astro-tokenkit 1.0.11 → 1.0.13

package/dist/index.cjs

@@ -112,6 +112,13 @@ const EXPIRES_IN_FIELDS = [
     'expiresIn',
     'ttl',
 ];
+/**
+ * Common field names for token type
+ */
+const TOKEN_TYPE_FIELDS = [
+    'token_type',
+    'tokenType',
+];
 /**
  * Common field names for session payload
  */
@@ -174,10 +181,13 @@ function autoDetectFields(body, fieldMapping) {
     }
     // Detect session payload (optional)
     const sessionPayload = findField(SESSION_PAYLOAD_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.sessionPayload);
+    // Detect token type (optional)
+    const tokenType = findField(TOKEN_TYPE_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.tokenType);
     return {
         accessToken,
         refreshToken,
         accessExpiresAt,
+        tokenType: tokenType || undefined,
         sessionPayload: sessionPayload || undefined,
     };
 }
@@ -191,6 +201,10 @@ function parseJWTPayload(token) {
             return null;
         }
         const payload = parts[1];
+        // Better UTF-8 support for environments with Buffer (like Node.js/Astro)
+        if (typeof Buffer !== 'undefined') {
+            return JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
+        }
         const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
         return JSON.parse(decoded);
     }
@@ -210,6 +224,7 @@ function getCookieNames(prefix) {
         refreshToken: `${p}refresh_token`,
         expiresAt: `${p}access_expires_at`,
         lastRefreshAt: `${p}last_refresh_at`,
+        tokenType: `${p}token_type`,
     };
 }
 /**
@@ -245,20 +260,25 @@ function storeTokens(ctx, bundle, cookieConfig = {}) {
     ctx.cookies.set(names.expiresAt, bundle.accessExpiresAt.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
     // Set last refresh timestamp
     ctx.cookies.set(names.lastRefreshAt, now.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    // Set token type if available
+    if (bundle.tokenType) {
+        ctx.cookies.set(names.tokenType, bundle.tokenType, Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    }
 }
 /**
  * Retrieve tokens from cookies
  */
 function retrieveTokens(ctx, cookieConfig = {}) {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     const names = getCookieNames(cookieConfig.prefix);
     const accessToken = ((_a = ctx.cookies.get(names.accessToken)) === null || _a === void 0 ? void 0 : _a.value) || null;
     const refreshToken = ((_b = ctx.cookies.get(names.refreshToken)) === null || _b === void 0 ? void 0 : _b.value) || null;
-    const expiresAtStr = (_c = ctx.cookies.get(names.expiresAt)) === null || _c === void 0 ? void 0 : _c.value;
+    const tokenType = ((_c = ctx.cookies.get(names.tokenType)) === null || _c === void 0 ? void 0 : _c.value) || null;
+    const expiresAtStr = (_d = ctx.cookies.get(names.expiresAt)) === null || _d === void 0 ? void 0 : _d.value;
     const expiresAt = expiresAtStr ? parseInt(expiresAtStr, 10) : null;
-    const lastRefreshAtStr = (_d = ctx.cookies.get(names.lastRefreshAt)) === null || _d === void 0 ? void 0 : _d.value;
+    const lastRefreshAtStr = (_e = ctx.cookies.get(names.lastRefreshAt)) === null || _e === void 0 ? void 0 : _e.value;
     const lastRefreshAt = lastRefreshAtStr ? parseInt(lastRefreshAtStr, 10) : null;
-    return { accessToken, refreshToken, expiresAt, lastRefreshAt };
+    return { accessToken, refreshToken, expiresAt, lastRefreshAt, tokenType };
 }
 /**
  * Clear all auth cookies
@@ -270,6 +290,7 @@ function clearTokens(ctx, cookieConfig = {}) {
     ctx.cookies.delete(names.refreshToken, Object.assign(Object.assign({}, options), { path: '/' }));
     ctx.cookies.delete(names.expiresAt, Object.assign(Object.assign({}, options), { path: '/' }));
     ctx.cookies.delete(names.lastRefreshAt, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.tokenType, Object.assign(Object.assign({}, options), { path: '/' }));
 }
 
 // packages/astro-tokenkit/src/utils/time.ts
@@ -371,7 +392,8 @@ function isExpired(expiresAt, now, policy = {}) {
     const clockSkew = typeof normalized.clockSkew === 'number'
         ? normalized.clockSkew
         : parseTime(normalized.clockSkew);
-    return now > expiresAt + clockSkew;
+    // Pessimistic: consider it expired if current time + skew is past expiration
+    return now + clockSkew > expiresAt;
 }
 
 // packages/astro-tokenkit/src/auth/manager.ts
@@ -417,7 +439,7 @@ class TokenManager {
      */
     login(ctx, credentials, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const url = this.baseURL + this.config.login;
+            const url = this.joinURL(this.baseURL, this.config.login);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
             const data = Object.assign(Object.assign(Object.assign({}, this.config.loginData), options === null || options === void 0 ? void 0 : options.data), credentials);
@@ -428,15 +450,25 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
-            const response = yield fetch(url, {
-                method: 'POST',
-                headers,
-                body: requestBody,
-            }).catch(error => {
-                throw new AuthError(`Login request failed: ${error.message}`);
-            });
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
+                const authError = new AuthError(`Login request failed: ${error.message}`);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
+            }
             if (!response.ok) {
-                throw new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
+                const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
             }
             const body = yield response.json().catch(() => ({}));
             // Parse response
@@ -447,7 +479,10 @@ class TokenManager {
                     : autoDetectFields(body, this.config.fields);
             }
             catch (error) {
-                throw new AuthError(`Invalid login response: ${error.message}`, response.status, response);
+                const authError = new AuthError(`Invalid login response: ${error.message}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
             }
             // Store in cookies
             storeTokens(ctx, bundle, this.config.cookies);
@@ -455,7 +490,14 @@ class TokenManager {
             if (options === null || options === void 0 ? void 0 : options.onLogin) {
                 yield options.onLogin(bundle, body, ctx);
             }
-            return bundle;
+            return {
+                data: bundle,
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+                url: response.url,
+                ok: response.ok,
+            };
         });
     }
     /**
@@ -477,7 +519,7 @@ class TokenManager {
      */
     performRefresh(ctx, refreshToken, options, extraHeaders) {
         return __awaiter(this, void 0, void 0, function* () {
-            const url = this.baseURL + this.config.refresh;
+            const url = this.joinURL(this.baseURL, this.config.refresh);
             const contentType = this.config.contentType || 'application/json';
             const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
             const refreshField = this.config.refreshRequestField || 'refreshToken';
@@ -489,13 +531,17 @@ class TokenManager {
             else {
                 requestBody = JSON.stringify(data);
             }
-            const response = yield fetch(url, {
-                method: 'POST',
-                headers,
-                body: requestBody,
-            }).catch(error => {
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
                 throw new AuthError(`Refresh request failed: ${error.message}`);
-            });
+            }
             if (!response.ok) {
                 // 401/403 = invalid refresh token
                 if (response.status === 401 || response.status === 403) {
@@ -529,7 +575,7 @@ class TokenManager {
      */
     ensure(ctx, options, headers) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f;
             const now = Math.floor(Date.now() / 1000);
             const tokens = retrieveTokens(ctx, this.config.cookies);
             // No tokens
@@ -545,6 +591,7 @@ class TokenManager {
                 return {
                     accessToken: bundle.accessToken,
                     expiresAt: bundle.accessExpiresAt,
+                    tokenType: bundle.tokenType,
                     payload: (_b = (_a = bundle.sessionPayload) !== null && _a !== void 0 ? _a : parseJWTPayload(bundle.accessToken)) !== null && _b !== void 0 ? _b : undefined,
                 };
             }
@@ -556,6 +603,7 @@ class TokenManager {
                     return {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.accessExpiresAt,
+                        tokenType: bundle.tokenType,
                         payload: (_d = (_c = bundle.sessionPayload) !== null && _c !== void 0 ? _c : parseJWTPayload(bundle.accessToken)) !== null && _d !== void 0 ? _d : undefined,
                     };
                 }
@@ -569,7 +617,8 @@ class TokenManager {
             return {
                 accessToken: tokens.accessToken,
                 expiresAt: tokens.expiresAt,
-                payload: (_e = parseJWTPayload(tokens.accessToken)) !== null && _e !== void 0 ? _e : undefined,
+                tokenType: (_e = tokens.tokenType) !== null && _e !== void 0 ? _e : undefined,
+                payload: (_f = parseJWTPayload(tokens.accessToken)) !== null && _f !== void 0 ? _f : undefined,
             };
         });
     }
@@ -578,15 +627,22 @@ class TokenManager {
      */
     logout(ctx) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             // Optionally call logout endpoint
             if (this.config.logout) {
                 try {
-                    const url = this.baseURL + this.config.logout;
-                    yield fetch(url, { method: 'POST' });
+                    const url = this.joinURL(this.baseURL, this.config.logout);
+                    const session = this.getSession(ctx);
+                    const headers = {};
+                    if (session === null || session === void 0 ? void 0 : session.accessToken) {
+                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
+                    }
+                    yield fetch(url, { method: 'POST', headers });
                 }
                 catch (error) {
                     // Ignore logout endpoint errors
-                    console.warn('Logout endpoint failed:', error);
+                    console.warn('[TokenKit] Logout endpoint failed:', error);
                 }
             }
             clearTokens(ctx, this.config.cookies);
@@ -596,7 +652,7 @@ class TokenManager {
      * Get current session (no refresh)
      */
     getSession(ctx) {
-        var _a;
+        var _a, _b;
         const tokens = retrieveTokens(ctx, this.config.cookies);
         if (!tokens.accessToken || !tokens.expiresAt) {
             return null;
@@ -604,7 +660,8 @@ class TokenManager {
         return {
             accessToken: tokens.accessToken,
             expiresAt: tokens.expiresAt,
-            payload: (_a = parseJWTPayload(tokens.accessToken)) !== null && _a !== void 0 ? _a : undefined,
+            tokenType: (_a = tokens.tokenType) !== null && _a !== void 0 ? _a : undefined,
+            payload: (_b = parseJWTPayload(tokens.accessToken)) !== null && _b !== void 0 ? _b : undefined,
         };
     }
     /**
@@ -618,57 +675,80 @@ class TokenManager {
      * Create flight key for single-flight deduplication
      */
     createFlightKey(token) {
-        let hash = 0;
-        for (let i = 0; i < token.length; i++) {
-            const char = token.charCodeAt(i);
-            hash = ((hash << 5) - hash) + char;
-            hash = hash & hash;
-        }
-        return `flight_${Math.abs(hash).toString(36)}`;
+        // Avoid weak hashing of sensitive tokens
+        return `refresh_${token}`;
+    }
+    /**
+     * Join base URL and path safely
+     */
+    joinURL(base, path) {
+        const b = base.endsWith('/') ? base : base + '/';
+        const p = path.startsWith('/') ? path.slice(1) : path;
+        return b + p;
     }
 }
 
 // packages/astro-tokenkit/src/config.ts
-let config = {
-    runWithContext: undefined,
-    getContextStore: undefined,
-    setContextStore: undefined,
-    baseURL: "",
-};
-let tokenManager;
+const CONFIG_KEY = Symbol.for('astro-tokenkit.config');
+const MANAGER_KEY = Symbol.for('astro-tokenkit.manager');
+const globalStorage = globalThis;
+// Initialize global storage if not present
+if (!globalStorage[CONFIG_KEY]) {
+    globalStorage[CONFIG_KEY] = {
+        runWithContext: undefined,
+        getContextStore: undefined,
+        setContextStore: undefined,
+        baseURL: "",
+    };
+}
 /**
  * Set configuration
  */
 function setConfig(userConfig) {
-    const finalConfig = Object.assign(Object.assign({}, config), userConfig);
+    const currentConfig = globalStorage[CONFIG_KEY];
+    const finalConfig = Object.assign(Object.assign({}, currentConfig), userConfig);
     // Validate that getter and setter are defined together
     if ((finalConfig.getContextStore && !finalConfig.setContextStore) ||
         (!finalConfig.getContextStore && finalConfig.setContextStore)) {
         throw new Error("[TokenKit] getContextStore and setContextStore must be defined together.");
     }
-    config = finalConfig;
+    globalStorage[CONFIG_KEY] = finalConfig;
     // Re-initialize global token manager if auth changed
-    if (config.auth) {
-        tokenManager = new TokenManager(config.auth, config.baseURL);
+    if (finalConfig.auth) {
+        globalStorage[MANAGER_KEY] = new TokenManager(finalConfig.auth, finalConfig.baseURL);
+    }
+    else {
+        globalStorage[MANAGER_KEY] = undefined;
     }
 }
 /**
  * Get current configuration
  */
 function getConfig() {
-    return config;
+    return globalStorage[CONFIG_KEY];
 }
 /**
  * Get global token manager
  */
 function getTokenManager() {
-    return tokenManager;
+    return globalStorage[MANAGER_KEY];
 }
 /**
  * Set global token manager (mainly for testing)
  */
 function setTokenManager(manager) {
-    tokenManager = manager;
+    globalStorage[MANAGER_KEY] = manager;
+}
+// Handle injected configuration from Astro integration
+try {
+    // @ts-ignore
+    const injectedConfig = typeof __TOKENKIT_CONFIG__ !== 'undefined' ? __TOKENKIT_CONFIG__ : undefined;
+    if (injectedConfig) {
+        setConfig(injectedConfig);
+    }
+}
+catch (e) {
+    // Ignore errors in environments where __TOKENKIT_CONFIG__ might be restricted
 }
 
 // packages/astro-tokenkit/src/client/context.ts
@@ -762,8 +842,8 @@ function createMiddleware() {
                     yield tokenManager.ensure(ctx);
                 }
                 catch (error) {
-                    // Log but don't block a request if rotation fails
-                    console.error('[TokenKit] Automatic token rotation failed:', error);
+                    // Log only the message to avoid leaking sensitive data in the error object
+                    console.error('[TokenKit] Automatic token rotation failed:', error.message || error);
                 }
             }
             return next();
@@ -892,8 +972,7 @@ class APIClient {
             while (true) {
                 attempt++;
                 try {
-                    const response = yield this.executeRequest(config, ctx, attempt);
-                    return response.data;
+                    return yield this.executeRequest(config, ctx, attempt);
                 }
                 catch (error) {
                     // Check if we should retry
@@ -921,7 +1000,7 @@ class APIClient {
             // Build full URL
             const fullURL = this.buildURL(config.url, config.params);
             // Build headers
-            const headers = this.buildHeaders(config, ctx);
+            const headers = this.buildHeaders(config, ctx, fullURL);
             // Build request init
             const init = {
                 method: config.method,
@@ -1018,6 +1097,7 @@ class APIClient {
                 statusText: response.statusText,
                 headers: response.headers,
                 url,
+                ok: response.ok,
             };
         });
     }
@@ -1039,19 +1119,33 @@ class APIClient {
     /**
      * Build request headers
      */
-    buildHeaders(config, ctx) {
+    buildHeaders(config, ctx, targetURL) {
         var _a, _b;
         const headers = Object.assign(Object.assign({ 'Content-Type': 'application/json' }, this.config.headers), config.headers);
-        // Add auth token if available
-        if (this.tokenManager && !config.skipAuth) {
+        // Add auth token if available (only for safe URLs)
+        if (this.tokenManager && !config.skipAuth && this.isSafeURL(targetURL)) {
             const session = this.tokenManager.getSession(ctx);
             if (session === null || session === void 0 ? void 0 : session.accessToken) {
-                const injectFn = (_b = (_a = this.config.auth) === null || _a === void 0 ? void 0 : _a.injectToken) !== null && _b !== void 0 ? _b : ((token) => `Bearer ${token}`);
-                headers['Authorization'] = injectFn(session.accessToken);
+                const injectFn = (_b = (_a = this.config.auth) === null || _a === void 0 ? void 0 : _a.injectToken) !== null && _b !== void 0 ? _b : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
             }
         }
         return headers;
     }
+    /**
+     * Check if a URL is safe for token injection (same origin as baseURL)
+     */
+    isSafeURL(url) {
+        try {
+            const requestUrl = new URL(url, this.config.baseURL);
+            const baseUrl = new URL(this.config.baseURL || 'http://localhost');
+            return requestUrl.origin === baseUrl.origin;
+        }
+        catch (_a) {
+            // Only allow relative paths if baseURL is missing or invalid
+            return !url.startsWith('http') && !url.startsWith('//');
+        }
+    }
     /**
      * Login
      */
@@ -1061,7 +1155,7 @@ class APIClient {
                 throw new Error('Auth is not configured for this client');
             }
             const context = getContextStore();
-            yield this.tokenManager.login(context, credentials, options);
+            return this.tokenManager.login(context, credentials, options);
         });
     }
     /**
@@ -1139,11 +1233,23 @@ function createClient(config) {
  */
 function tokenKit(config) {
     setConfig(config);
+    // Create a serializable version of the config for the runtime
+    const serializableConfig = JSON.parse(JSON.stringify(config, (key, value) => {
+        if (typeof value === 'function')
+            return undefined;
+        return value;
+    }));
     return {
         name: 'astro-tokenkit',
         hooks: {
-            'astro:config:setup': () => {
-                // Future-proofing: could add vite aliases or other setup here
+            'astro:config:setup': ({ updateConfig }) => {
+                updateConfig({
+                    vite: {
+                        define: {
+                            '__TOKENKIT_CONFIG__': JSON.stringify(serializableConfig)
+                        }
+                    }
+                });
                 console.log('[TokenKit] Integration initialized');
             },
         },