nextly 0.0.1 → 0.0.2-alpha.0

package/dist/chunk-2ZFKXPQM.mjs

@@ -0,0 +1,88 @@
+import {
+  secretToKey
+} from "./chunk-X23WKS3Z.mjs";
+
+// src/auth/cookies/cookie-config.ts
+var COOKIE_NAMES = {
+  accessToken: "nextly_session",
+  refreshToken: "nextly_refresh",
+  csrf: "nextly_csrf"
+};
+var COOKIE_PATHS = {
+  accessToken: "/admin",
+  refreshToken: "/admin/api/auth/refresh",
+  csrf: "/admin"
+};
+function getCookieOptions(type, isProduction, maxAge) {
+  const base = {
+    httpOnly: type !== "csrf",
+    // CSRF cookie must be JS-readable
+    secure: isProduction,
+    sameSite: "lax",
+    path: COOKIE_PATHS[type]
+  };
+  if (maxAge !== void 0) {
+    base.maxAge = maxAge;
+  }
+  return base;
+}
+function serializeCookie(name, value, options) {
+  let cookie = `${name}=${encodeURIComponent(value)}`;
+  if (options.httpOnly) cookie += "; HttpOnly";
+  if (options.secure) cookie += "; Secure";
+  cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;
+  cookie += `; Path=${options.path}`;
+  if (options.maxAge !== void 0) cookie += `; Max-Age=${options.maxAge}`;
+  return cookie;
+}
+function serializeClearCookie(name, path) {
+  return `${name}=; Path=${path}; Max-Age=0; HttpOnly; SameSite=Lax`;
+}
+function parseCookie(cookieHeader, name) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
+  return match ? decodeURIComponent(match[1]) : null;
+}
+
+// src/auth/cookies/access-token-cookie.ts
+function setAccessTokenCookie(token, cookieMaxAgeSeconds, isProduction) {
+  const options = getCookieOptions(
+    "accessToken",
+    isProduction,
+    cookieMaxAgeSeconds
+  );
+  return serializeCookie(COOKIE_NAMES.accessToken, token, options);
+}
+function clearAccessTokenCookie() {
+  return serializeClearCookie(COOKIE_NAMES.accessToken, "/admin");
+}
+function readAccessTokenCookie(request) {
+  return parseCookie(request.headers.get("cookie"), COOKIE_NAMES.accessToken);
+}
+
+// src/auth/jwt/verify.ts
+import { jwtVerify, errors as joseErrors } from "jose";
+async function verifyAccessToken(token, secret) {
+  try {
+    const key = secretToKey(secret);
+    const { payload } = await jwtVerify(token, key);
+    return { valid: true, payload };
+  } catch (error) {
+    if (error instanceof joseErrors.JWTExpired) {
+      return { valid: false, reason: "expired" };
+    }
+    return { valid: false, reason: "invalid" };
+  }
+}
+
+export {
+  COOKIE_NAMES,
+  getCookieOptions,
+  serializeCookie,
+  serializeClearCookie,
+  parseCookie,
+  setAccessTokenCookie,
+  clearAccessTokenCookie,
+  readAccessTokenCookie,
+  verifyAccessToken
+};