stitchkit 0.2.0 → 0.4.0

package/dist/index-1cf8jkhf.js

@@ -0,0 +1,219 @@
+import {
+  forbidden,
+  unauthorized
+} from "./index-afzt3nmx.js";
+import {
+  isUnsafeKey,
+  safeJsonParse
+} from "./index-kzfs85xp.js";
+import {
+  isRecord
+} from "./index-809wc1tt.js";
+
+// src/server/middleware/cookies.ts
+function parseCookies(header) {
+  if (!header)
+    return {};
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq === -1)
+      continue;
+    const key = pair.slice(0, eq).trim();
+    if (!key || isUnsafeKey(key))
+      continue;
+    const raw = pair.slice(eq + 1).trim();
+    try {
+      cookies[key] = decodeURIComponent(raw);
+    } catch {
+      cookies[key] = raw;
+    }
+  }
+  return cookies;
+}
+function serializeCookie(name, value, opts = {}) {
+  let cookie = `${name}=${encodeURIComponent(value)}`;
+  if (opts.maxAge !== undefined)
+    cookie += `; Max-Age=${opts.maxAge}`;
+  if (opts.path)
+    cookie += `; Path=${opts.path}`;
+  if (opts.domain)
+    cookie += `; Domain=${opts.domain}`;
+  if (opts.secure)
+    cookie += "; Secure";
+  if (opts.httpOnly)
+    cookie += "; HttpOnly";
+  if (opts.sameSite)
+    cookie += `; SameSite=${opts.sameSite}`;
+  return cookie;
+}
+function defineCookie(config) {
+  const { name, ...options } = config;
+  return {
+    get(req) {
+      return parseCookies(req.headers.get("cookie"))[name];
+    },
+    set(value) {
+      return serializeCookie(name, value, options);
+    },
+    clear() {
+      return serializeCookie(name, "", { ...options, maxAge: 0 });
+    }
+  };
+}
+
+// src/server/middleware/auth.ts
+var MAX_TOKEN_BYTES = 8192;
+function decodeBase64Url(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) {
+    throw new Error("invalid base64url segment");
+  }
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, "=");
+  return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+}
+async function verifyJwt(token, secret, options = {}) {
+  if (!secret)
+    throw new Error("verifyJwt: a non-empty secret is required");
+  if (token.length > MAX_TOKEN_BYTES)
+    throw unauthorized("Token too large");
+  const [headerB64, payloadB64, signatureB64] = token.split(".");
+  if (!headerB64 || !payloadB64 || !signatureB64)
+    throw unauthorized("Invalid token format");
+  let header;
+  let payloadRaw;
+  let signature;
+  try {
+    const decoder = new TextDecoder;
+    header = JSON.parse(decoder.decode(decodeBase64Url(headerB64)));
+    payloadRaw = safeJsonParse(decoder.decode(decodeBase64Url(payloadB64)));
+    signature = decodeBase64Url(signatureB64);
+  } catch {
+    throw unauthorized("Malformed token");
+  }
+  if (!isRecord(payloadRaw))
+    throw unauthorized("Malformed token");
+  const payload = payloadRaw;
+  if (header.alg !== "HS256")
+    throw unauthorized("Unsupported token algorithm");
+  const encoder = new TextEncoder;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  const data = encoder.encode(`${headerB64}.${payloadB64}`);
+  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
+  if (!valid)
+    throw unauthorized("Invalid token signature");
+  const leeway = options.leewaySeconds ?? 60;
+  const now = Date.now() / 1000;
+  if ("exp" in payload) {
+    if (typeof payload.exp !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.exp < now - leeway)
+      throw unauthorized("Token expired");
+  }
+  if ("nbf" in payload) {
+    if (typeof payload.nbf !== "number")
+      throw unauthorized("Malformed token");
+    if (payload.nbf > now + leeway)
+      throw unauthorized("Token not yet valid");
+  }
+  if (options.issuer !== undefined && payload.iss !== options.issuer) {
+    throw unauthorized("Token issuer mismatch");
+  }
+  if (options.audience !== undefined) {
+    const aud = payload.aud;
+    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
+    if (!ok)
+      throw unauthorized("Token audience mismatch");
+  }
+  return payload;
+}
+function encodeBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function signJwt(payload, secret, options = {}) {
+  if (!secret)
+    throw new Error("signJwt: a non-empty secret is required");
+  const now = Math.floor(Date.now() / 1000);
+  const claims = {
+    ...payload,
+    iat: now,
+    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
+    ...options.issuer !== undefined && { iss: options.issuer },
+    ...options.audience !== undefined && { aud: options.audience },
+    ...options.subject !== undefined && { sub: options.subject }
+  };
+  const encoder = new TextEncoder;
+  const headerB64 = encodeBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
+  const payloadB64 = encodeBase64Url(encoder.encode(JSON.stringify(claims)));
+  const signingInput = `${headerB64}.${payloadB64}`;
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
+  const signatureB64 = encodeBase64Url(new Uint8Array(signature));
+  return `${signingInput}.${signatureB64}`;
+}
+function extractToken(req, cookieName) {
+  const authHeader = req.headers.get("authorization");
+  if (authHeader?.startsWith("Bearer "))
+    return authHeader.slice(7);
+  if (cookieName) {
+    const cookies = parseCookies(req.headers.get("cookie"));
+    return cookies[cookieName] ?? null;
+  }
+  return null;
+}
+function createAuthHook(config) {
+  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
+  const onForbidden = config.onForbidden ?? (() => forbidden());
+  return async (ctx, endpoint) => {
+    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
+    config.inject?.(ctx, identity);
+    const scope = endpoint.scope ?? config.defaultScope;
+    if (!scope)
+      return;
+    const rule = config.rules[scope];
+    if (!rule) {
+      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
+    }
+    if (rule === "public")
+      return;
+    if (!identity) {
+      onAnonymous();
+      return;
+    }
+    if (rule === "authenticated")
+      return;
+    if (!await rule(identity, ctx))
+      onForbidden();
+  };
+}
+function createBearerResolver(config) {
+  return async (req) => {
+    const token = extractToken(req);
+    if (!token)
+      return null;
+    return config.lookup(token, req);
+  };
+}
+
+// src/server/middleware/pkce.ts
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes)
+    binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function deriveCodeChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64UrlEncode(new Uint8Array(digest));
+}
+async function verifyPkce(verifier, challenge) {
+  if (!verifier || !challenge)
+    return false;
+  const derived = await deriveCodeChallenge(verifier);
+  return derived === challenge;
+}
+
+export { parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, createBearerResolver, deriveCodeChallenge, verifyPkce };

package/dist/index-37x76zdn.js

@@ -0,0 +1,4 @@
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+export { __require };