oauth.do 0.1.14 → 0.2.0

package/dist/hono.js

@@ -0,0 +1,198 @@
+import { getCookie } from 'hono/cookie';
+import * as jose from 'jose';
+
+// src/hono.ts
+var OAUTH_DO_CONFIG = {
+  clientId: "client_01JQYTRXK9ZPD8JPJTKDCRB656",
+  jwksUri: "https://api.workos.com/sso/jwks/client_01JQYTRXK9ZPD8JPJTKDCRB656"
+};
+var TOKEN_CACHE_TTL = 5 * 60;
+var CACHE_URL_PREFIX = "https://oauth.do/_cache/token/";
+async function hashToken(token) {
+  const data = new TextEncoder().encode(token);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function getCachedUser(token) {
+  try {
+    const cache = caches.default;
+    const hash = await hashToken(token);
+    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`);
+    const cached = await cache.match(cacheKey);
+    if (!cached) return null;
+    const data = await cached.json();
+    if (data.expiresAt < Date.now()) return null;
+    return data.user;
+  } catch {
+    return null;
+  }
+}
+async function cacheUser(token, user) {
+  try {
+    const cache = caches.default;
+    const hash = await hashToken(token);
+    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`);
+    const data = { user, expiresAt: Date.now() + TOKEN_CACHE_TTL * 1e3 };
+    const response = new Response(JSON.stringify(data), {
+      headers: { "Cache-Control": `max-age=${TOKEN_CACHE_TTL}` }
+    });
+    await cache.put(cacheKey, response);
+  } catch {
+  }
+}
+function extractToken(c, cookieName, headerName) {
+  const authHeader = c.req.header(headerName);
+  if (authHeader?.startsWith("Bearer ")) {
+    return authHeader.slice(7);
+  }
+  const cookie = getCookie(c, cookieName);
+  if (cookie) return cookie;
+  return null;
+}
+function payloadToUser(payload) {
+  return {
+    id: payload.sub || "",
+    email: payload.email,
+    name: payload.name,
+    organizationId: payload.org_id,
+    roles: payload.roles,
+    permissions: payload.permissions,
+    metadata: payload.metadata
+  };
+}
+var jwksCache = null;
+var jwksCacheExpiry = 0;
+async function getJwks(jwksUri, cacheTtl) {
+  const now = Date.now();
+  if (jwksCache && jwksCacheExpiry > now) {
+    return jwksCache;
+  }
+  jwksCache = jose.createRemoteJWKSet(new URL(jwksUri));
+  jwksCacheExpiry = now + cacheTtl * 1e3;
+  return jwksCache;
+}
+function auth(options = {}) {
+  const {
+    cookieName = "auth",
+    headerName = "Authorization",
+    clientId = OAUTH_DO_CONFIG.clientId,
+    jwksUri = OAUTH_DO_CONFIG.jwksUri,
+    skip,
+    jwksCacheTtl = 3600
+  } = options;
+  return async (c, next) => {
+    c.set("user", null);
+    c.set("userId", null);
+    c.set("isAuth", false);
+    c.set("token", null);
+    if (skip?.(c)) {
+      return next();
+    }
+    const token = extractToken(c, cookieName, headerName);
+    if (!token) {
+      return next();
+    }
+    c.set("token", token);
+    const cached = await getCachedUser(token);
+    if (cached) {
+      c.set("user", cached);
+      c.set("userId", cached.id);
+      c.set("isAuth", true);
+      return next();
+    }
+    try {
+      const jwks = await getJwks(jwksUri, jwksCacheTtl);
+      const { payload } = await jose.jwtVerify(token, jwks, {
+        audience: clientId
+      });
+      const user = payloadToUser(payload);
+      c.set("user", user);
+      c.set("userId", user.id);
+      c.set("isAuth", true);
+      await cacheUser(token, user);
+    } catch {
+    }
+    return next();
+  };
+}
+function requireAuth(options = {}) {
+  const { redirectTo, roles, permissions, ...authOptions } = options;
+  return async (c, next) => {
+    if (c.var.user === void 0) {
+      await auth(authOptions)(c, async () => {
+      });
+    }
+    if (!c.var.isAuth || !c.var.user) {
+      if (redirectTo) {
+        return c.redirect(redirectTo);
+      }
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    if (roles?.length) {
+      const userRoles = c.var.user.roles || [];
+      const hasRole = roles.some((r) => userRoles.includes(r));
+      if (!hasRole) {
+        return c.json({ error: "Insufficient permissions" }, 403);
+      }
+    }
+    if (permissions?.length) {
+      const userPerms = c.var.user.permissions || [];
+      const hasAllPerms = permissions.every((p) => userPerms.includes(p));
+      if (!hasAllPerms) {
+        return c.json({ error: "Insufficient permissions" }, 403);
+      }
+    }
+    return next();
+  };
+}
+function apiKey(options) {
+  const { headerName = "X-API-Key", verify } = options;
+  return async (c, next) => {
+    c.set("user", null);
+    c.set("userId", null);
+    c.set("isAuth", false);
+    c.set("token", null);
+    const key = c.req.header(headerName);
+    if (!key) {
+      return c.json({ error: "API key required" }, 401);
+    }
+    const user = await verify(key, c);
+    if (!user) {
+      return c.json({ error: "Invalid API key" }, 401);
+    }
+    c.set("user", user);
+    c.set("userId", user.id);
+    c.set("isAuth", true);
+    c.set("token", key);
+    return next();
+  };
+}
+function combined(options) {
+  return async (c, next) => {
+    if (options.auth) {
+      await auth(options.auth)(c, async () => {
+      });
+      if (c.var.isAuth) {
+        return next();
+      }
+    }
+    if (options.apiKey) {
+      const key = c.req.header(options.apiKey.headerName || "X-API-Key");
+      if (key) {
+        const user = await options.apiKey.verify(key, c);
+        if (user) {
+          c.set("user", user);
+          c.set("userId", user.id);
+          c.set("isAuth", true);
+          c.set("token", key);
+          return next();
+        }
+      }
+    }
+    return c.json({ error: "Authentication required" }, 401);
+  };
+}
+
+export { apiKey, auth, combined, requireAuth };
+//# sourceMappingURL=hono.js.map
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts"],"names":[],"mappings":";;;;AA+EA,IAAM,eAAA,GAAkB;AAAA,EACtB,QAAA,EAAU,mCAAA;AAAA,EACV,OAAA,EAAS;AACX,CAAA;AAEA,IAAM,kBAAkB,CAAA,GAAI,EAAA;AAC5B,IAAM,gBAAA,GAAmB,gCAAA;AASzB,eAAe,UAAU,KAAA,EAAgC;AACvD,EAAA,MAAM,IAAA,GAAO,IAAI,WAAA,EAAY,CAAE,OAAO,KAAK,CAAA;AAC3C,EAAA,MAAM,aAAa,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,WAAW,IAAI,CAAA;AAC7D,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA,CACzC,IAAI,CAAC,CAAA,KAAM,EAAE,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAC1C,KAAK,EAAE,CAAA;AACZ;AAKA,eAAe,cAAc,KAAA,EAAyC;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAA;AACrB,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,KAAK,CAAA;AAClC,IAAA,MAAM,WAAW,IAAI,OAAA,CAAQ,GAAG,gBAAgB,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACzD,IAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,KAAA,CAAM,QAAQ,CAAA;AAEzC,IAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AAEpB,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK;AAC/B,IAAA,IAAI,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,IAAO,OAAO,IAAA;AAExC,IAAA,OAAO,IAAA,CAAK,IAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAKA,eAAe,SAAA,CAAU,OAAe,IAAA,EAA+B;AACrE,EAAA,IAAI;AACF,IAAA,MAAM,QAAQ,MAAA,CAAO,OAAA;AACrB,IAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,KAAK,CAAA;AAClC,IAAA,MAAM,WAAW,IAAI,OAAA,CAAQ,GAAG,gBAAgB,CAAA,EAAG,IAAI,CAAA,CAAE,CAAA;AACzD,IAAA,MAAM,IAAA,GAAO,EAAE,IAAA,EAAM,SAAA,EAAW,KAAK,GAAA,EAAI,GAAI,kBAAkB,GAAA,EAAK;AACpE,IAAA,MAAM,WAAW,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,MAClD,OAAA,EAAS,EAAE,eAAA,EAAiB,CAAA,QAAA,EAAW,eAAe,CAAA,CAAA;AAAG,KAC1D,CAAA;AACD,IAAA,MAAM,KAAA,CAAM,GAAA,CAAI,QAAA,EAAU,QAAQ,CAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAKA,SAAS,YAAA,CAAa,CAAA,EAAY,UAAA,EAAoB,UAAA,EAAmC;AAEvF,EAAA,MAAM,UAAA,GAAa,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,UAAU,CAAA;AAC1C,EAAA,IAAI,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACrC,IAAA,OAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,EAC3B;AAGA,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,CAAA,EAAG,UAAU,CAAA;AACtC,EAAA,IAAI,QAAQ,OAAO,MAAA;AAEnB,EAAA,OAAO,IAAA;AACT;AAKA,SAAS,cAAc,OAAA,EAA+B;AACpD,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,QAAQ,GAAA,IAAO,EAAA;AAAA,IACnB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,gBAAgB,OAAA,CAAQ,MAAA;AAAA,IACxB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,UAAU,OAAA,CAAQ;AAAA,GACpB;AACF;AAGA,IAAI,SAAA,GAAyC,IAAA;AAC7C,IAAI,eAAA,GAAkB,CAAA;AAKtB,eAAe,OAAA,CAAQ,SAAiB,QAAA,EAAiD;AACvF,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,IAAI,SAAA,IAAa,kBAAkB,GAAA,EAAK;AACtC,IAAA,OAAO,SAAA;AAAA,EACT;AAEA,EAAA,SAAA,GAAiB,IAAA,CAAA,kBAAA,CAAmB,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA;AACpD,EAAA,eAAA,GAAkB,MAAM,QAAA,GAAW,GAAA;AACnC,EAAA,OAAO,SAAA;AACT;AAyBO,SAAS,IAAA,CAAK,OAAA,GAAuB,EAAC,EAAsB;AACjE,EAAA,MAAM;AAAA,IACJ,UAAA,GAAa,MAAA;AAAA,IACb,UAAA,GAAa,eAAA;AAAA,IACb,WAAW,eAAA,CAAgB,QAAA;AAAA,IAC3B,UAAU,eAAA,CAAgB,OAAA;AAAA,IAC1B,IAAA;AAAA,IACA,YAAA,GAAe;AAAA,GACjB,GAAI,OAAA;AAEJ,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AAExB,IAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,IAAI,CAAA;AAClB,IAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AACpB,IAAA,CAAA,CAAE,GAAA,CAAI,UAAU,KAAK,CAAA;AACrB,IAAA,CAAA,CAAE,GAAA,CAAI,SAAS,IAAI,CAAA;AAGnB,IAAA,IAAI,IAAA,GAAO,CAAC,CAAA,EAAG;AACb,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,CAAA,EAAG,UAAA,EAAY,UAAU,CAAA;AACpD,IAAA,IAAI,CAAC,KAAA,EAAO;AACV,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAEA,IAAA,CAAA,CAAE,GAAA,CAAI,SAAS,KAAK,CAAA;AAGpB,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAK,CAAA;AACxC,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,MAAM,CAAA;AACpB,MAAA,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,MAAA,CAAO,EAAE,CAAA;AACzB,MAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AACpB,MAAA,OAAO,IAAA,EAAK;AAAA,IACd;AAGA,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,OAAA,EAAS,YAAY,CAAA;AAChD,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAW,IAAA,CAAA,SAAA,CAAU,OAAO,IAAA,EAAM;AAAA,QACpD,QAAA,EAAU;AAAA,OACX,CAAA;AAED,MAAA,MAAM,IAAA,GAAO,cAAc,OAAO,CAAA;AAClC,MAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,IAAI,CAAA;AAClB,MAAA,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,EAAE,CAAA;AACvB,MAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AAGpB,MAAA,MAAM,SAAA,CAAU,OAAO,IAAI,CAAA;AAAA,IAC7B,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO,IAAA,EAAK;AAAA,EACd,CAAA;AACF;AAmBO,SAAS,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAsB;AAC/E,EAAA,MAAM,EAAE,UAAA,EAAY,KAAA,EAAO,WAAA,EAAa,GAAG,aAAY,GAAI,OAAA;AAE3D,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AAExB,IAAA,IAAI,CAAA,CAAE,GAAA,CAAI,IAAA,KAAS,MAAA,EAAW;AAC5B,MAAA,MAAM,IAAA,CAAK,WAAW,CAAA,CAAE,CAAA,EAAG,YAAY;AAAA,MAAC,CAAC,CAAA;AAAA,IAC3C;AAEA,IAAA,IAAI,CAAC,CAAA,CAAE,GAAA,CAAI,UAAU,CAAC,CAAA,CAAE,IAAI,IAAA,EAAM;AAChC,MAAA,IAAI,UAAA,EAAY;AACd,QAAA,OAAO,CAAA,CAAE,SAAS,UAAU,CAAA;AAAA,MAC9B;AACA,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,IACzD;AAGA,IAAA,IAAI,OAAO,MAAA,EAAQ;AACjB,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,SAAS,EAAC;AACvC,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,CAAC,MAAM,SAAA,CAAU,QAAA,CAAS,CAAC,CAAC,CAAA;AACvD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF;AAGA,IAAA,IAAI,aAAa,MAAA,EAAQ;AACvB,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,IAAA,CAAK,eAAe,EAAC;AAC7C,MAAA,MAAM,WAAA,GAAc,YAAY,KAAA,CAAM,CAAC,MAAM,SAAA,CAAU,QAAA,CAAS,CAAC,CAAC,CAAA;AAClE,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,MAC1D;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,EAAK;AAAA,EACd,CAAA;AACF;AAoBO,SAAS,OAAO,OAAA,EAA2C;AAChE,EAAA,MAAM,EAAE,UAAA,GAAa,WAAA,EAAa,MAAA,EAAO,GAAI,OAAA;AAE7C,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AACxB,IAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,IAAI,CAAA;AAClB,IAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AACpB,IAAA,CAAA,CAAE,GAAA,CAAI,UAAU,KAAK,CAAA;AACrB,IAAA,CAAA,CAAE,GAAA,CAAI,SAAS,IAAI,CAAA;AAEnB,IAAA,MAAM,GAAA,GAAM,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,UAAU,CAAA;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AACR,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,kBAAA,IAAsB,GAAG,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,GAAA,EAAK,CAAC,CAAA;AAChC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,IAAqB,GAAG,CAAA;AAAA,IACjD;AAEA,IAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,IAAI,CAAA;AAClB,IAAA,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,EAAE,CAAA;AACvB,IAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AACpB,IAAA,CAAA,CAAE,GAAA,CAAI,SAAS,GAAG,CAAA;AAElB,IAAA,OAAO,IAAA,EAAK;AAAA,EACd,CAAA;AACF;AAkBO,SAAS,SAAS,OAAA,EAGH;AACpB,EAAA,OAAO,OAAO,GAAG,IAAA,KAAS;AAExB,IAAA,IAAI,QAAQ,IAAA,EAAM;AAChB,MAAA,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA,CAAE,GAAG,YAAY;AAAA,MAAC,CAAC,CAAA;AAC1C,MAAA,IAAI,CAAA,CAAE,IAAI,MAAA,EAAQ;AAChB,QAAA,OAAO,IAAA,EAAK;AAAA,MACd;AAAA,IACF;AAGA,IAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,MAAA,MAAM,MAAM,CAAA,CAAE,GAAA,CAAI,OAAO,OAAA,CAAQ,MAAA,CAAO,cAAc,WAAW,CAAA;AACjE,MAAA,IAAI,GAAA,EAAK;AACP,QAAA,MAAM,OAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,MAAA,CAAO,KAAK,CAAC,CAAA;AAC/C,QAAA,IAAI,IAAA,EAAM;AACR,UAAA,CAAA,CAAE,GAAA,CAAI,QAAQ,IAAI,CAAA;AAClB,UAAA,CAAA,CAAE,GAAA,CAAI,QAAA,EAAU,IAAA,CAAK,EAAE,CAAA;AACvB,UAAA,CAAA,CAAE,GAAA,CAAI,UAAU,IAAI,CAAA;AACpB,UAAA,CAAA,CAAE,GAAA,CAAI,SAAS,GAAG,CAAA;AAClB,UAAA,OAAO,IAAA,EAAK;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,EACzD,CAAA;AACF","file":"hono.js","sourcesContent":["/**\n * oauth.do/hono - Hono middleware for authentication\n *\n * Lightweight authentication middleware for Cloudflare Workers.\n * Uses jose for JWT verification - no heavy WorkOS SDK dependency.\n *\n * @packageDocumentation\n */\n\nimport type { Context, MiddlewareHandler } from 'hono'\nimport { getCookie } from 'hono/cookie'\nimport type { JWTPayload } from 'jose'\nimport * as jose from 'jose'\n\n// Cloudflare Workers Cache API type\ndeclare const caches: {\n  default: Cache\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Types\n// ═══════════════════════════════════════════════════════════════════════════\n\nexport interface AuthUser {\n  id: string\n  email?: string\n  name?: string\n  organizationId?: string\n  roles?: string[]\n  permissions?: string[]\n  metadata?: Record<string, unknown>\n}\n\nexport interface AuthVariables {\n  user: AuthUser | null\n  userId: string | null\n  isAuth: boolean\n  token: string | null\n}\n\ndeclare module 'hono' {\n  interface ContextVariableMap extends AuthVariables {}\n}\n\nexport interface AuthOptions {\n  /** Cookie name for JWT token (default: 'auth') */\n  cookieName?: string\n  /** Header name for Bearer token (default: 'Authorization') */\n  headerName?: string\n  /** WorkOS Client ID (default: oauth.do client ID) */\n  clientId?: string\n  /** JWKS URI for token verification (default: WorkOS JWKS) */\n  jwksUri?: string\n  /** Skip auth for certain paths */\n  skip?: (c: Context) => boolean\n  /** Cache duration for JWKS in seconds (default: 3600) */\n  jwksCacheTtl?: number\n}\n\nexport interface RequireAuthOptions extends AuthOptions {\n  /** Redirect to login page instead of 401 */\n  redirectTo?: string\n  /** Required roles (any of) */\n  roles?: string[]\n  /** Required permissions (all of) */\n  permissions?: string[]\n}\n\nexport interface ApiKeyOptions {\n  /** Header name (default: 'X-API-Key') */\n  headerName?: string\n  /** Verify function - return user if valid, null if not */\n  verify: (key: string, c: Context) => Promise<AuthUser | null>\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Constants\n// ═══════════════════════════════════════════════════════════════════════════\n\nconst OAUTH_DO_CONFIG = {\n  clientId: 'client_01JQYTRXK9ZPD8JPJTKDCRB656',\n  jwksUri: 'https://api.workos.com/sso/jwks/client_01JQYTRXK9ZPD8JPJTKDCRB656',\n}\n\nconst TOKEN_CACHE_TTL = 5 * 60 // 5 minutes\nconst CACHE_URL_PREFIX = 'https://oauth.do/_cache/token/'\n\n// ═══════════════════════════════════════════════════════════════════════════\n// JWT Utilities\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Hash a token for cache key (avoids storing raw tokens in cache)\n */\nasync function hashToken(token: string): Promise<string> {\n  const data = new TextEncoder().encode(token)\n  const hashBuffer = await crypto.subtle.digest('SHA-256', data)\n  return Array.from(new Uint8Array(hashBuffer))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\n/**\n * Get cached user from Cache API\n */\nasync function getCachedUser(token: string): Promise<AuthUser | null> {\n  try {\n    const cache = caches.default\n    const hash = await hashToken(token)\n    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`)\n    const cached = await cache.match(cacheKey)\n\n    if (!cached) return null\n\n    const data = await cached.json() as { user: AuthUser; expiresAt: number }\n    if (data.expiresAt < Date.now()) return null\n\n    return data.user\n  } catch {\n    return null\n  }\n}\n\n/**\n * Cache user in Cache API\n */\nasync function cacheUser(token: string, user: AuthUser): Promise<void> {\n  try {\n    const cache = caches.default\n    const hash = await hashToken(token)\n    const cacheKey = new Request(`${CACHE_URL_PREFIX}${hash}`)\n    const data = { user, expiresAt: Date.now() + TOKEN_CACHE_TTL * 1000 }\n    const response = new Response(JSON.stringify(data), {\n      headers: { 'Cache-Control': `max-age=${TOKEN_CACHE_TTL}` },\n    })\n    await cache.put(cacheKey, response)\n  } catch {\n    // Cache failures are non-fatal\n  }\n}\n\n/**\n * Extract JWT from request (cookie or Bearer header)\n */\nfunction extractToken(c: Context, cookieName: string, headerName: string): string | null {\n  // Try Bearer header first\n  const authHeader = c.req.header(headerName)\n  if (authHeader?.startsWith('Bearer ')) {\n    return authHeader.slice(7)\n  }\n\n  // Try cookie\n  const cookie = getCookie(c, cookieName)\n  if (cookie) return cookie\n\n  return null\n}\n\n/**\n * Convert JWT payload to AuthUser\n */\nfunction payloadToUser(payload: JWTPayload): AuthUser {\n  return {\n    id: payload.sub || '',\n    email: payload.email as string | undefined,\n    name: payload.name as string | undefined,\n    organizationId: payload.org_id as string | undefined,\n    roles: payload.roles as string[] | undefined,\n    permissions: payload.permissions as string[] | undefined,\n    metadata: payload.metadata as Record<string, unknown> | undefined,\n  }\n}\n\n// JWKS cache (module-level, persists across requests)\nlet jwksCache: jose.JWTVerifyGetKey | null = null\nlet jwksCacheExpiry = 0\n\n/**\n * Get JWKS verifier with caching\n */\nasync function getJwks(jwksUri: string, cacheTtl: number): Promise<jose.JWTVerifyGetKey> {\n  const now = Date.now()\n  if (jwksCache && jwksCacheExpiry > now) {\n    return jwksCache\n  }\n\n  jwksCache = jose.createRemoteJWKSet(new URL(jwksUri))\n  jwksCacheExpiry = now + cacheTtl * 1000\n  return jwksCache\n}\n\n// ═══════════════════════════════════════════════════════════════════════════\n// Middleware\n// ═══════════════════════════════════════════════════════════════════════════\n\n/**\n * Auth middleware - populates c.var.user if authenticated\n *\n * Does NOT reject unauthenticated requests. Use requireAuth() for that.\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { auth } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.use('*', auth())\n *\n * app.get('/api/me', (c) => {\n *   if (!c.var.user) return c.json({ error: 'Not authenticated' }, 401)\n *   return c.json(c.var.user)\n * })\n * ```\n */\nexport function auth(options: AuthOptions = {}): MiddlewareHandler {\n  const {\n    cookieName = 'auth',\n    headerName = 'Authorization',\n    clientId = OAUTH_DO_CONFIG.clientId,\n    jwksUri = OAUTH_DO_CONFIG.jwksUri,\n    skip,\n    jwksCacheTtl = 3600,\n  } = options\n\n  return async (c, next) => {\n    // Initialize variables\n    c.set('user', null)\n    c.set('userId', null)\n    c.set('isAuth', false)\n    c.set('token', null)\n\n    // Skip if configured\n    if (skip?.(c)) {\n      return next()\n    }\n\n    const token = extractToken(c, cookieName, headerName)\n    if (!token) {\n      return next()\n    }\n\n    c.set('token', token)\n\n    // Check cache first\n    const cached = await getCachedUser(token)\n    if (cached) {\n      c.set('user', cached)\n      c.set('userId', cached.id)\n      c.set('isAuth', true)\n      return next()\n    }\n\n    // Verify JWT\n    try {\n      const jwks = await getJwks(jwksUri, jwksCacheTtl)\n      const { payload } = await jose.jwtVerify(token, jwks, {\n        audience: clientId,\n      })\n\n      const user = payloadToUser(payload)\n      c.set('user', user)\n      c.set('userId', user.id)\n      c.set('isAuth', true)\n\n      // Cache the result\n      await cacheUser(token, user)\n    } catch {\n      // Invalid token - leave user as null\n    }\n\n    return next()\n  }\n}\n\n/**\n * Require auth middleware - rejects unauthenticated requests\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { auth, requireAuth } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.use('*', auth())\n * app.use('/api/*', requireAuth())\n *\n * app.get('/api/secret', (c) => {\n *   return c.json({ secret: 'data', user: c.var.user })\n * })\n * ```\n */\nexport function requireAuth(options: RequireAuthOptions = {}): MiddlewareHandler {\n  const { redirectTo, roles, permissions, ...authOptions } = options\n\n  return async (c, next) => {\n    // Run auth middleware first if not already done\n    if (c.var.user === undefined) {\n      await auth(authOptions)(c, async () => {})\n    }\n\n    if (!c.var.isAuth || !c.var.user) {\n      if (redirectTo) {\n        return c.redirect(redirectTo)\n      }\n      return c.json({ error: 'Authentication required' }, 401)\n    }\n\n    // Check roles (any of)\n    if (roles?.length) {\n      const userRoles = c.var.user.roles || []\n      const hasRole = roles.some((r) => userRoles.includes(r))\n      if (!hasRole) {\n        return c.json({ error: 'Insufficient permissions' }, 403)\n      }\n    }\n\n    // Check permissions (all of)\n    if (permissions?.length) {\n      const userPerms = c.var.user.permissions || []\n      const hasAllPerms = permissions.every((p) => userPerms.includes(p))\n      if (!hasAllPerms) {\n        return c.json({ error: 'Insufficient permissions' }, 403)\n      }\n    }\n\n    return next()\n  }\n}\n\n/**\n * API key middleware - authenticates via API key header\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { apiKey } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.use('/api/*', apiKey({\n *   verify: async (key, c) => {\n *     // Verify key against your database/service\n *     const user = await verifyApiKey(key)\n *     return user\n *   }\n * }))\n * ```\n */\nexport function apiKey(options: ApiKeyOptions): MiddlewareHandler {\n  const { headerName = 'X-API-Key', verify } = options\n\n  return async (c, next) => {\n    c.set('user', null)\n    c.set('userId', null)\n    c.set('isAuth', false)\n    c.set('token', null)\n\n    const key = c.req.header(headerName)\n    if (!key) {\n      return c.json({ error: 'API key required' }, 401)\n    }\n\n    const user = await verify(key, c)\n    if (!user) {\n      return c.json({ error: 'Invalid API key' }, 401)\n    }\n\n    c.set('user', user)\n    c.set('userId', user.id)\n    c.set('isAuth', true)\n    c.set('token', key)\n\n    return next()\n  }\n}\n\n/**\n * Combined auth middleware - tries JWT first, then API key\n *\n * @example\n * ```ts\n * import { Hono } from 'hono'\n * import { combined } from 'oauth.do/hono'\n *\n * const app = new Hono()\n * app.use('/api/*', combined({\n *   apiKey: {\n *     verify: async (key) => verifyApiKey(key)\n *   }\n * }))\n * ```\n */\nexport function combined(options: {\n  auth?: AuthOptions\n  apiKey?: ApiKeyOptions\n}): MiddlewareHandler {\n  return async (c, next) => {\n    // Try JWT auth first\n    if (options.auth) {\n      await auth(options.auth)(c, async () => {})\n      if (c.var.isAuth) {\n        return next()\n      }\n    }\n\n    // Fall back to API key\n    if (options.apiKey) {\n      const key = c.req.header(options.apiKey.headerName || 'X-API-Key')\n      if (key) {\n        const user = await options.apiKey.verify(key, c)\n        if (user) {\n          c.set('user', user)\n          c.set('userId', user.id)\n          c.set('isAuth', true)\n          c.set('token', key)\n          return next()\n        }\n      }\n    }\n\n    return c.json({ error: 'Authentication required' }, 401)\n  }\n}\n"]}

package/dist/index.d.ts

@@ -1,91 +1,5 @@
-/**
- * OAuth configuration options
- */
-interface OAuthConfig {
-    /**
-     * Base URL for API endpoints
-     * @default 'https://apis.do'
-     */
-    apiUrl?: string;
-    /**
-     * Client ID for OAuth flow
-     */
-    clientId?: string;
-    /**
-     * AuthKit domain for device authorization
-     * @default 'login.oauth.do'
-     */
-    authKitDomain?: string;
-    /**
-     * Custom fetch implementation
-     */
-    fetch?: typeof fetch;
-    /**
-     * Custom path for token storage
-     * Supports ~ for home directory (e.g., '~/.studio/tokens.json')
-     * @default '~/.oauth.do/token'
-     */
-    storagePath?: string;
-}
-/**
- * User information returned from auth endpoints
- */
-interface User {
-    id: string;
-    email?: string;
-    name?: string;
-    [key: string]: any;
-}
-/**
- * Authentication result
- */
-interface AuthResult {
-    user: User | null;
-    token?: string;
-}
-/**
- * Device authorization response
- */
-interface DeviceAuthorizationResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-/**
- * Token response
- */
-interface TokenResponse {
-    access_token: string;
-    refresh_token?: string;
-    token_type: string;
-    expires_in?: number;
-    user?: User;
-}
-/**
- * Token polling error types
- */
-type TokenError = 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token' | 'unknown';
-/**
- * Stored token data including refresh token and expiration
- */
-interface StoredTokenData {
-    accessToken: string;
-    refreshToken?: string;
-    expiresAt?: number;
-}
-/**
- * Token storage interface
- */
-interface TokenStorage {
-    getToken(): Promise<string | null>;
-    setToken(token: string): Promise<void>;
-    removeToken(): Promise<void>;
-    getTokenData?(): Promise<StoredTokenData | null>;
-    setTokenData?(data: StoredTokenData): Promise<void>;
-}
+import { AuthResult, OAuthConfig, DeviceAuthorizationResponse, TokenResponse, TokenStorage, StoredTokenData } from './types-export.js';
+export { TokenError, User } from './types-export.js';
 
 /**
  * Get current authenticated user
@@ -121,7 +35,7 @@ declare function logout(token?: string): Promise<void>;
  * 1. globalThis.DO_ADMIN_TOKEN / DO_TOKEN (Workers legacy)
  * 2. process.env.DO_ADMIN_TOKEN / DO_TOKEN (Node.js)
  * 3. cloudflare:workers env import (Workers 2025+) - supports secrets store bindings
- * 4. Stored token (keychain/secure file)
+ * 4. Stored token (keychain/secure file) - with automatic refresh if expired
  *
  * @see https://developers.cloudflare.com/changelog/2025-03-17-importable-env/
  */
@@ -460,6 +374,8 @@ interface LoginResult {
  * Get existing token or perform device flow login
  * Handles browser launch and token storage automatically
  * Automatically refreshes expired tokens if refresh_token is available
+ *
+ * Uses singleton pattern to prevent multiple concurrent login/refresh attempts
  */
 declare function ensureLoggedIn(options?: LoginOptions): Promise<LoginResult>;
 /**
@@ -471,4 +387,4 @@ declare function forceLogin(options?: LoginOptions): Promise<LoginResult>;
  */
 declare function ensureLoggedOut(options?: LoginOptions): Promise<void>;
 
-export { type AuthProvider, type AuthResult, CompositeTokenStorage, type DeviceAuthorizationResponse, FileTokenStorage, type GitHubDeviceAuthResponse, type GitHubDeviceFlowOptions, type GitHubTokenResponse, type GitHubUser, KeychainTokenStorage, LocalStorageTokenStorage, type LoginOptions, type LoginResult, MemoryTokenStorage, type OAuthConfig, type OAuthProvider, SecureFileTokenStorage, type TokenError, type TokenResponse, type TokenStorage, type User, ensureLoggedOut as a, auth, authorizeDevice, buildAuthUrl, configure, createSecureStorage, ensureLoggedIn as e, forceLogin as f, getConfig, getGitHubUser, getToken, getUser, isAuthenticated, login, logout, pollForTokens, pollGitHubDeviceFlow, startGitHubDeviceFlow };
+export { type AuthProvider, AuthResult, CompositeTokenStorage, DeviceAuthorizationResponse, FileTokenStorage, type GitHubDeviceAuthResponse, type GitHubDeviceFlowOptions, type GitHubTokenResponse, type GitHubUser, KeychainTokenStorage, LocalStorageTokenStorage, type LoginOptions, type LoginResult, MemoryTokenStorage, OAuthConfig, type OAuthProvider, SecureFileTokenStorage, TokenResponse, TokenStorage, ensureLoggedOut as a, auth, authorizeDevice, buildAuthUrl, configure, createSecureStorage, ensureLoggedIn as e, forceLogin as f, getConfig, getGitHubUser, getToken, getUser, isAuthenticated, login, logout, pollForTokens, pollGitHubDeviceFlow, startGitHubDeviceFlow };

package/dist/index.js

@@ -8,6 +8,17 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/utils.ts
+function getEnv(key) {
+  if (globalThis[key]) return globalThis[key];
+  if (typeof process !== "undefined" && process.env?.[key]) return process.env[key];
+  return void 0;
+}
+var init_utils = __esm({
+  "src/utils.ts"() {
+  }
+});
+
 // src/storage.ts
 var storage_exports = {};
 __export(storage_exports, {
@@ -22,10 +33,6 @@ __export(storage_exports, {
 function isNode() {
   return typeof process !== "undefined" && process.versions != null && process.versions.node != null;
 }
-function getEnv2(key) {
-  if (typeof process !== "undefined" && process.env?.[key]) return process.env[key];
-  return void 0;
-}
 function createSecureStorage(storagePath) {
   if (isNode()) {
     return new SecureFileTokenStorage(storagePath);
@@ -38,6 +45,7 @@ function createSecureStorage(storagePath) {
 var KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, KeychainTokenStorage, SecureFileTokenStorage, FileTokenStorage, MemoryTokenStorage, LocalStorageTokenStorage, CompositeTokenStorage;
 var init_storage = __esm({
   "src/storage.ts"() {
+    init_utils();
     KEYCHAIN_SERVICE = "oauth.do";
     KEYCHAIN_ACCOUNT = "access_token";
     KeychainTokenStorage = class {
@@ -57,7 +65,7 @@ var init_storage = __esm({
           const keytarModule = imported.default || imported;
           this.keytar = keytarModule;
           if (typeof this.keytar.getPassword !== "function") {
-            if (getEnv2("DEBUG")) {
+            if (getEnv("DEBUG")) {
               console.warn("Keytar module loaded but getPassword is not a function:", Object.keys(this.keytar));
             }
             this.keytar = null;
@@ -65,7 +73,7 @@ var init_storage = __esm({
           }
           return this.keytar;
         } catch (error) {
-          if (getEnv2("DEBUG")) {
+          if (getEnv("DEBUG")) {
             console.warn("Keychain storage not available:", error);
           }
           return null;
@@ -80,7 +88,7 @@ var init_storage = __esm({
           const token = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
           return token;
         } catch (error) {
-          if (getEnv2("DEBUG")) {
+          if (getEnv("DEBUG")) {
             console.warn("Failed to get token from keychain:", error);
           }
           return null;
@@ -122,7 +130,7 @@ var init_storage = __esm({
           await keytar.getPassword(KEYCHAIN_SERVICE, "__test__");
           return true;
         } catch (error) {
-          if (getEnv2("DEBUG")) {
+          if (getEnv("DEBUG")) {
             console.warn("Keychain not available:", error);
           }
           return false;
@@ -167,7 +175,7 @@ var init_storage = __esm({
           const fs = await import('fs/promises');
           const stats = await fs.stat(this.tokenPath);
           const mode = stats.mode & 511;
-          if (mode !== 384 && getEnv2("DEBUG")) {
+          if (mode !== 384 && getEnv("DEBUG")) {
             console.warn(
               `Warning: Token file has insecure permissions (${mode.toString(8)}). Expected 600. Run: chmod 600 ${this.tokenPath}`
             );
@@ -346,7 +354,7 @@ var init_storage = __esm({
             try {
               await this.keychainStorage.setToken(fileToken);
               await this.fileStorage.removeToken();
-              if (getEnv2("DEBUG")) {
+              if (getEnv("DEBUG")) {
                 console.log("Migrated token from file to keychain");
               }
             } catch {
@@ -377,11 +385,7 @@ var init_storage = __esm({
 });
 
 // src/config.ts
-function getEnv(key) {
-  if (globalThis[key]) return globalThis[key];
-  if (typeof process !== "undefined" && process.env?.[key]) return process.env[key];
-  return void 0;
-}
+init_utils();
 var globalConfig = {
   apiUrl: getEnv("OAUTH_API_URL") || getEnv("API_URL") || "https://apis.do",
   clientId: getEnv("OAUTH_CLIENT_ID") || "client_01JQYTRXK9ZPD8JPJTKDCRB656",
@@ -400,6 +404,7 @@ function getConfig() {
 }
 
 // src/auth.ts
+init_utils();
 async function resolveSecret(value) {
   if (!value) return null;
   if (typeof value === "string") return value;
@@ -408,14 +413,9 @@ async function resolveSecret(value) {
   }
   return null;
 }
-function getEnv3(key) {
-  if (globalThis[key]) return globalThis[key];
-  if (typeof process !== "undefined" && process.env?.[key]) return process.env[key];
-  return void 0;
-}
 async function getUser(token) {
   const config = getConfig();
-  const authToken = token || getEnv3("DO_TOKEN") || "";
+  const authToken = token || getEnv("DO_TOKEN") || "";
   if (!authToken) {
     return { user: null };
   }
@@ -462,7 +462,7 @@ async function login(credentials) {
 }
 async function logout(token) {
   const config = getConfig();
-  const authToken = token || getEnv3("DO_TOKEN") || "";
+  const authToken = token || getEnv("DO_TOKEN") || "";
   if (!authToken) {
     return;
   }
@@ -481,10 +481,15 @@ async function logout(token) {
     console.error("Logout error:", error);
   }
 }
+var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+function isTokenExpired(expiresAt) {
+  if (!expiresAt) return false;
+  return Date.now() >= expiresAt - REFRESH_BUFFER_MS;
+}
 async function getToken() {
-  const adminToken = getEnv3("DO_ADMIN_TOKEN");
+  const adminToken = getEnv("DO_ADMIN_TOKEN");
   if (adminToken) return adminToken;
-  const doToken = getEnv3("DO_TOKEN");
+  const doToken = getEnv("DO_TOKEN");
   if (doToken) return doToken;
   try {
     const { env } = await import('cloudflare:workers');
@@ -498,6 +503,32 @@ async function getToken() {
     const { createSecureStorage: createSecureStorage2 } = await Promise.resolve().then(() => (init_storage(), storage_exports));
     const config = getConfig();
     const storage = createSecureStorage2(config.storagePath);
+    const tokenData = storage.getTokenData ? await storage.getTokenData() : null;
+    if (tokenData) {
+      if (!isTokenExpired(tokenData.expiresAt)) {
+        return tokenData.accessToken;
+      }
+      if (tokenData.refreshToken) {
+        try {
+          const newTokens = await refreshAccessToken(tokenData.refreshToken);
+          const expiresAt = newTokens.expires_in ? Date.now() + newTokens.expires_in * 1e3 : void 0;
+          const newData = {
+            accessToken: newTokens.access_token,
+            refreshToken: newTokens.refresh_token || tokenData.refreshToken,
+            expiresAt
+          };
+          if (storage.setTokenData) {
+            await storage.setTokenData(newData);
+          } else {
+            await storage.setToken(newTokens.access_token);
+          }
+          return newTokens.access_token;
+        } catch {
+          return null;
+        }
+      }
+      return null;
+    }
     return await storage.getToken();
   } catch {
     return null;
@@ -510,6 +541,28 @@ async function isAuthenticated(token) {
 function auth() {
   return getToken;
 }
+async function refreshAccessToken(refreshToken) {
+  const config = getConfig();
+  if (!config.clientId) {
+    throw new Error("Client ID is required for token refresh");
+  }
+  const response = await config.fetch("https://auth.apis.do/user_management/authenticate", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: config.clientId
+    }).toString()
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Token refresh failed: ${response.status} - ${errorText}`);
+  }
+  return await response.json();
+}
 function buildAuthUrl(options) {
   const config = getConfig();
   const clientId = options.clientId || config.clientId;