh?.cookie) {
+          this.issueRefreshHttpOnlyCookie(event, tokens.refreshToken);
+          const result2 = {
+            success: true,
+            tokens: {
+              ...tokens,
+              refreshToken: void 0
+            }
+          };
+          await this.notifyTokenRefreshed(result2, event);
+          return result2;
+        }
+      }
+      const result = {
+        success: true,
+        tokens
+      };
+      await this.notifyTokenRefreshed(result, event);
+      return result;
+    } catch (error) {
+      return this.handleError(error, event);
+    }
+  }
+  async revoke(event) {
+    if (!event) {
+      throw this.createError(
+        "EVENT_UNAVAILABLE",
+        "Unable to access the current event context"
+      );
+    }
+    const requestedRefreshToken = this.readRefreshHttpOnlyCookie(event);
+    if (this.jwtConfig.tokens.refresh?.cookie) {
+      this.revokeRefreshHttpOnlyCookie(event);
+    }
+    if (!requestedRefreshToken) {
+      return;
+    }
+    const payload = this.decodeToken(requestedRefreshToken);
+    if (!payload || !payload.sub) {
+      return;
+    }
+    await this.removeStoredRefreshToken(requestedRefreshToken, payload.sub, event);
+    await this.notifyLogout(payload.sub, event);
+  }
+  /**
+   * Server-initiated revocation (admin force-logout, scheduled cleanup...).
+   *
+   * Throws when no `onRevokeServer` callback is configured. Only the app knows
+   * where its tokens live, so there is nothing this can do on its own — and
+   * reporting success while doing nothing is worse than failing.
+   */
+  async revokeServer(options, event) {
+    if (!this.callbacks.onRevokeServer) {
+      throw this.createError(
+        "UNKNOWN_ERROR",
+        "[nuxt-authkit] revokeServer() was called but no onRevokeServer callback is configured. Implement onRevokeServer in createJWTStrategy() to delete the relevant refresh tokens from your store.",
+        void 0,
+        false
+      );
+    }
+    await this.callbacks.onRevokeServer(options, event);
+  }
+  // ========== Claim validation ==========
+  /**
+   * Decide whether a payload is an access or a refresh token.
+   *
+   * `typ` is mandatory: a token that does not say what it is, is not usable as
+   * anything. Both kinds are signed with the same key, so this claim is the only
+   * thing preventing a refresh token from being replayed as a 7-day Bearer
+   * session. There is deliberately no fallback for tokens minted before the claim
+   * existed — they are rejected, which logs their holders out once.
+   */
+  resolveTokenUse(payload) {
+    if (payload.typ === "access" || payload.typ === "refresh") {
+      return payload.typ;
+    }
+    return "unknown";
+  }
+  validateClaims(payload, expectedUse, options) {
+    if (this.resolveTokenUse(payload) !== expectedUse) {
+      return {
+        code: "TOKEN_INVALID",
+        message: `Invalid token: expected a ${expectedUse} token`,
+        recoverable: false
+      };
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options?.ignoreExpiration) {
+      if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
+        return {
+          code: "TOKEN_EXPIRED",
+          message: "Token has no valid expiry",
+          recoverable: false
+        };
+      }
+      if (payload.exp < now) {
+        return {
+          code: "TOKEN_EXPIRED",
+          message: "Token has expired",
+          recoverable: false
+        };
+      }
+    }
+    if (typeof payload.nbf === "number" && Number.isFinite(payload.nbf) && payload.nbf > now) {
+      return {
+        code: "TOKEN_INVALID",
+        message: "Token is not yet valid",
+        recoverable: false
+      };
+    }
+    const issuer = this.jwtConfig.jwt?.issuer;
+    if (issuer && payload.iss !== issuer) {
+      return {
+        code: "TOKEN_INVALID",
+        message: "Token issuer mismatch",
+        recoverable: false
+      };
+    }
+    const audience = this.jwtConfig.jwt?.audience;
+    if (audience && !this.audienceMatches(payload.aud, audience)) {
+      return {
+        code: "TOKEN_INVALID",
+        message: "Token audience mismatch",
+        recoverable: false
+      };
+    }
+    return null;
+  }
+  /** `aud` is `string | string[]` on both sides; they match if they intersect. */
+  audienceMatches(tokenAudience, configuredAudience) {
+    if (tokenAudience === void 0) {
+      return false;
+    }
+    const tokenValues = Array.isArray(tokenAudience) ? tokenAudience : [tokenAudience];
+    const configuredValues = Array.isArray(configuredAudience) ? configuredAudience : [configuredAudience];
+    return tokenValues.some((value) => configuredValues.includes(value));
+  }
+  // ========== Refresh helpers ==========
+  shouldRotate(options) {
+    if (!this.jwtConfig.tokens.refresh) {
+      return false;
+    }
+    if (typeof options?.rotate === "boolean") {
+      return options.rotate;
+    }
+    if (typeof options?.refreshToken === "boolean") {
+      return options.refreshToken;
+    }
+    return this.jwtConfig.tokens.refresh.rotate !== false;
+  }
+  /**
+   * Accepts the legacy `string | null` return as well as the richer
+   * {@link RefreshTokenLookup}, so existing callbacks keep working unchanged.
+   */
+  normaliseRefreshLookup(result, presentedToken) {
+    if (result === null || result === void 0) {
+      return { valid: false };
+    }
+    if (typeof result === "string") {
+      return { valid: this.constantTimeEquals(result, presentedToken) };
+    }
+    return result;
+  }
+  async resolveRolesForRefresh(lookup, payload, event) {
+    if (lookup.roles) {
+      return lookup.roles;
+    }
+    if (this.callbacks.onGetRoles && payload.sub) {
+      return await this.callbacks.onGetRoles(payload.sub, event);
+    }
+    return payload.roles;
+  }
+  async removeStoredRefreshToken(refreshToken, identifier, event) {
+    if (!this.callbacks.onRemoveRefreshToken) {
+      return;
+    }
+    try {
+      await this.callbacks.onRemoveRefreshToken(refreshToken, identifier, event);
+    } catch (error) {
+      consola.error("[nuxt-authkit] Error in onRemoveRefreshToken callback:", error);
+      throw error;
+    }
+  }
+  constantTimeEquals(a, b) {
+    const bufferA = Buffer.from(a, "utf8");
+    const bufferB = Buffer.from(b, "utf8");
+    if (bufferA.length !== bufferB.length) {
+      return false;
+    }
+    return timingSafeEqual(bufferA, bufferB);
+  }
+  // ========== Token Management ==========
+  async generateTokens(userId, includeRefreshToken, roles, claims, family, options) {
+    const now = Math.floor(Date.now() / 1e3);
+    const accessExpiresIn = options?.accessExpiresIn ? options.accessExpiresIn : this.jwtConfig.tokens.access.expiresIn;
+    if (accessExpiresIn > ACCESS_TOKEN_LIFETIME_WARN_THRESHOLD) {
+      consola.warn(
+        `[nuxt-authkit] Access token lifetime is ${accessExpiresIn}s (> 24h). Access tokens cannot be revoked before they expire \u2014 check this is seconds, not milliseconds.`
+      );
+    }
+    const accessPayload = {
+      ...this.jwtConfig.jwt?.claims,
+      ...this.stripReservedClaims(claims),
+      sub: userId,
+      typ: "access",
+      iat: now,
+      exp: now + accessExpiresIn,
+      ...roles !== void 0 && { roles },
+      ...this.jwtConfig.jwt?.issuer && {
+        iss: this.jwtConfig.jwt.issuer
+      },
+      ...this.jwtConfig.jwt?.audience && {
+        aud: this.jwtConfig.jwt.audience
+      }
+    };
+    const newAccessToken = this.encodeToken(accessPayload);
+    if (!newAccessToken) {
+      throw this.createError(
+        "UNKNOWN_ERROR",
+        "Access token creation failed"
+      );
+    }
+    if (includeRefreshToken) {
+      const refreshExpiresIn = options?.refreshExpiresIn ? options.refreshExpiresIn : this.jwtConfig.tokens.refresh?.expiresIn ?? 0;
+      const refreshPayload = refreshExpiresIn ? {
+        sub: userId,
+        typ: "refresh",
+        iat: now,
+        exp: now + refreshExpiresIn,
+        jti: uuidv7(),
+        family: family || uuidv7(),
+        // Carried so roles survive rotation even without an onGetRoles callback.
+        ...roles !== void 0 && { roles },
+        ...this.jwtConfig.jwt?.issuer && {
+          iss: this.jwtConfig.jwt.issuer
+        },
+        ...this.jwtConfig.jwt?.audience && {
+          aud: this.jwtConfig.jwt.audience
+        }
+      } : null;
+      const newRefreshToken = refreshPayload ? this.encodeToken(refreshPayload) : void 0;
+      if (!newRefreshToken) {
+        throw this.createError(
+          "UNKNOWN_ERROR",
+          "Refresh token creation failed"
+        );
+      }
+      return {
+        accessToken: newAccessToken,
+        refreshToken: newRefreshToken,
+        expiresAt: (now + accessExpiresIn) * 1e3,
+        expiresIn: accessExpiresIn,
+        tokenType: "Bearer"
+      };
+    }
+    return {
+      accessToken: newAccessToken,
+      expiresAt: (now + accessExpiresIn) * 1e3,
+      expiresIn: accessExpiresIn,
+      tokenType: "Bearer"
+    };
+  }
+  /**
+   * Carry an existing token's custom claims through rotation, dropping the
+   * reserved ones (which are always recomputed).
+   */
+  extractCustomClaims(payload) {
+    return this.stripReservedClaims(payload) ?? {};
+  }
+  stripReservedClaims(claims) {
+    if (!claims) {
+      return void 0;
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(claims)) {
+      if (!RESERVED_CLAIMS.includes(key) && value !== void 0) {
+        result[key] = value;
+      }
+    }
+    return result;
+  }
+  /**
+   * Static `jwt.claims` that collide with a computed claim are a configuration
+   * error, not something to silently drop: a stray `exp` there would otherwise
+   * have minted never-expiring tokens app-wide.
+   */
+  assertNoReservedClaims(claims) {
+    if (!claims) {
+      return;
+    }
+    const offending = Object.keys(claims).filter(
+      (key) => RESERVED_CLAIMS.includes(key)
+    );
+    if (offending.length > 0) {
+      throw new Error(
+        `[nuxt-authkit] jwt.claims may not contain the reserved claim(s): ${offending.join(", ")}. These are computed per request. Reserved claims: ${RESERVED_CLAIMS.join(", ")}.`
+      );
+    }
+  }
+  warnOnWeakConfiguration() {
+    if (!this.callbacks.onRemoveRefreshToken) {
+      consola.warn(
+        "[nuxt-authkit] No onRemoveRefreshToken callback configured. Refresh tokens cannot be deleted from your store, so logout and rotation will not invalidate them server-side \u2014 a leaked refresh token stays valid until it expires."
+      );
+    }
+    if (!this.callbacks.onGetRoles) {
+      consola.warn(
+        "[nuxt-authkit] No onGetRoles callback configured. Roles are carried forward from the refresh token, so a role change or a ban will not take effect until the user logs in again."
+      );
+    }
+    const cookie = this.jwtConfig.tokens.refresh?.cookie;
+    if (cookie && cookie.secure === false && process.env.NODE_ENV === "production") {
+      consola.warn(
+        "[nuxt-authkit] The refresh cookie is configured with secure:false in production. It will be sent over plaintext HTTP."
+      );
+    }
+  }
+  encodeToken(payload) {
+    return this.jwtCrypto.sign(payload);
+  }
+  /**
+   * Verify and decode a token.
+   *
+   * Returns `null` for any cryptographically-invalid token — malformed, bad
+   * signature, wrong algorithm. The distinction is logged server-side but never
+   * surfaced to the caller, so it cannot become an error oracle, and callers get
+   * a single unambiguous "invalid" they can fail closed on.
+   */
+  decodeToken(token) {
+    try {
+      return this.jwtCrypto.verify(token);
+    } catch (error) {
+      if (error instanceof JWTCryptoError) {
+        consola.debug(`[nuxt-authkit] Token rejected (${error.code}): ${error.message}`);
+        return null;
+      }
+      throw error;
+    }
+  }
+  invalidToken(message) {
+    return {
+      valid: false,
+      error: {
+        code: "TOKEN_INVALID",
+        message,
+        recoverable: false
+      }
+    };
+  }
+  invalidRefresh(code, message) {
+    return {
+      success: false,
+      error: {
+        code,
+        message,
+        recoverable: false
+      }
+    };
+  }
+  shouldRefreshToken(payload) {
+    if (!this.jwtConfig.autoRefresh?.enabled || !payload.exp) {
+      return false;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const beforeExpiry = this.jwtConfig.autoRefresh.beforeExpiry;
+    return payload.exp - now <= beforeExpiry;
+  }
+  async notifyTokenRefreshed(result, event) {
+    if (this.callbacks.onTokenRefreshed && result.tokens) {
+      try {
+        await this.callbacks.onTokenRefreshed(result.tokens, event);
+      } catch (error) {
+        consola.error("[nuxt-authkit] Error in onTokenRefreshed callback:", error);
+      }
+    }
+  }
+  // ========== Cookie handling ==========
+  readRefreshHttpOnlyCookie(event) {
+    const cookieName = this.jwtConfig.tokens.refresh?.cookie?.name || "refreshToken";
+    return getCookie(event, cookieName) || null;
+  }
+  revokeRefreshHttpOnlyCookie(event) {
+    const cookieName = this.jwtConfig.tokens.refresh?.cookie?.name || "refreshToken";
+    deleteCookie(event, cookieName, this.resolveRefreshCookieOptions(event));
+  }
+  issueRefreshHttpOnlyCookie(event, refreshToken) {
+    const cookieName = this.jwtConfig.tokens.refresh?.cookie?.name || "refreshToken";
+    setCookie(event, cookieName, refreshToken, this.resolveRefreshCookieOptions(event));
+  }
+  /**
+   * `httpOnly` is forced on rather than merged in. These helpers are named for a
+   * guarantee, and a refresh token readable from JavaScript is exactly the
+   * credential this design exists to keep out of reach.
+   *
+   * The domain is resolved per request when `onResolveCookieDomain` is supplied:
+   * one API can serve clients on several registrable domains, and a static
+   * `cookie.domain` can only ever satisfy one of them. Deletion resolves the
+   * domain the same way — a cookie set on one domain cannot be cleared by a
+   * Set-Cookie scoped to another.
+   */
+  resolveRefreshCookieOptions(event) {
+    const options = {
+      ...this.jwtConfig.tokens.refresh?.cookie,
+      name: void 0,
+      httpOnly: true
+    };
+    if (event && this.callbacks.onResolveCookieDomain) {
+      const resolvedDomain = this.callbacks.onResolveCookieDomain(event);
+      if (resolvedDomain) {
+        options.domain = resolvedDomain;
+      }
+    }
+    return options;
+  }
+  /**
+   * RFC 7235 makes the auth-scheme case-insensitive, and an anchored match keeps
+   * a header without the scheme from being returned verbatim as a "token".
+   */
+  getAuthBearerToken(event) {
+    const rawHeader = event.node.req.headers["authorization"];
+    const authHeader = Array.isArray(rawHeader) ? rawHeader[0] : rawHeader;
+    if (!authHeader) {
+      return null;
+    }
+    const separatorIndex = authHeader.indexOf(" ");
+    if (separatorIndex === -1) {
+      return null;
+    }
+    const scheme = authHeader.slice(0, separatorIndex);
+    if (scheme.toLowerCase() !== "bearer") {
+      return null;
+    }
+    return authHeader.slice(separatorIndex + 1).trim() || null;
+  }
+}
+export function createJWTStrategy(callbacks) {
+  return new JWTStrategy(callbacks);
+}