@~lyre/auth 0.0.7 → 0.0.9

package/dist/{chunk-RADVGFYQ.js → chunk-QIAL6IDV.js}

@@ -242,6 +242,76 @@ function readCookie(cookieHeader, name) {
   }
   return null;
 }
+function serviceKeyFromRequest(request) {
+  const explicit = request.headers.get("x-api-key");
+  if (explicit && explicit.trim()) return explicit.trim();
+  const auth = request.headers.get("authorization");
+  if (auth && auth.startsWith("Bearer ")) {
+    const token = auth.slice(7).trim();
+    if (token.startsWith("sk_")) return token;
+  }
+  return null;
+}
+async function introspectServiceKey(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!input.key || !base) return null;
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/service-keys/introspect", base), {
+      method: "POST",
+      headers: { "x-api-key": input.key, accept: "application/json" }
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data.valid || !data.keyId) return null;
+    const accessibleApps = (data.accessibleApps ?? []).filter(
+      (a) => Boolean(a) && typeof a.id === "string" && typeof a.slug === "string"
+    ).map((a) => ({ id: a.id, slug: a.slug, name: a.name }));
+    return {
+      keyId: data.keyId,
+      tenantId: data.tenantId ?? null,
+      scopes: Array.isArray(data.scopes) ? data.scopes : [],
+      accessibleApps,
+      expiresAt: data.expiresAt ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+async function logoutFromAccounts(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!base || !input.accessToken) return { success: false };
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/logout", base), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${input.accessToken}`,
+        accept: "application/json"
+      },
+      body: JSON.stringify({ all: input.all ?? false })
+    });
+    if (!res.ok) return { success: false };
+    return await res.json();
+  } catch {
+    return { success: false };
+  }
+}
+function verifyWebhookSignature(rawBody, signature, secret) {
+  if (!signature || !secret) return false;
+  const provided = (signature.startsWith("sha256=") ? signature.slice(7) : signature).toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(provided)) return false;
+  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
+  const a = Buffer.from(provided, "hex");
+  const b = Buffer.from(expected, "hex");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+function scopeSatisfied(granted, required) {
+  if (!granted || granted.length === 0) return false;
+  return granted.includes(required);
+}
 
 export {
   createAccountsClientConfig,
@@ -253,5 +323,10 @@ export {
   identityPassthroughSync,
   resolveActiveTenant,
   readPlatformSessionCookie,
-  clearPlatformSessionCookie
+  clearPlatformSessionCookie,
+  serviceKeyFromRequest,
+  introspectServiceKey,
+  logoutFromAccounts,
+  verifyWebhookSignature,
+  scopeSatisfied
 };

package/dist/index.d.ts

@@ -142,5 +142,40 @@ type CookieOptions = {
     secure?: boolean;
 };
 declare function clearPlatformSessionCookie(opts?: CookieOptions): string;
+type ServiceKeyApp = {
+    id: string;
+    slug: string;
+    name?: string;
+};
+type ServiceKeyContext = {
+    keyId: string;
+    tenantId: string | null;
+    /** Scopes granted to this key (opaque strings owned by the consuming app). */
+    scopes: string[];
+    /** Apps this key may act on (auth resolves these from the key's app grant). */
+    accessibleApps: ServiceKeyApp[];
+    expiresAt: string | null;
+};
+declare function serviceKeyFromRequest(request: Request): string | null;
+declare function introspectServiceKey(input: {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    key: string;
+    fetchImpl?: typeof fetch;
+}): Promise<ServiceKeyContext | null>;
+declare function logoutFromAccounts(input: {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    accessToken: string;
+    all?: boolean;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    success: boolean;
+    revokedCount?: number;
+}>;
+declare function verifyWebhookSignature(rawBody: string, signature: string | null | undefined, secret: string): boolean;
+type AccountsWebhookEvent = {
+    type: string;
+    [key: string]: unknown;
+};
+declare function scopeSatisfied(granted: string[] | undefined, required: string): boolean;
 
-export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, readPlatformSessionCookie, resolveActiveTenant, syncAccountsUser };
+export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AccountsWebhookEvent, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, logoutFromAccounts, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser, verifyWebhookSignature };

package/dist/index.js

@@ -6,10 +6,15 @@ import {
   exchangeAuthorizationCode,
   handleAccountsCallback,
   identityPassthroughSync,
+  introspectServiceKey,
+  logoutFromAccounts,
   readPlatformSessionCookie,
   resolveActiveTenant,
-  syncAccountsUser
-} from "./chunk-RADVGFYQ.js";
+  scopeSatisfied,
+  serviceKeyFromRequest,
+  syncAccountsUser,
+  verifyWebhookSignature
+} from "./chunk-QIAL6IDV.js";
 export {
   beginAccountsLoginRedirect,
   clearPlatformSessionCookie,
@@ -18,7 +23,12 @@ export {
   exchangeAuthorizationCode,
   handleAccountsCallback,
   identityPassthroughSync,
+  introspectServiceKey,
+  logoutFromAccounts,
   readPlatformSessionCookie,
   resolveActiveTenant,
-  syncAccountsUser
+  scopeSatisfied,
+  serviceKeyFromRequest,
+  syncAccountsUser,
+  verifyWebhookSignature
 };

package/dist/sveltekit.d.ts

@@ -1,5 +1,5 @@
 import { RequestEvent, Handle } from '@sveltejs/kit';
-import { PlatformSession, AccountsClientConfig, SyncAccountsUser, CookieOptions } from './index.js';
+import { AccountsWebhookEvent, PlatformSession, AccountsClientConfig, ServiceKeyContext, SyncAccountsUser, CookieOptions } from './index.js';
 export { clearPlatformSessionCookie } from './index.js';
 
 type SvelteKitAuthOptions = {
@@ -35,5 +35,31 @@ type PlatformLocals = {
     principal: PlatformSession['principal'];
 };
 declare function createAuthHandle(opts: SvelteKitAuthOptions): Handle;
+type ServiceKeyHandleOptions = {
+    config: AccountsClientConfig;
+    fetchImpl?: typeof fetch;
+    /** Which requests to attempt key auth on. Default: paths starting with `/api`. */
+    match?: (event: RequestEvent) => boolean;
+    /** Introspection cache TTL in ms. Default 60_000; set 0 to disable caching. */
+    cacheTtlMs?: number;
+    /** Map the resolved key grant onto app locals. Called only for a valid key. */
+    onResolved?: (event: RequestEvent, ctx: ServiceKeyContext) => void;
+    /** Observe a present-but-invalid key (e.g. logging) before the 401 is returned. */
+    onInvalid?: (event: RequestEvent) => void;
+};
+type ServiceKeyLocals = {
+    serviceKey?: ServiceKeyContext | null;
+};
+declare function createServiceKeyHandle(opts: ServiceKeyHandleOptions): Handle;
+type AccountsWebhookOptions = {
+    secret: string;
+    /** Route to receive webhooks on. Default '/api/auth/accounts/webhook'. */
+    path?: string;
+    /** Header carrying the signature. Default 'x-accounts-signature'. */
+    signatureHeader?: string;
+    /** React to a verified event. Throwing yields a 500 (Accounts may retry). */
+    onEvent: (event: AccountsWebhookEvent, raw: string, request: RequestEvent) => void | Promise<void>;
+};
+declare function createAccountsWebhookHandle(opts: AccountsWebhookOptions): Handle;
 
-export { type PlatformLocals, type SvelteKitAuthOptions, createAuthHandle };
+export { type AccountsWebhookOptions, type PlatformLocals, type ServiceKeyHandleOptions, type ServiceKeyLocals, type SvelteKitAuthOptions, createAccountsWebhookHandle, createAuthHandle, createServiceKeyHandle };

package/dist/sveltekit.js

@@ -3,10 +3,15 @@ import {
   clearPlatformSessionCookie,
   handleAccountsCallback,
   identityPassthroughSync,
-  readPlatformSessionCookie
-} from "./chunk-RADVGFYQ.js";
+  introspectServiceKey,
+  logoutFromAccounts,
+  readPlatformSessionCookie,
+  serviceKeyFromRequest,
+  verifyWebhookSignature
+} from "./chunk-QIAL6IDV.js";
 
 // src/sveltekit.ts
+import { createHash } from "crypto";
 var STATE_COOKIE = "accounts_auth_state";
 function redirectWithCookies(location, cookies) {
   const headers = new Headers({ location });
@@ -52,6 +57,10 @@ function createAuthHandle(opts) {
       ]);
     }
     if (path === logoutPath) {
+      if (session.accessToken) {
+        const all = event.url.searchParams.get("all") === "1" || event.url.searchParams.get("all") === "true";
+        await logoutFromAccounts({ config: opts.config, accessToken: session.accessToken, all });
+      }
       return redirectWithCookies(postLogoutPath, [
         clearPlatformSessionCookie(cookieOptions),
         `${STATE_COOKIE}=; ${cookieOptions?.sameSite === "none" ? "Path=/; HttpOnly; SameSite=None; Secure" : "Path=/; HttpOnly; SameSite=Lax"}; Max-Age=0`
@@ -69,7 +78,65 @@ function createAuthHandle(opts) {
     return resolve(event);
   };
 }
+function createServiceKeyHandle(opts) {
+  const match = opts.match ?? ((event) => event.url.pathname.startsWith("/api"));
+  const ttl = opts.cacheTtlMs ?? 6e4;
+  const cache = /* @__PURE__ */ new Map();
+  return async ({ event, resolve }) => {
+    if (!match(event)) return resolve(event);
+    const key = serviceKeyFromRequest(event.request);
+    if (!key) return resolve(event);
+    const hash = createHash("sha256").update(key).digest("hex");
+    const now = Date.now();
+    let ctx;
+    const cached = ttl > 0 ? cache.get(hash) : void 0;
+    if (cached && cached.expires > now) {
+      ctx = cached.value;
+    } else {
+      ctx = await introspectServiceKey({ config: opts.config, key, fetchImpl: opts.fetchImpl });
+      if (ttl > 0) cache.set(hash, { value: ctx, expires: now + ttl });
+    }
+    if (ctx) {
+      event.locals.serviceKey = ctx;
+      opts.onResolved?.(event, ctx);
+      return resolve(event);
+    }
+    opts.onInvalid?.(event);
+    return new Response(JSON.stringify({ message: "Invalid or expired API key." }), {
+      status: 401,
+      headers: { "content-type": "application/json" }
+    });
+  };
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+function createAccountsWebhookHandle(opts) {
+  const path = opts.path ?? "/api/auth/accounts/webhook";
+  const sigHeader = opts.signatureHeader ?? "x-accounts-signature";
+  return async ({ event, resolve }) => {
+    if (event.url.pathname !== path || event.request.method !== "POST") return resolve(event);
+    const raw = await event.request.text();
+    if (!verifyWebhookSignature(raw, event.request.headers.get(sigHeader), opts.secret)) {
+      return jsonResponse(401, { ok: false, error: "Invalid webhook signature." });
+    }
+    let payload;
+    try {
+      payload = JSON.parse(raw);
+    } catch {
+      return jsonResponse(400, { ok: false, error: "Invalid JSON body." });
+    }
+    try {
+      await opts.onEvent({ ...payload, type: String(payload.type ?? "unknown") }, raw, event);
+    } catch {
+      return jsonResponse(500, { ok: false, error: "Webhook handler failed." });
+    }
+    return jsonResponse(200, { ok: true });
+  };
+}
 export {
   clearPlatformSessionCookie,
-  createAuthHandle
+  createAccountsWebhookHandle,
+  createAuthHandle,
+  createServiceKeyHandle
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,