cortex-auth 1.0.0 → 1.1.0

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './payload-jwt';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export * from './payload-jwt';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}

package/dist/payload-jwt/authenticateRequest.d.ts

@@ -0,0 +1,13 @@
+import { type Payload } from 'payload';
+import { NextAuthRequest } from "next-auth";
+export declare function authenticateRequest({ req, payload }: {
+    req: NextAuthRequest;
+    payload?: Payload;
+}): Promise<{
+    id: string | number;
+    email: any;
+    name: any;
+    role: any;
+    method: string;
+}>;
+//# sourceMappingURL=authenticateRequest.d.ts.map

package/dist/payload-jwt/authenticateRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticateRequest.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAqC5C,wBAAsB,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;GAwDtG"}

package/dist/payload-jwt/authenticateRequest.js

@@ -0,0 +1,63 @@
+import { verifySession } from "./user";
+export async function authenticateRequest({ req, payload }) {
+    let type = 'cookie';
+    if (req.auth) {
+        const user = req.auth.user;
+        return {
+            id: user.id,
+            email: user.email,
+            name: user.name,
+            role: user.role,
+            method: 'cookie',
+        };
+    }
+    else {
+        type = 'bearer';
+        const session = await verifySession(req);
+        if (!session || !session.sub || !session.extra)
+            throw new Error("No valid session found");
+        if (!payload)
+            throw new Error("Payload instance is required for Keycloak user normalisation");
+        const payloadUser = (await payload.find({ collection: 'users', depth: 1, limit: 1, draft: false, overrideAccess: true, where: { email: { equals: session.extra.email } } })).docs[0];
+        if (!payloadUser && session.extra) {
+            // create the user in Payload
+            const newUser = await payload.create({
+                collection: 'users',
+                data: {
+                    email: session.extra.email,
+                    name: session.extra.name,
+                    role: 'user',
+                    enabled: true,
+                    accounts: [
+                        {
+                            provider: 'keycloak', providerAccountId: session.sub, type: 'oidc',
+                        }
+                    ],
+                },
+                draft: false,
+                overrideAccess: true,
+            });
+            console.log("Created new Payload user for Keycloak user:", newUser.id, newUser.email);
+            return {
+                id: newUser.id,
+                email: newUser.email,
+                name: newUser.name,
+                role: newUser.role,
+                method: 'bearer',
+            };
+        }
+        else if (payloadUser) {
+            return {
+                id: payloadUser.id,
+                email: payloadUser.email,
+                name: payloadUser.name,
+                role: payloadUser.role,
+                method: 'bearer',
+            };
+        }
+        else {
+            throw new Error("No user found for the given session");
+        }
+    }
+}
+//# sourceMappingURL=authenticateRequest.js.map

package/dist/payload-jwt/authenticateRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticateRequest.js","sourceRoot":"","sources":["../../src/payload-jwt/authenticateRequest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAyCvC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAA+C;IACnG,IAAI,IAAI,GAAG,QAAQ,CAAA;IACnB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAY,CAAA;QAClC,OAAO;YACH,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,QAAQ;SACnB,CAAA;IACL,CAAC;SAAM,CAAC;QACJ,IAAI,GAAG,QAAQ,CAAA;QACf,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;QACzF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QAC7F,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEpL,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAChC,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBACjC,UAAU,EAAE,OAAO;gBACnB,IAAI,EAAE;oBACF,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;oBAC1B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;oBACxB,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACN;4BACI,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM;yBACrE;qBACJ;iBACJ;gBACD,KAAK,EAAE,KAAK;gBACZ,cAAc,EAAE,IAAI;aACvB,CAAC,CAAA;YACF,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YACrF,OAAO;gBACH,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACrB,OAAO;gBACH,EAAE,EAAE,WAAW,CAAC,EAAE;gBAClB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,MAAM,EAAE,QAAQ;aACnB,CAAA;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC1D,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/payload-jwt/index.d.ts

@@ -0,0 +1,3 @@
+export * from './user';
+export * from './authenticateRequest';
+//# sourceMappingURL=index.d.ts.map

package/dist/payload-jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA"}

package/dist/payload-jwt/index.js

@@ -0,0 +1,3 @@
+export * from './user';
+export * from './authenticateRequest';
+//# sourceMappingURL=index.js.map

package/dist/payload-jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/payload-jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAA;AACtB,cAAc,uBAAuB,CAAA"}

package/dist/payload-jwt/user.d.ts

@@ -0,0 +1,14 @@
+import type { NextRequest } from "next/server";
+export interface AuthInfo {
+    sub: string;
+    exp: number;
+    scopes: string[];
+    extra?: Record<string, any>;
+}
+export declare function verifySession(req: NextRequest): Promise<AuthInfo | undefined>;
+export declare function verifyToken(bearer: string): Promise<AuthInfo | undefined>;
+/**
+ * Check if a token is expired
+ */
+export declare function isTokenExpired(token: string): Promise<boolean>;
+//# sourceMappingURL=user.d.ts.map

package/dist/payload-jwt/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,QAAQ;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC/B;AA0CD,wBAAsB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAgCnF;AAID,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CA0B/E;AAGD;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMpE"}

package/dist/payload-jwt/user.js

@@ -0,0 +1,100 @@
+import { jwtVerify, createRemoteJWKSet, decodeJwt } from "jose";
+const OIDC_ISSUER = process.env.OAUTH_ISSUER; // e.g. https://login.microsoftonline.com/<tenant>/v2.0
+const OAUTH_DISCOVERY_URL = `${OIDC_ISSUER}/.well-known/openid-configuration`;
+// Fetch JWKS URL from OAuth well-known configuration
+async function getJwksUrl() {
+    const wellKnownUrl = OAUTH_DISCOVERY_URL;
+    try {
+        const response = await fetch(wellKnownUrl);
+        const config = await response.json();
+        return config.jwks_uri;
+    }
+    catch (error) {
+        console.error("Failed to fetch well-known config:", error);
+        // Fallback to the hardcoded path
+        const fallbackUrl = `${OAUTH_DISCOVERY_URL}/discovery/v2.0/keys`;
+        return fallbackUrl;
+    }
+}
+// Create JWKS instance - will be initialized lazily
+let JWKS = null;
+async function getJWKS() {
+    if (!JWKS) {
+        const jwksUrl = await getJwksUrl();
+        JWKS = createRemoteJWKSet(new URL(jwksUrl));
+    }
+    return JWKS;
+}
+function extractBearer(req) {
+    const h = req.headers.get("authorization");
+    if (!h)
+        return;
+    const [scheme, token] = h.split(" ");
+    if (scheme.toLowerCase() !== "bearer")
+        return;
+    return token;
+}
+// Verify Next Session and return AuthInfo
+export async function verifySession(req) {
+    const bearer = extractBearer(req);
+    if (bearer) {
+        // for development ONLY, use a dummy token
+        try {
+            const decodedJWT = decodeJwt(bearer);
+            // Get JWKS dynamically from well-known endpoint
+            const jwks = await getJWKS();
+            const { payload, protectedHeader } = await jwtVerify(bearer, jwks, {
+                issuer: OIDC_ISSUER,
+                algorithms: ["RS256"],
+            });
+            return {
+                sub: payload.sub ?? "unknown",
+                exp: payload.exp ?? 0,
+                scopes: typeof payload.scp === "string" ? payload.scp.split(" ") : [],
+                extra: { email: payload.email, name: payload.name },
+            };
+        }
+        catch (error) {
+            console.log("JWT verification failed:", error);
+            return undefined;
+        }
+    }
+    // fallback: NextAuth session (optional)
+    return undefined;
+}
+export async function verifyToken(bearer) {
+    if (bearer) {
+        // for development ONLY, use a dummy token
+        try {
+            const decodedJWT = decodeJwt(bearer);
+            // Get JWKS dynamically from well-known endpoint
+            const jwks = await getJWKS();
+            const { payload, protectedHeader } = await jwtVerify(bearer, jwks, {
+                issuer: OIDC_ISSUER,
+                algorithms: ["RS256"],
+            });
+            return {
+                sub: payload.sub ?? "unknown",
+                exp: payload.exp ?? 0,
+                scopes: typeof payload.scp === "string" ? payload.scp.split(" ") : [],
+                extra: { email: payload.email, name: payload.name },
+            };
+        }
+        catch (error) {
+            console.log("JWT verification failed:", error);
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * Check if a token is expired
+ */
+export async function isTokenExpired(token) {
+    const decoded = await verifyToken(token);
+    if (!decoded || !decoded.exp)
+        return true;
+    const currentTime = Math.floor(Date.now() / 1000);
+    return decoded.exp < currentTime;
+}
+//# sourceMappingURL=user.js.map

package/dist/payload-jwt/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/payload-jwt/user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAWhE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAa,CAAC,CAAC,uDAAuD;AACtG,MAAM,mBAAmB,GAAG,GAAG,WAAW,mCAAmC,CAAC;AAE9E,qDAAqD;AACrD,KAAK,UAAU,UAAU;IACrB,MAAM,YAAY,GAAG,mBAAmB,CAAC;IACzC,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA0B,CAAC;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAC3D,iCAAiC;QACjC,MAAM,WAAW,GAAG,GAAG,mBAAmB,sBAAsB,CAAC;QACjE,OAAO,WAAW,CAAC;IACvB,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,IAAI,IAAI,GAAiD,IAAI,CAAC;AAE9D,KAAK,UAAU,OAAO;IAClB,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;QACnC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO;IAC9C,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,0CAA0C;AAE1C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAgB;IAEhD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,MAAM,EAAE,CAAC;QACT,0CAA0C;QAC1C,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAErC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC/D,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,wCAAwC;IAExC,OAAO,SAAS,CAAC;AACrB,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC5C,IAAI,MAAM,EAAE,CAAC;QACT,0CAA0C;QAC1C,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAErC,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAE7B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE;gBAC/D,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,CAAC,OAAO,CAAC;aACxB,CAAC,CAAC;YAEH,OAAO;gBACH,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,SAAS;gBACzC,GAAG,EAAG,OAAO,CAAC,GAAc,IAAI,CAAC;gBACjC,MAAM,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACrE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;aACtD,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAGD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,GAAG,GAAG,WAAW,CAAC;AACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortex-auth",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Shared authentication utilities for Node.js and Next.js applications",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",
@@ -37,7 +37,9 @@
     "jsonwebtoken": "^9.0.3"
   },
   "peerDependencies": {
-    "next": ">=15.0.0"
+    "next": ">=15.0.0",
+    "next-auth": "5.0.0-beta.30",
+    "payload": "^3.70.0"
   },
   "peerDependenciesMeta": {
     "next": {
@@ -52,6 +54,8 @@
     "@typescript-eslint/parser": "^6.15.0",
     "eslint": "^8.56.0",
     "next": "^15.0.0",
+    "next-auth": "5.0.0-beta.30",
+    "payload": "^3.70.0",
     "typescript": "^5.3.3"
   }
 }