astro-tokenkit 1.0.10 → 1.0.12

package/dist/index.js

@@ -110,6 +110,13 @@ const EXPIRES_IN_FIELDS = [
     'expiresIn',
     'ttl',
 ];
+/**
+ * Common field names for token type
+ */
+const TOKEN_TYPE_FIELDS = [
+    'token_type',
+    'tokenType',
+];
 /**
  * Common field names for session payload
  */
@@ -172,10 +179,13 @@ function autoDetectFields(body, fieldMapping) {
     }
     // Detect session payload (optional)
     const sessionPayload = findField(SESSION_PAYLOAD_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.sessionPayload);
+    // Detect token type (optional)
+    const tokenType = findField(TOKEN_TYPE_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.tokenType);
     return {
         accessToken,
         refreshToken,
         accessExpiresAt,
+        tokenType: tokenType || undefined,
         sessionPayload: sessionPayload || undefined,
     };
 }
@@ -189,6 +199,10 @@ function parseJWTPayload(token) {
             return null;
         }
         const payload = parts[1];
+        // Better UTF-8 support for environments with Buffer (like Node.js/Astro)
+        if (typeof Buffer !== 'undefined') {
+            return JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
+        }
         const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
         return JSON.parse(decoded);
     }
@@ -208,6 +222,7 @@ function getCookieNames(prefix) {
         refreshToken: `${p}refresh_token`,
         expiresAt: `${p}access_expires_at`,
         lastRefreshAt: `${p}last_refresh_at`,
+        tokenType: `${p}token_type`,
     };
 }
 /**
@@ -243,20 +258,25 @@ function storeTokens(ctx, bundle, cookieConfig = {}) {
     ctx.cookies.set(names.expiresAt, bundle.accessExpiresAt.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
     // Set last refresh timestamp
     ctx.cookies.set(names.lastRefreshAt, now.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    // Set token type if available
+    if (bundle.tokenType) {
+        ctx.cookies.set(names.tokenType, bundle.tokenType, Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    }
 }
 /**
  * Retrieve tokens from cookies
  */
 function retrieveTokens(ctx, cookieConfig = {}) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     const names = getCookieNames(cookieConfig.prefix);
     const accessToken = ((_a = ctx.cookies.get(names.accessToken)) === null || _a === void 0 ? void 0 : _a.value) || null;
     const refreshToken = ((_b = ctx.cookies.get(names.refreshToken)) === null || _b === void 0 ? void 0 : _b.value) || null;
-    const expiresAtStr = (_c = ctx.cookies.get(names.expiresAt)) === null || _c === void 0 ? void 0 : _c.value;
+    const tokenType = ((_c = ctx.cookies.get(names.tokenType)) === null || _c === void 0 ? void 0 : _c.value) || null;
+    const expiresAtStr = (_d = ctx.cookies.get(names.expiresAt)) === null || _d === void 0 ? void 0 : _d.value;
     const expiresAt = expiresAtStr ? parseInt(expiresAtStr, 10) : null;
-    const lastRefreshAtStr = (_d = ctx.cookies.get(names.lastRefreshAt)) === null || _d === void 0 ? void 0 : _d.value;
+    const lastRefreshAtStr = (_e = ctx.cookies.get(names.lastRefreshAt)) === null || _e === void 0 ? void 0 : _e.value;
     const lastRefreshAt = lastRefreshAtStr ? parseInt(lastRefreshAtStr, 10) : null;
-    return { accessToken, refreshToken, expiresAt, lastRefreshAt };
+    return { accessToken, refreshToken, expiresAt, lastRefreshAt, tokenType };
 }
 /**
  * Clear all auth cookies
@@ -268,6 +288,7 @@ function clearTokens(ctx, cookieConfig = {}) {
     ctx.cookies.delete(names.refreshToken, Object.assign(Object.assign({}, options), { path: '/' }));
     ctx.cookies.delete(names.expiresAt, Object.assign(Object.assign({}, options), { path: '/' }));
     ctx.cookies.delete(names.lastRefreshAt, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.tokenType, Object.assign(Object.assign({}, options), { path: '/' }));
 }
 
 // packages/astro-tokenkit/src/utils/time.ts
@@ -369,7 +390,8 @@ function isExpired(expiresAt, now, policy = {}) {
     const clockSkew = typeof normalized.clockSkew === 'number'
         ? normalized.clockSkew
         : parseTime(normalized.clockSkew);
-    return now > expiresAt + clockSkew;
+    // Pessimistic: consider it expired if current time + skew is past expiration
+    return now + clockSkew > expiresAt;
 }
 
 // packages/astro-tokenkit/src/auth/manager.ts
@@ -413,18 +435,38 @@ class TokenManager {
     /**
      * Perform login
      */
-    login(ctx, credentials, onLogin) {
+    login(ctx, credentials, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const url = this.baseURL + this.config.login;
-            const response = yield fetch(url, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify(credentials),
-            }).catch(error => {
-                throw new AuthError(`Login request failed: ${error.message}`);
-            });
+            const url = this.joinURL(this.baseURL, this.config.login);
+            const contentType = this.config.contentType || 'application/json';
+            const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
+            const data = Object.assign(Object.assign(Object.assign({}, this.config.loginData), options === null || options === void 0 ? void 0 : options.data), credentials);
+            let requestBody;
+            if (contentType === 'application/x-www-form-urlencoded') {
+                requestBody = new URLSearchParams(data).toString();
+            }
+            else {
+                requestBody = JSON.stringify(data);
+            }
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
+                const authError = new AuthError(`Login request failed: ${error.message}`);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
+            }
             if (!response.ok) {
-                throw new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
+                const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
             }
             const body = yield response.json().catch(() => ({}));
             // Parse response
@@ -435,24 +477,34 @@ class TokenManager {
                     : autoDetectFields(body, this.config.fields);
             }
             catch (error) {
-                throw new AuthError(`Invalid login response: ${error.message}`, response.status, response);
+                const authError = new AuthError(`Invalid login response: ${error.message}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
             }
             // Store in cookies
             storeTokens(ctx, bundle, this.config.cookies);
             // Call onLogin callback if provided
-            if (onLogin) {
-                yield onLogin(bundle, body, ctx);
+            if (options === null || options === void 0 ? void 0 : options.onLogin) {
+                yield options.onLogin(bundle, body, ctx);
             }
-            return bundle;
+            return {
+                data: bundle,
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+                url: response.url,
+                ok: response.ok,
+            };
         });
     }
     /**
      * Perform token refresh
      */
-    refresh(ctx, refreshToken) {
+    refresh(ctx, refreshToken, options, headers) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                return yield this.performRefresh(ctx, refreshToken);
+                return yield this.performRefresh(ctx, refreshToken, options, headers);
             }
             catch (error) {
                 clearTokens(ctx, this.config.cookies);
@@ -463,16 +515,31 @@ class TokenManager {
     /**
      * Internal refresh implementation
      */
-    performRefresh(ctx, refreshToken) {
+    performRefresh(ctx, refreshToken, options, extraHeaders) {
         return __awaiter(this, void 0, void 0, function* () {
-            const url = this.baseURL + this.config.refresh;
-            const response = yield fetch(url, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ refreshToken }),
-            }).catch(error => {
+            const url = this.joinURL(this.baseURL, this.config.refresh);
+            const contentType = this.config.contentType || 'application/json';
+            const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
+            const refreshField = this.config.refreshRequestField || 'refreshToken';
+            const data = Object.assign(Object.assign(Object.assign({}, this.config.refreshData), options === null || options === void 0 ? void 0 : options.data), { [refreshField]: refreshToken });
+            let requestBody;
+            if (contentType === 'application/x-www-form-urlencoded') {
+                requestBody = new URLSearchParams(data).toString();
+            }
+            else {
+                requestBody = JSON.stringify(data);
+            }
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
                 throw new AuthError(`Refresh request failed: ${error.message}`);
-            });
+            }
             if (!response.ok) {
                 // 401/403 = invalid refresh token
                 if (response.status === 401 || response.status === 403) {
@@ -504,9 +571,9 @@ class TokenManager {
     /**
      * Ensure valid tokens (with automatic refresh)
      */
-    ensure(ctx) {
+    ensure(ctx, options, headers) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f;
             const now = Math.floor(Date.now() / 1000);
             const tokens = retrieveTokens(ctx, this.config.cookies);
             // No tokens
@@ -516,23 +583,25 @@ class TokenManager {
             // Token expired
             if (isExpired(tokens.expiresAt, now, this.config.policy)) {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
-                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken));
+                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (!bundle)
                     return null;
                 return {
                     accessToken: bundle.accessToken,
                     expiresAt: bundle.accessExpiresAt,
+                    tokenType: bundle.tokenType,
                     payload: (_b = (_a = bundle.sessionPayload) !== null && _a !== void 0 ? _a : parseJWTPayload(bundle.accessToken)) !== null && _b !== void 0 ? _b : undefined,
                 };
             }
             // Proactive refresh
             if (shouldRefresh(tokens.expiresAt, now, tokens.lastRefreshAt, this.config.policy)) {
                 const flightKey = this.createFlightKey(tokens.refreshToken);
-                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken));
+                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
                 if (bundle) {
                     return {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.accessExpiresAt,
+                        tokenType: bundle.tokenType,
                         payload: (_d = (_c = bundle.sessionPayload) !== null && _c !== void 0 ? _c : parseJWTPayload(bundle.accessToken)) !== null && _d !== void 0 ? _d : undefined,
                     };
                 }
@@ -546,7 +615,8 @@ class TokenManager {
             return {
                 accessToken: tokens.accessToken,
                 expiresAt: tokens.expiresAt,
-                payload: (_e = parseJWTPayload(tokens.accessToken)) !== null && _e !== void 0 ? _e : undefined,
+                tokenType: (_e = tokens.tokenType) !== null && _e !== void 0 ? _e : undefined,
+                payload: (_f = parseJWTPayload(tokens.accessToken)) !== null && _f !== void 0 ? _f : undefined,
             };
         });
     }
@@ -555,15 +625,22 @@ class TokenManager {
      */
     logout(ctx) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             // Optionally call logout endpoint
             if (this.config.logout) {
                 try {
-                    const url = this.baseURL + this.config.logout;
-                    yield fetch(url, { method: 'POST' });
+                    const url = this.joinURL(this.baseURL, this.config.logout);
+                    const session = this.getSession(ctx);
+                    const headers = {};
+                    if (session === null || session === void 0 ? void 0 : session.accessToken) {
+                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
+                    }
+                    yield fetch(url, { method: 'POST', headers });
                 }
                 catch (error) {
                     // Ignore logout endpoint errors
-                    console.warn('Logout endpoint failed:', error);
+                    console.warn('[TokenKit] Logout endpoint failed:', error);
                 }
             }
             clearTokens(ctx, this.config.cookies);
@@ -573,7 +650,7 @@ class TokenManager {
      * Get current session (no refresh)
      */
     getSession(ctx) {
-        var _a;
+        var _a, _b;
         const tokens = retrieveTokens(ctx, this.config.cookies);
         if (!tokens.accessToken || !tokens.expiresAt) {
             return null;
@@ -581,7 +658,8 @@ class TokenManager {
         return {
             accessToken: tokens.accessToken,
             expiresAt: tokens.expiresAt,
-            payload: (_a = parseJWTPayload(tokens.accessToken)) !== null && _a !== void 0 ? _a : undefined,
+            tokenType: (_a = tokens.tokenType) !== null && _a !== void 0 ? _a : undefined,
+            payload: (_b = parseJWTPayload(tokens.accessToken)) !== null && _b !== void 0 ? _b : undefined,
         };
     }
     /**
@@ -595,13 +673,16 @@ class TokenManager {
      * Create flight key for single-flight deduplication
      */
     createFlightKey(token) {
-        let hash = 0;
-        for (let i = 0; i < token.length; i++) {
-            const char = token.charCodeAt(i);
-            hash = ((hash << 5) - hash) + char;
-            hash = hash & hash;
-        }
-        return `flight_${Math.abs(hash).toString(36)}`;
+        // Avoid weak hashing of sensitive tokens
+        return `refresh_${token}`;
+    }
+    /**
+     * Join base URL and path safely
+     */
+    joinURL(base, path) {
+        const b = base.endsWith('/') ? base : base + '/';
+        const p = path.startsWith('/') ? path.slice(1) : path;
+        return b + p;
     }
 }
 
@@ -667,20 +748,17 @@ function runWithContext(ctx, fn) {
 /**
  * Get current Astro context (from middleware binding or explicit)
  */
-function getContextStore(explicitCtx) {
+function getContextStore() {
     const config = getConfig();
     const getStore = config.getContextStore;
     const context = config.context || als;
     const store = getStore
         ? getStore()
         : context.getStore();
-    const ctx = explicitCtx || store;
-    if (!ctx) {
-        throw new Error('Astro context not found. Either:\n' +
-            '1. Use api.middleware() to bind context automatically, or\n' +
-            '2. Pass context explicitly: api.get("/path", { ctx: Astro })');
+    if (!store) {
+        throw new Error('Astro context not found. Make sure to use api.middleware() to bind context automatically.');
     }
-    return ctx;
+    return store;
 }
 
 // packages/astro-tokenkit/src/utils/retry.ts
@@ -742,8 +820,8 @@ function createMiddleware() {
                     yield tokenManager.ensure(ctx);
                 }
                 catch (error) {
-                    // Log but don't block a request if rotation fails
-                    console.error('[TokenKit] Automatic token rotation failed:', error);
+                    // Log only the message to avoid leaking sensitive data in the error object
+                    console.error('[TokenKit] Automatic token rotation failed:', error.message || error);
                 }
             }
             return next();
@@ -867,13 +945,12 @@ class APIClient {
      */
     request(config) {
         return __awaiter(this, void 0, void 0, function* () {
-            const ctx = getContextStore(config.ctx);
+            const ctx = getContextStore();
             let attempt = 0;
             while (true) {
                 attempt++;
                 try {
-                    const response = yield this.executeRequest(config, ctx, attempt);
-                    return response.data;
+                    return yield this.executeRequest(config, ctx, attempt);
                 }
                 catch (error) {
                     // Check if we should retry
@@ -896,12 +973,12 @@ class APIClient {
             var _a, _b, _c, _d, _e;
             // Ensure valid session (if auth is enabled)
             if (this.tokenManager && !config.skipAuth) {
-                yield this.tokenManager.ensure(ctx);
+                yield this.tokenManager.ensure(ctx, config.auth, config.headers);
             }
             // Build full URL
             const fullURL = this.buildURL(config.url, config.params);
             // Build headers
-            const headers = this.buildHeaders(config, ctx);
+            const headers = this.buildHeaders(config, ctx, fullURL);
             // Build request init
             const init = {
                 method: config.method,
@@ -929,7 +1006,7 @@ class APIClient {
                 // Handle 401 (try refresh and retry once)
                 if (response.status === 401 && this.tokenManager && !config.skipAuth && attempt === 1) {
                     // Clear and try fresh session
-                    const session = yield this.tokenManager.ensure(ctx);
+                    const session = yield this.tokenManager.ensure(ctx, config.auth, config.headers);
                     if (session) {
                         // Retry with new token
                         return this.executeRequest(config, ctx, attempt + 1);
@@ -998,6 +1075,7 @@ class APIClient {
                 statusText: response.statusText,
                 headers: response.headers,
                 url,
+                ok: response.ok,
             };
         });
     }
@@ -1019,19 +1097,33 @@ class APIClient {
     /**
      * Build request headers
      */
-    buildHeaders(config, ctx) {
+    buildHeaders(config, ctx, targetURL) {
         var _a, _b;
         const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json' }, this.config.headers), config.headers);
-        // Add auth token if available
-        if (this.tokenManager && !config.skipAuth) {
+        // Add auth token if available (only for safe URLs)
+        if (this.tokenManager && !config.skipAuth && this.isSafeURL(targetURL)) {
             const session = this.tokenManager.getSession(ctx);
             if (session === null || session === void 0 ? void 0 : session.accessToken) {
-                const injectFn = (_b = (_a = this.config.auth) === null || _a === void 0 ? void 0 : _a.injectToken) !== null && _b !== void 0 ? _b : ((token) => `Bearer ${token}`);
-                headers['Authorization'] = injectFn(session.accessToken);
+                const injectFn = (_b = (_a = this.config.auth) === null || _a === void 0 ? void 0 : _a.injectToken) !== null && _b !== void 0 ? _b : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
             }
         }
         return headers;
     }
+    /**
+     * Check if a URL is safe for token injection (same origin as baseURL)
+     */
+    isSafeURL(url) {
+        try {
+            const requestUrl = new URL(url, this.config.baseURL);
+            const baseUrl = new URL(this.config.baseURL || 'http://localhost');
+            return requestUrl.origin === baseUrl.origin;
+        }
+        catch (_a) {
+            // Only allow relative paths if baseURL is missing or invalid
+            return !url.startsWith('http') && !url.startsWith('//');
+        }
+    }
     /**
      * Login
      */
@@ -1040,48 +1132,38 @@ class APIClient {
             if (!this.tokenManager) {
                 throw new Error('Auth is not configured for this client');
             }
-            let ctx;
-            let onLogin;
-            if (options && 'cookies' in options) {
-                ctx = options;
-            }
-            else if (options) {
-                const opt = options;
-                ctx = opt.ctx;
-                onLogin = opt.onLogin;
-            }
-            const context = getContextStore(ctx);
-            yield this.tokenManager.login(context, credentials, onLogin);
+            const context = getContextStore();
+            return this.tokenManager.login(context, credentials, options);
         });
     }
     /**
      * Logout
      */
-    logout(ctx) {
+    logout() {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.tokenManager) {
                 throw new Error('Auth is not configured for this client');
             }
-            const context = getContextStore(ctx);
+            const context = getContextStore();
             yield this.tokenManager.logout(context);
         });
     }
     /**
      * Check if authenticated
      */
-    isAuthenticated(ctx) {
+    isAuthenticated() {
         if (!this.tokenManager)
             return false;
-        const context = getContextStore(ctx);
+        const context = getContextStore();
         return this.tokenManager.isAuthenticated(context);
     }
     /**
      * Get current session
      */
-    getSession(ctx) {
+    getSession() {
         if (!this.tokenManager)
             return null;
-        const context = getContextStore(ctx);
+        const context = getContextStore();
         return this.tokenManager.getSession(context);
     }
 }
@@ -1144,5 +1226,5 @@ function tokenKit(config) {
  */
 const defineMiddleware = () => createMiddleware();
 
-export { APIClient, APIError, AuthError, NetworkError, TimeoutError, api, createClient, createMiddleware, defineMiddleware, formatTime, getConfig, getTokenManager, parseTime, setConfig, setTokenManager, tokenKit };
+export { APIClient, APIError, AuthError, NetworkError, TimeoutError, api, createClient, createMiddleware, defineMiddleware, formatTime, getConfig, getContextStore, getTokenManager, parseTime, runWithContext, setConfig, setTokenManager, tokenKit };
 //# sourceMappingURL=index.js.map