effortless-aws 0.27.1 → 0.29.0

package/dist/{chunk-UXSZNW5A.js → chunk-ISJC6CHC.js}

@@ -251,7 +251,8 @@ var toSeconds = (d) => {
 
 // src/handlers/auth.ts
 var AUTH_COOKIE_NAME = "__eff_session";
-var createAuthRuntime = (secret, defaultExpiresIn) => {
+var createAuthRuntime = (secret, defaultExpiresIn, apiTokenVerify, apiTokenHeader, apiTokenCacheTtlSeconds) => {
+  const tokenCache = apiTokenCacheTtlSeconds ? /* @__PURE__ */ new Map() : void 0;
   const sign = (payload) => crypto.createHmac("sha256", secret).update(payload).digest("base64url");
   const cookieBase = `${AUTH_COOKIE_NAME}=`;
   const cookieAttrs = "; HttpOnly; Secure; SameSite=Lax; Path=/";
@@ -271,36 +272,55 @@ var createAuthRuntime = (secret, defaultExpiresIn) => {
       return void 0;
     }
   };
-  return {
-    forRequest(cookieValue) {
+  const extractTokenValue = (headerValue) => {
+    const isDefaultHeader = !apiTokenHeader || apiTokenHeader.toLowerCase() === "authorization";
+    if (isDefaultHeader && headerValue.toLowerCase().startsWith("bearer ")) {
+      return headerValue.slice(7);
+    }
+    return headerValue;
+  };
+  const buildHelpers = (sessionData) => ({
+    createSession(data, options) {
+      const seconds = options?.expiresIn ? toSeconds(options.expiresIn) : defaultExpiresIn;
+      const exp = Math.floor(Date.now() / 1e3) + seconds;
+      const payload = Buffer.from(JSON.stringify({ exp, ...data }), "utf-8").toString("base64url");
+      const sig = sign(payload);
       return {
-        grant(...args) {
-          const hasData = args.length > 0 && (typeof args[0] === "object" && args[0] !== null && !("expiresIn" in args[0]));
-          const data = hasData ? args[0] : void 0;
-          const options = hasData ? args[1] : args[0];
-          const seconds = options?.expiresIn ? toSeconds(options.expiresIn) : defaultExpiresIn;
-          const exp = Math.floor(Date.now() / 1e3) + seconds;
-          const payload = Buffer.from(JSON.stringify({ exp, ...data }), "utf-8").toString("base64url");
-          const sig = sign(payload);
-          return {
-            status: 200,
-            body: { ok: true },
-            headers: {
-              "set-cookie": `${cookieBase}${payload}.${sig}${cookieAttrs}; Max-Age=${seconds}`
-            }
-          };
-        },
-        revoke() {
-          return {
-            status: 200,
-            body: { ok: true },
-            headers: {
-              "set-cookie": `${cookieBase}${cookieAttrs}; Max-Age=0`
-            }
-          };
-        },
-        session: decodeSession(cookieValue)
+        status: 200,
+        body: { ok: true },
+        headers: {
+          "set-cookie": `${cookieBase}${payload}.${sig}${cookieAttrs}; Max-Age=${seconds}`
+        }
+      };
+    },
+    clearSession() {
+      return {
+        status: 200,
+        body: { ok: true },
+        headers: {
+          "set-cookie": `${cookieBase}${cookieAttrs}; Max-Age=0`
+        }
       };
+    },
+    session: sessionData
+  });
+  return {
+    async forRequest(cookieValue, authHeader) {
+      if (authHeader && apiTokenVerify) {
+        const tokenValue = extractTokenValue(authHeader);
+        if (tokenCache) {
+          const cached = tokenCache.get(tokenValue);
+          if (cached && cached.expiresAt > Date.now()) {
+            return buildHelpers(cached.session);
+          }
+        }
+        const session = await apiTokenVerify({ value: tokenValue });
+        if (tokenCache && apiTokenCacheTtlSeconds) {
+          tokenCache.set(tokenValue, { session, expiresAt: Date.now() + apiTokenCacheTtlSeconds * 1e3 });
+        }
+        return buildHelpers(session);
+      }
+      return buildHelpers(decodeSession(cookieValue));
     }
   };
 };
@@ -478,7 +498,6 @@ var getParameters = async (names) => {
 // src/runtime/handler-utils.ts
 var ENV_DEP_PREFIX = "EFF_DEP_";
 var ENV_PARAM_PREFIX = "EFF_PARAM_";
-var ENV_AUTH_SECRET = "EFF_AUTH_SECRET";
 var LOG_RANK = { error: 0, info: 1, debug: 2 };
 var truncate = (value, maxLength = 4096) => {
   if (value === void 0 || value === null) return value;
@@ -554,18 +573,27 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     resolvedParams = await buildParams(handler.config);
     return resolvedParams;
   };
-  const getAuthRuntime = async () => {
+  const getAuthRuntime = async (setupCtx) => {
     if (resolvedAuthRuntime !== null) return resolvedAuthRuntime;
-    const ssmPath = process.env[ENV_AUTH_SECRET];
-    if (!ssmPath || !handler.auth) {
+    const authOpts = setupCtx && typeof setupCtx === "object" && "auth" in setupCtx ? setupCtx.auth : void 0;
+    if (!authOpts?.secret) {
       resolvedAuthRuntime = void 0;
       return void 0;
     }
-    const values = await getParameters([ssmPath]);
-    const secret = values.get(ssmPath);
-    if (!secret) throw new Error(`Auth secret not found at ${ssmPath}`);
-    const defaultExpires = handler.auth.expiresIn ? toSeconds(handler.auth.expiresIn) : 604800;
-    resolvedAuthRuntime = createAuthRuntime(secret, defaultExpires);
+    const secret = authOpts.secret;
+    resolvedAuthHeaderName = authOpts.apiToken?.header;
+    const defaultExpires = authOpts.expiresIn ? toSeconds(authOpts.expiresIn) : 604800;
+    const apiToken = authOpts.apiToken;
+    const cacheTtlSeconds = apiToken?.cacheTtl ? toSeconds(apiToken.cacheTtl) : void 0;
+    const rawVerify = apiToken?.verify;
+    const wrappedVerify = rawVerify ? (args) => rawVerify(args.value) : void 0;
+    resolvedAuthRuntime = createAuthRuntime(
+      secret,
+      defaultExpires,
+      wrappedVerify,
+      apiToken?.header,
+      cacheTtlSeconds
+    );
     return resolvedAuthRuntime;
   };
   const getSetup = async () => {
@@ -573,7 +601,7 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     if (handler.setup) {
       const params = await getParams();
       const deps = getDeps();
-      const args = {};
+      const args = { enableAuth: (opts) => opts };
       if (params) args.config = params;
       if (deps) args.deps = deps;
       if (handler.static) args.files = staticFiles;
@@ -582,7 +610,8 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     }
     return ctx;
   };
-  const commonArgs = async (cookieValue) => {
+  let resolvedAuthHeaderName;
+  const commonArgs = async (cookieValue, authHeader, headers) => {
     const args = {};
     if (handler.setup) args.ctx = await getSetup();
     const deps = getDeps();
@@ -590,8 +619,14 @@ var createHandlerRuntime = (handler, handlerType, logLevel = "info", extraSetupA
     const params = await getParams();
     if (params) args.config = params;
     if (handler.static) args.files = staticFiles;
-    const authRuntime = await getAuthRuntime();
-    if (authRuntime) args.auth = authRuntime.forRequest(cookieValue);
+    const authRuntime = await getAuthRuntime(args.ctx);
+    if (authRuntime) {
+      let finalAuthHeader = authHeader;
+      if (finalAuthHeader === void 0 && headers && resolvedAuthHeaderName) {
+        finalAuthHeader = headers[resolvedAuthHeaderName] ?? headers[resolvedAuthHeaderName.toLowerCase()] ?? void 0;
+      }
+      args.auth = await authRuntime.forRequest(cookieValue, finalAuthHeader);
+    }
     return args;
   };
   const logExecution = (startTime, input, output) => {