@~lyre/auth 0.0.8 → 0.0.9

package/dist/{chunk-2FSPKJAC.js → chunk-QIAL6IDV.js}

@@ -278,6 +278,36 @@ async function introspectServiceKey(input) {
     return null;
   }
 }
+async function logoutFromAccounts(input) {
+  const base = normalizeOptionalString(input.config.baseUrl);
+  if (!base || !input.accessToken) return { success: false };
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    const res = await fetchImpl(new URL("/api/auth/logout", base), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${input.accessToken}`,
+        accept: "application/json"
+      },
+      body: JSON.stringify({ all: input.all ?? false })
+    });
+    if (!res.ok) return { success: false };
+    return await res.json();
+  } catch {
+    return { success: false };
+  }
+}
+function verifyWebhookSignature(rawBody, signature, secret) {
+  if (!signature || !secret) return false;
+  const provided = (signature.startsWith("sha256=") ? signature.slice(7) : signature).toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(provided)) return false;
+  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
+  const a = Buffer.from(provided, "hex");
+  const b = Buffer.from(expected, "hex");
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
 function scopeSatisfied(granted, required) {
   if (!granted || granted.length === 0) return false;
   return granted.includes(required);
@@ -296,5 +326,7 @@ export {
   clearPlatformSessionCookie,
   serviceKeyFromRequest,
   introspectServiceKey,
+  logoutFromAccounts,
+  verifyWebhookSignature,
   scopeSatisfied
 };

package/dist/index.d.ts

@@ -162,6 +162,20 @@ declare function introspectServiceKey(input: {
     key: string;
     fetchImpl?: typeof fetch;
 }): Promise<ServiceKeyContext | null>;
+declare function logoutFromAccounts(input: {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    accessToken: string;
+    all?: boolean;
+    fetchImpl?: typeof fetch;
+}): Promise<{
+    success: boolean;
+    revokedCount?: number;
+}>;
+declare function verifyWebhookSignature(rawBody: string, signature: string | null | undefined, secret: string): boolean;
+type AccountsWebhookEvent = {
+    type: string;
+    [key: string]: unknown;
+};
 declare function scopeSatisfied(granted: string[] | undefined, required: string): boolean;
 
-export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser };
+export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AccountsWebhookEvent, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, logoutFromAccounts, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser, verifyWebhookSignature };

package/dist/index.js

@@ -7,12 +7,14 @@ import {
   handleAccountsCallback,
   identityPassthroughSync,
   introspectServiceKey,
+  logoutFromAccounts,
   readPlatformSessionCookie,
   resolveActiveTenant,
   scopeSatisfied,
   serviceKeyFromRequest,
-  syncAccountsUser
-} from "./chunk-2FSPKJAC.js";
+  syncAccountsUser,
+  verifyWebhookSignature
+} from "./chunk-QIAL6IDV.js";
 export {
   beginAccountsLoginRedirect,
   clearPlatformSessionCookie,
@@ -22,9 +24,11 @@ export {
   handleAccountsCallback,
   identityPassthroughSync,
   introspectServiceKey,
+  logoutFromAccounts,
   readPlatformSessionCookie,
   resolveActiveTenant,
   scopeSatisfied,
   serviceKeyFromRequest,
-  syncAccountsUser
+  syncAccountsUser,
+  verifyWebhookSignature
 };

package/dist/sveltekit.d.ts

@@ -1,5 +1,5 @@
 import { RequestEvent, Handle } from '@sveltejs/kit';
-import { PlatformSession, AccountsClientConfig, ServiceKeyContext, SyncAccountsUser, CookieOptions } from './index.js';
+import { AccountsWebhookEvent, PlatformSession, AccountsClientConfig, ServiceKeyContext, SyncAccountsUser, CookieOptions } from './index.js';
 export { clearPlatformSessionCookie } from './index.js';
 
 type SvelteKitAuthOptions = {
@@ -51,5 +51,15 @@ type ServiceKeyLocals = {
     serviceKey?: ServiceKeyContext | null;
 };
 declare function createServiceKeyHandle(opts: ServiceKeyHandleOptions): Handle;
+type AccountsWebhookOptions = {
+    secret: string;
+    /** Route to receive webhooks on. Default '/api/auth/accounts/webhook'. */
+    path?: string;
+    /** Header carrying the signature. Default 'x-accounts-signature'. */
+    signatureHeader?: string;
+    /** React to a verified event. Throwing yields a 500 (Accounts may retry). */
+    onEvent: (event: AccountsWebhookEvent, raw: string, request: RequestEvent) => void | Promise<void>;
+};
+declare function createAccountsWebhookHandle(opts: AccountsWebhookOptions): Handle;
 
-export { type PlatformLocals, type ServiceKeyHandleOptions, type ServiceKeyLocals, type SvelteKitAuthOptions, createAuthHandle, createServiceKeyHandle };
+export { type AccountsWebhookOptions, type PlatformLocals, type ServiceKeyHandleOptions, type ServiceKeyLocals, type SvelteKitAuthOptions, createAccountsWebhookHandle, createAuthHandle, createServiceKeyHandle };

package/dist/sveltekit.js

@@ -4,9 +4,11 @@ import {
   handleAccountsCallback,
   identityPassthroughSync,
   introspectServiceKey,
+  logoutFromAccounts,
   readPlatformSessionCookie,
-  serviceKeyFromRequest
-} from "./chunk-2FSPKJAC.js";
+  serviceKeyFromRequest,
+  verifyWebhookSignature
+} from "./chunk-QIAL6IDV.js";
 
 // src/sveltekit.ts
 import { createHash } from "crypto";
@@ -55,6 +57,10 @@ function createAuthHandle(opts) {
       ]);
     }
     if (path === logoutPath) {
+      if (session.accessToken) {
+        const all = event.url.searchParams.get("all") === "1" || event.url.searchParams.get("all") === "true";
+        await logoutFromAccounts({ config: opts.config, accessToken: session.accessToken, all });
+      }
       return redirectWithCookies(postLogoutPath, [
         clearPlatformSessionCookie(cookieOptions),
         `${STATE_COOKIE}=; ${cookieOptions?.sameSite === "none" ? "Path=/; HttpOnly; SameSite=None; Secure" : "Path=/; HttpOnly; SameSite=Lax"}; Max-Age=0`
@@ -102,8 +108,35 @@ function createServiceKeyHandle(opts) {
     });
   };
 }
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+}
+function createAccountsWebhookHandle(opts) {
+  const path = opts.path ?? "/api/auth/accounts/webhook";
+  const sigHeader = opts.signatureHeader ?? "x-accounts-signature";
+  return async ({ event, resolve }) => {
+    if (event.url.pathname !== path || event.request.method !== "POST") return resolve(event);
+    const raw = await event.request.text();
+    if (!verifyWebhookSignature(raw, event.request.headers.get(sigHeader), opts.secret)) {
+      return jsonResponse(401, { ok: false, error: "Invalid webhook signature." });
+    }
+    let payload;
+    try {
+      payload = JSON.parse(raw);
+    } catch {
+      return jsonResponse(400, { ok: false, error: "Invalid JSON body." });
+    }
+    try {
+      await opts.onEvent({ ...payload, type: String(payload.type ?? "unknown") }, raw, event);
+    } catch {
+      return jsonResponse(500, { ok: false, error: "Webhook handler failed." });
+    }
+    return jsonResponse(200, { ok: true });
+  };
+}
 export {
   clearPlatformSessionCookie,
+  createAccountsWebhookHandle,
   createAuthHandle,
   createServiceKeyHandle
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,