clearauth 0.3.0

package/dist/utils/cors.js

@@ -0,0 +1,152 @@
+/**
+ * CORS (Cross-Origin Resource Sharing) Utilities
+ *
+ * Provides utilities for handling CORS headers in authentication endpoints.
+ * Essential for browser-based clients making cross-origin requests.
+ */
+/**
+ * Default CORS configuration
+ */
+const DEFAULT_CORS_CONFIG = {
+    origin: '*',
+    credentials: true,
+    methods: ['GET', 'POST', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+    exposedHeaders: [],
+    maxAge: 86400, // 24 hours
+};
+/**
+ * Check if origin is allowed
+ *
+ * @param origin - Request origin header
+ * @param allowedOrigins - Configured allowed origins
+ * @returns True if origin is allowed
+ */
+function isOriginAllowed(origin, allowedOrigins) {
+    if (!origin)
+        return false;
+    // Allow all origins
+    if (allowedOrigins === '*')
+        return true;
+    // Check against array of allowed origins
+    if (Array.isArray(allowedOrigins)) {
+        return allowedOrigins.includes(origin);
+    }
+    // Check against single origin
+    return allowedOrigins === origin;
+}
+/**
+ * Create CORS headers for a response
+ *
+ * @param request - HTTP request
+ * @param config - CORS configuration
+ * @returns Headers object with CORS headers
+ *
+ * @example
+ * ```ts
+ * const headers = createCorsHeaders(request, config.cors)
+ * return new Response(body, { headers })
+ * ```
+ */
+export function createCorsHeaders(request, config) {
+    const headers = new Headers();
+    const corsConfig = { ...DEFAULT_CORS_CONFIG, ...config };
+    const origin = request.headers.get('Origin');
+    // Set Access-Control-Allow-Origin
+    if (corsConfig.origin === '*') {
+        headers.set('Access-Control-Allow-Origin', '*');
+    }
+    else if (origin && isOriginAllowed(origin, corsConfig.origin)) {
+        headers.set('Access-Control-Allow-Origin', origin);
+        headers.set('Vary', 'Origin');
+    }
+    // Set Access-Control-Allow-Credentials
+    if (corsConfig.credentials) {
+        headers.set('Access-Control-Allow-Credentials', 'true');
+    }
+    // Set Access-Control-Allow-Methods
+    headers.set('Access-Control-Allow-Methods', corsConfig.methods.join(', '));
+    // Set Access-Control-Allow-Headers
+    headers.set('Access-Control-Allow-Headers', corsConfig.allowedHeaders.join(', '));
+    // Set Access-Control-Expose-Headers (if any)
+    if (corsConfig.exposedHeaders.length > 0) {
+        headers.set('Access-Control-Expose-Headers', corsConfig.exposedHeaders.join(', '));
+    }
+    // Set Access-Control-Max-Age
+    headers.set('Access-Control-Max-Age', corsConfig.maxAge.toString());
+    return headers;
+}
+/**
+ * Handle CORS preflight request (OPTIONS)
+ *
+ * @param request - HTTP OPTIONS request
+ * @param config - CORS configuration
+ * @returns Response with CORS headers
+ *
+ * @example
+ * ```ts
+ * if (request.method === 'OPTIONS') {
+ *   return handleCorsPreflightRequest(request, config.cors)
+ * }
+ * ```
+ */
+export function handleCorsPreflightRequest(request, config) {
+    const headers = createCorsHeaders(request, config);
+    return new Response(null, {
+        status: 204,
+        headers,
+    });
+}
+/**
+ * Add CORS headers to an existing response
+ *
+ * @param response - Original response
+ * @param request - HTTP request
+ * @param config - CORS configuration
+ * @returns Response with CORS headers added
+ *
+ * @example
+ * ```ts
+ * const response = await handleAuthRequest(request, config)
+ * return addCorsHeaders(response, request, config.cors)
+ * ```
+ */
+export function addCorsHeaders(response, request, config) {
+    const corsHeaders = createCorsHeaders(request, config);
+    // Clone response and add CORS headers
+    const newHeaders = new Headers(response.headers);
+    corsHeaders.forEach((value, key) => {
+        newHeaders.set(key, value);
+    });
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: newHeaders,
+    });
+}
+/**
+ * Wrap a request handler with CORS support
+ *
+ * @param handler - Original request handler
+ * @param config - CORS configuration
+ * @returns Wrapped handler with CORS support
+ *
+ * @example
+ * ```ts
+ * const handleWithCors = withCors(handleAuthRequest, config.cors)
+ * return handleWithCors(request, config)
+ * ```
+ */
+export function withCors(handler, corsConfig) {
+    return async (request, config) => {
+        // Handle preflight requests
+        if (request.method === 'OPTIONS') {
+            return handleCorsPreflightRequest(request, corsConfig);
+        }
+        // Handle actual request
+        const response = await handler(request, config);
+        // Add CORS headers to response
+        return addCorsHeaders(response, request, corsConfig);
+    };
+}
+//# sourceMappingURL=cors.js.map

package/dist/utils/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/utils/cors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,MAAM,mBAAmB,GAAyB;IAChD,MAAM,EAAE,GAAG;IACX,WAAW,EAAE,IAAI;IACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IACnC,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IACjD,cAAc,EAAE,EAAE;IAClB,MAAM,EAAE,KAAK,EAAE,WAAW;CAC3B,CAAA;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,MAAqB,EAAE,cAAiC;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,oBAAoB;IACpB,IAAI,cAAc,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAEvC,yCAAyC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAClC,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED,8BAA8B;IAC9B,OAAO,cAAc,KAAK,MAAM,CAAA;AAClC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,MAAmB;IAEnB,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,MAAM,UAAU,GAAG,EAAE,GAAG,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAAA;IAExD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE5C,kCAAkC;IAClC,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IACjD,CAAC;SAAM,IAAI,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC/B,CAAC;IAED,uCAAuC;IACvC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;IACzD,CAAC;IAED,mCAAmC;IACnC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAE1E,mCAAmC;IACnC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAEjF,6CAA6C;IAC7C,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEnE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAgB,EAChB,MAAmB;IAEnB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAElD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG;QACX,OAAO;KACR,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAkB,EAClB,OAAgB,EAChB,MAAmB;IAEnB,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAEtD,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAChD,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,UAAU;KACpB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CACtB,OAA6D,EAC7D,UAAuB;IAEvB,OAAO,KAAK,EAAE,OAAgB,EAAE,MAAW,EAAqB,EAAE;QAChE,4BAA4B;QAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,0BAA0B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QACxD,CAAC;QAED,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAE/C,+BAA+B;QAC/B,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;IACtD,CAAC,CAAA;AACH,CAAC"}

package/dist/utils/normalize-auth-path.d.ts

@@ -0,0 +1 @@
+export declare function normalizeAuthPath(pathname: string): string;

package/dist/utils/normalize-auth-path.js

@@ -0,0 +1,8 @@
+export function normalizeAuthPath(pathname) {
+    let path = pathname.replace(/\/$/, '');
+    if (path.startsWith('/api/auth')) {
+        path = path.replace(/^\/api/, '');
+    }
+    return path;
+}
+//# sourceMappingURL=normalize-auth-path.js.map

package/dist/utils/normalize-auth-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-auth-path.js","sourceRoot":"","sources":["../../src/utils/normalize-auth-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/validation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Validation utilities for ClearAuth
+ */
+/**
+ * Validate that a string is a valid URL
+ */
+export declare function validateUrl(url: string, fieldName?: string): void;
+/**
+ * Validate that a string is a valid UUID (with optional prefix like "app_", "user_")
+ */
+export declare function validateUuid(value: string, fieldName?: string): void;
+/**
+ * Validate that a string is not empty
+ */
+export declare function validateNonEmpty(value: string | undefined, fieldName: string): string;
+/**
+ * Validate that a number is positive
+ */
+export declare function validatePositive(value: number, fieldName?: string): void;
+/**
+ * Validate that a number is within a range
+ */
+export declare function validateRange(value: number, min: number, max: number, fieldName?: string): void;

package/dist/validation.js

@@ -0,0 +1,70 @@
+/**
+ * Validation utilities for ClearAuth
+ */
+import { ClearAuthConfigError } from "./errors.js";
+// UUID regex that also accepts common prefixes like "app_", "user_", etc.
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const PREFIXED_UUID_REGEX = /^[a-z]+_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Validate that a string is a valid URL
+ */
+export function validateUrl(url, fieldName = "URL") {
+    try {
+        new URL(url);
+    }
+    catch (err) {
+        throw new ClearAuthConfigError(`Invalid ${fieldName}: "${url}" is not a valid URL`, {
+            fieldName,
+            url,
+            error: err.message
+        });
+    }
+}
+/**
+ * Validate that a string is a valid UUID (with optional prefix like "app_", "user_")
+ */
+export function validateUuid(value, fieldName = "UUID") {
+    if (!UUID_REGEX.test(value) && !PREFIXED_UUID_REGEX.test(value)) {
+        throw new ClearAuthConfigError(`Invalid ${fieldName}: "${value}" is not a valid UUID`, {
+            fieldName,
+            value
+        });
+    }
+}
+/**
+ * Validate that a string is not empty
+ */
+export function validateNonEmpty(value, fieldName) {
+    if (!value || value.trim() === "") {
+        throw new ClearAuthConfigError(`${fieldName} is required and cannot be empty`, {
+            fieldName,
+            value
+        });
+    }
+    return value;
+}
+/**
+ * Validate that a number is positive
+ */
+export function validatePositive(value, fieldName = "value") {
+    if (value <= 0) {
+        throw new ClearAuthConfigError(`${fieldName} must be positive, got ${value}`, {
+            fieldName,
+            value
+        });
+    }
+}
+/**
+ * Validate that a number is within a range
+ */
+export function validateRange(value, min, max, fieldName = "value") {
+    if (value < min || value > max) {
+        throw new ClearAuthConfigError(`${fieldName} must be between ${min} and ${max}, got ${value}`, {
+            fieldName,
+            value,
+            min,
+            max
+        });
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAElD,0EAA0E;AAC1E,MAAM,UAAU,GAAG,iEAAiE,CAAA;AACpF,MAAM,mBAAmB,GAAG,wEAAwE,CAAA;AAEpG;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,YAAoB,KAAK;IAChE,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAAC,WAAW,SAAS,MAAM,GAAG,sBAAsB,EAAE;YAClF,SAAS;YACT,GAAG;YACH,KAAK,EAAG,GAAa,CAAC,OAAO;SAC9B,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,YAAoB,MAAM;IACpE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,oBAAoB,CAAC,WAAW,SAAS,MAAM,KAAK,uBAAuB,EAAE;YACrF,SAAS;YACT,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAyB,EAAE,SAAiB;IAC3E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,kCAAkC,EAAE;YAC7E,SAAS;YACT,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAAoB,OAAO;IACzE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,0BAA0B,KAAK,EAAE,EAAE;YAC5E,SAAS;YACT,KAAK;SACN,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW,EAAE,YAAoB,OAAO;IAChG,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,oBAAoB,GAAG,QAAQ,GAAG,SAAS,KAAK,EAAE,EAAE;YAC7F,SAAS;YACT,KAAK;YACL,GAAG;YACH,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,93 @@
+{
+  "name": "clearauth",
+  "version": "0.3.0",
+  "description": "ClearAuth: lightweight authentication library with Arctic OAuth, pluggable password hashing, and Kysely-backed storage",
+  "keywords": [
+    "clearauth",
+    "auth",
+    "arctic",
+    "oauth",
+    "argon2id",
+    "authentication",
+    "sessions",
+    "typescript",
+    "cloudflare-workers"
+  ],
+  "author": "Dundas",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dundas/clearauth.git"
+  },
+  "bugs": {
+    "url": "https://github.com/dundas/clearauth/issues"
+  },
+  "homepage": "https://github.com/dundas/clearauth#readme",
+  "private": false,
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./react": {
+      "import": "./dist/react.js",
+      "types": "./dist/react.d.ts"
+    },
+    "./edge": {
+      "import": "./dist/edge.js",
+      "types": "./dist/edge.d.ts"
+    },
+    "./argon2": {
+      "import": "./dist/password-hasher-argon2.js",
+      "types": "./dist/password-hasher-argon2.d.ts"
+    },
+    "./node": {
+      "import": "./dist/node.js",
+      "types": "./dist/node.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json",
+    "prepare": "npm run build",
+    "prepack": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:ui": "vitest --ui",
+    "test:coverage": "vitest --coverage"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@node-rs/argon2": "^2.0.2",
+    "arctic": "^3.0.0",
+    "kysely": "^0.27.3",
+    "oslo": "^1.2.0"
+  },
+  "devDependencies": {
+    "@types/react": "^18.2.0",
+    "@types/node": "^22.10.0",
+    "@vitest/coverage-v8": "^1.0.0",
+    "@vitest/ui": "^1.0.0",
+    "react": "^18.2.0",
+    "typescript": "^5.6.3",
+    "vitest": "^1.0.0"
+  }
+}