@~lyre/auth 0.0.6 → 0.0.8

package/dist/{chunk-RADVGFYQ.js → chunk-2FSPKJAC.js}

@@ -242,6 +242,46 @@ function readCookie(cookieHeader, name) {
   }
   return null;
 }
+function serviceKeyFromRequest(request) {
+  const explicit = request.headers.get("x-api-key");
+  if (explicit && explicit.trim()) return explicit.trim();
+  const auth = request.headers.get("authorization");
+  if (auth && auth.startsWith("Bearer ")) {
+    const token = auth.slice(7).trim();
+    if (token.startsWith("sk_")) return token;
+  }
+  return null;
+}
+async function introspectServiceKey(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!input.key || !base) return null;
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/service-keys/introspect", base), {
+      method: "POST",
+      headers: { "x-api-key": input.key, accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data.valid || !data.keyId) return null;
+    const accessibleApps = (data.accessibleApps ?? []).filter(
+      (a) => Boolean(a) && typeof a.id === "string" && typeof a.slug === "string"
+    ).map((a) => ({ id: a.id, slug: a.slug, name: a.name }));
+    return {
+      keyId: data.keyId,
+      tenantId: data.tenantId ?? null,
+      scopes: Array.isArray(data.scopes) ? data.scopes : [],
+      accessibleApps,
+      expiresAt: data.expiresAt ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+function scopeSatisfied(granted, required) {
+  if (!granted || granted.length === 0) return false;
+  return granted.includes(required);
+}
 
 export {
   createAccountsClientConfig,
@@ -253,5 +293,8 @@ export {
   identityPassthroughSync,
   resolveActiveTenant,
   readPlatformSessionCookie,
-  clearPlatformSessionCookie
+  clearPlatformSessionCookie,
+  serviceKeyFromRequest,
+  introspectServiceKey,
+  scopeSatisfied
 };

package/dist/index.d.ts

@@ -142,5 +142,26 @@ type CookieOptions = {
     secure?: boolean;
 };
 declare function clearPlatformSessionCookie(opts?: CookieOptions): string;
+type ServiceKeyApp = {
+    id: string;
+    slug: string;
+    name?: string;
+};
+type ServiceKeyContext = {
+    keyId: string;
+    tenantId: string | null;
+    /** Scopes granted to this key (opaque strings owned by the consuming app). */
+    scopes: string[];
+    /** Apps this key may act on (auth resolves these from the key's app grant). */
+    accessibleApps: ServiceKeyApp[];
+    expiresAt: string | null;
+};
+declare function serviceKeyFromRequest(request: Request): string | null;
+declare function introspectServiceKey(input: {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    key: string;
+    fetchImpl?: typeof fetch;
+}): Promise<ServiceKeyContext | null>;
+declare function scopeSatisfied(granted: string[] | undefined, required: string): boolean;
 
-export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, readPlatformSessionCookie, resolveActiveTenant, syncAccountsUser };
+export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser };

package/dist/index.js

@@ -6,10 +6,13 @@ import {
   exchangeAuthorizationCode,
   handleAccountsCallback,
   identityPassthroughSync,
+  introspectServiceKey,
   readPlatformSessionCookie,
   resolveActiveTenant,
+  scopeSatisfied,
+  serviceKeyFromRequest,
   syncAccountsUser
-} from "./chunk-RADVGFYQ.js";
+} from "./chunk-2FSPKJAC.js";
 export {
   beginAccountsLoginRedirect,
   clearPlatformSessionCookie,
@@ -18,7 +21,10 @@ export {
   exchangeAuthorizationCode,
   handleAccountsCallback,
   identityPassthroughSync,
+  introspectServiceKey,
   readPlatformSessionCookie,
   resolveActiveTenant,
+  scopeSatisfied,
+  serviceKeyFromRequest,
   syncAccountsUser
 };

package/dist/sveltekit.d.ts

@@ -1,5 +1,5 @@
 import { RequestEvent, Handle } from '@sveltejs/kit';
-import { PlatformSession, AccountsClientConfig, SyncAccountsUser, CookieOptions } from './index.js';
+import { PlatformSession, AccountsClientConfig, ServiceKeyContext, SyncAccountsUser, CookieOptions } from './index.js';
 export { clearPlatformSessionCookie } from './index.js';
 
 type SvelteKitAuthOptions = {
@@ -35,5 +35,21 @@ type PlatformLocals = {
     principal: PlatformSession['principal'];
 };
 declare function createAuthHandle(opts: SvelteKitAuthOptions): Handle;
+type ServiceKeyHandleOptions = {
+    config: AccountsClientConfig;
+    fetchImpl?: typeof fetch;
+    /** Which requests to attempt key auth on. Default: paths starting with `/api`. */
+    match?: (event: RequestEvent) => boolean;
+    /** Introspection cache TTL in ms. Default 60_000; set 0 to disable caching. */
+    cacheTtlMs?: number;
+    /** Map the resolved key grant onto app locals. Called only for a valid key. */
+    onResolved?: (event: RequestEvent, ctx: ServiceKeyContext) => void;
+    /** Observe a present-but-invalid key (e.g. logging) before the 401 is returned. */
+    onInvalid?: (event: RequestEvent) => void;
+};
+type ServiceKeyLocals = {
+    serviceKey?: ServiceKeyContext | null;
+};
+declare function createServiceKeyHandle(opts: ServiceKeyHandleOptions): Handle;
 
-export { type PlatformLocals, type SvelteKitAuthOptions, createAuthHandle };
+export { type PlatformLocals, type ServiceKeyHandleOptions, type ServiceKeyLocals, type SvelteKitAuthOptions, createAuthHandle, createServiceKeyHandle };

package/dist/sveltekit.js

@@ -3,11 +3,13 @@ import {
   clearPlatformSessionCookie,
   handleAccountsCallback,
   identityPassthroughSync,
-  readPlatformSessionCookie
-} from "./chunk-RADVGFYQ.js";
+  introspectServiceKey,
+  readPlatformSessionCookie,
+  serviceKeyFromRequest
+} from "./chunk-2FSPKJAC.js";
 
 // src/sveltekit.ts
-import { redirect } from "@sveltejs/kit";
+import { createHash } from "crypto";
 var STATE_COOKIE = "accounts_auth_state";
 function redirectWithCookies(location, cookies) {
   const headers = new Headers({ location });
@@ -65,12 +67,43 @@ function createAuthHandle(opts) {
           headers: { "content-type": "application/json" }
         });
       }
-      throw redirect(302, `${loginPath}?next=${encodeURIComponent(path + event.url.search)}`);
+      return redirectWithCookies(`${loginPath}?next=${encodeURIComponent(path + event.url.search)}`, []);
     }
     return resolve(event);
   };
 }
+function createServiceKeyHandle(opts) {
+  const match = opts.match ?? ((event) => event.url.pathname.startsWith("/api"));
+  const ttl = opts.cacheTtlMs ?? 6e4;
+  const cache = /* @__PURE__ */ new Map();
+  return async ({ event, resolve }) => {
+    if (!match(event)) return resolve(event);
+    const key = serviceKeyFromRequest(event.request);
+    if (!key) return resolve(event);
+    const hash = createHash("sha256").update(key).digest("hex");
+    const now = Date.now();
+    let ctx;
+    const cached = ttl > 0 ? cache.get(hash) : void 0;
+    if (cached && cached.expires > now) {
+      ctx = cached.value;
+    } else {
+      ctx = await introspectServiceKey({ config: opts.config, key, fetchImpl: opts.fetchImpl });
+      if (ttl > 0) cache.set(hash, { value: ctx, expires: now + ttl });
+    }
+    if (ctx) {
+      event.locals.serviceKey = ctx;
+      opts.onResolved?.(event, ctx);
+      return resolve(event);
+    }
+    opts.onInvalid?.(event);
+    return new Response(JSON.stringify({ message: "Invalid or expired API key." }), {
+      status: 401,
+      headers: { "content-type": "application/json" }
+    });
+  };
+}
 export {
   clearPlatformSessionCookie,
-  createAuthHandle
+  createAuthHandle,
+  createServiceKeyHandle
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,