stitchkit 0.94.0 → 0.95.0

package/dist/index-e2z3ahw9.js

@@ -1,325 +0,0 @@
-import {
-  deriveCodeChallenge
-} from "./index-hr4tzbwq.js";
-import {
-  contextContributionDelta,
-  mergeContextContribution,
-  prepareContextContribution
-} from "./index-xnj9bgxe.js";
-import {
-  base64UrlToBytes,
-  bytesToBase64Url
-} from "./index-rxfy4cq7.js";
-import {
-  forbidden,
-  unauthorized
-} from "./index-2vtcmrj9.js";
-import {
-  isUnsafeKey,
-  safeJsonParse
-} from "./index-kzfs85xp.js";
-import {
-  isRecord
-} from "./index-hffjpmq9.js";
-
-// src/server/middleware/cookies.ts
-function parseCookieHeader(header) {
-  if (!header)
-    return [];
-  const pairs = [];
-  for (const pair of header.split(";")) {
-    const eq = pair.indexOf("=");
-    if (eq === -1)
-      continue;
-    const key = pair.slice(0, eq).trim();
-    if (!key)
-      continue;
-    const raw = pair.slice(eq + 1).trim();
-    let value = raw;
-    try {
-      value = decodeURIComponent(raw);
-    } catch {}
-    pairs.push([key, value]);
-  }
-  return pairs;
-}
-function parseCookies(header) {
-  const cookies = {};
-  for (const [key, value] of parseCookieHeader(header)) {
-    if (isUnsafeKey(key))
-      continue;
-    cookies[key] = value;
-  }
-  return cookies;
-}
-function serializeCookie(name, value, opts = {}) {
-  let cookie = `${name}=${encodeURIComponent(value)}`;
-  if (opts.maxAge !== undefined)
-    cookie += `; Max-Age=${opts.maxAge}`;
-  if (opts.path)
-    cookie += `; Path=${opts.path}`;
-  if (opts.domain)
-    cookie += `; Domain=${opts.domain}`;
-  if (opts.secure)
-    cookie += "; Secure";
-  if (opts.httpOnly)
-    cookie += "; HttpOnly";
-  if (opts.sameSite)
-    cookie += `; SameSite=${opts.sameSite}`;
-  return cookie;
-}
-function defineCookie(config) {
-  const { name, duplicates = "last", ...options } = config;
-  const getAll = (req) => parseCookieHeader(req.headers.get("cookie")).flatMap(([key, value]) => key === name ? [value] : []);
-  return {
-    get(req) {
-      const values = getAll(req);
-      if (values.length === 0)
-        return;
-      if (duplicates === "first")
-        return values[0];
-      if (duplicates === "reject") {
-        return new Set(values).size === 1 ? values[0] : undefined;
-      }
-      return values[values.length - 1];
-    },
-    getAll,
-    set(value) {
-      return serializeCookie(name, value, options);
-    },
-    clear() {
-      return serializeCookie(name, "", { ...options, maxAge: 0 });
-    }
-  };
-}
-
-// src/server/middleware/auth.ts
-var MAX_TOKEN_BYTES = 8192;
-async function verifyJwt(token, secret, options = {}) {
-  if (!secret)
-    throw new Error("verifyJwt: a non-empty secret is required");
-  if (token.length > MAX_TOKEN_BYTES)
-    throw unauthorized("Token too large");
-  const [headerB64, payloadB64, signatureB64] = token.split(".");
-  if (!headerB64 || !payloadB64 || !signatureB64)
-    throw unauthorized("Invalid token format");
-  let header;
-  let payloadRaw;
-  let signature;
-  try {
-    const decoder = new TextDecoder;
-    header = JSON.parse(decoder.decode(base64UrlToBytes(headerB64)));
-    payloadRaw = safeJsonParse(decoder.decode(base64UrlToBytes(payloadB64)));
-    signature = base64UrlToBytes(signatureB64);
-  } catch {
-    throw unauthorized("Malformed token");
-  }
-  if (!isRecord(payloadRaw))
-    throw unauthorized("Malformed token");
-  const payload = payloadRaw;
-  if (header.alg !== "HS256")
-    throw unauthorized("Unsupported token algorithm");
-  const encoder = new TextEncoder;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
-  const data = encoder.encode(`${headerB64}.${payloadB64}`);
-  const valid = await crypto.subtle.verify("HMAC", key, signature, data);
-  if (!valid)
-    throw unauthorized("Invalid token signature");
-  const leeway = options.leewaySeconds ?? 60;
-  const now = Date.now() / 1000;
-  if ("exp" in payload) {
-    if (typeof payload.exp !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.exp < now - leeway)
-      throw unauthorized("Token expired");
-  }
-  if ("nbf" in payload) {
-    if (typeof payload.nbf !== "number")
-      throw unauthorized("Malformed token");
-    if (payload.nbf > now + leeway)
-      throw unauthorized("Token not yet valid");
-  }
-  if (options.issuer !== undefined && payload.iss !== options.issuer) {
-    throw unauthorized("Token issuer mismatch");
-  }
-  if (options.audience !== undefined) {
-    const aud = payload.aud;
-    const ok = Array.isArray(aud) ? aud.includes(options.audience) : aud === options.audience;
-    if (!ok)
-      throw unauthorized("Token audience mismatch");
-  }
-  return payload;
-}
-async function signJwt(payload, secret, options = {}) {
-  if (!secret)
-    throw new Error("signJwt: a non-empty secret is required");
-  const now = Math.floor(Date.now() / 1000);
-  const claims = {
-    ...payload,
-    iat: now,
-    ...options.expiresInSec !== undefined && { exp: now + options.expiresInSec },
-    ...options.issuer !== undefined && { iss: options.issuer },
-    ...options.audience !== undefined && { aud: options.audience },
-    ...options.subject !== undefined && { sub: options.subject }
-  };
-  const encoder = new TextEncoder;
-  const headerB64 = bytesToBase64Url(encoder.encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
-  const payloadB64 = bytesToBase64Url(encoder.encode(JSON.stringify(claims)));
-  const signingInput = `${headerB64}.${payloadB64}`;
-  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(signingInput));
-  const signatureB64 = bytesToBase64Url(new Uint8Array(signature));
-  return `${signingInput}.${signatureB64}`;
-}
-function extractToken(req, cookieName) {
-  const authHeader = req.headers.get("authorization");
-  if (authHeader?.startsWith("Bearer "))
-    return authHeader.slice(7);
-  if (cookieName) {
-    const cookies = parseCookies(req.headers.get("cookie"));
-    return cookies[cookieName] ?? null;
-  }
-  return null;
-}
-function isThenable(value) {
-  try {
-    return "then" in value && typeof value.then === "function";
-  } catch {
-    return false;
-  }
-}
-var scopedAuthHookBrand = Symbol("stitchkit.scoped-auth-hook");
-var authOwnershipPlans = new WeakMap;
-function createShadowContext(ctx) {
-  const shadow = {
-    params: ctx.params,
-    input: ctx.input,
-    source: ctx.source
-  };
-  Object.defineProperties(shadow, Object.getOwnPropertyDescriptors(ctx));
-  return shadow;
-}
-function createAuthHook(config) {
-  const onAnonymous = config.onAnonymous ?? (() => unauthorized());
-  const onForbidden = config.onForbidden ?? (() => forbidden());
-  async function auth(ctx, endpoint) {
-    const identity = ctx.source === "http" ? await config.resolve(ctx) : await config.resolveFromContext?.(ctx) ?? null;
-    config.inject?.(ctx, identity);
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const entry = Object.hasOwn(config.rules, scope) ? config.rules[scope] : undefined;
-    if (!entry) {
-      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
-    }
-    const rule = typeof entry === "object" ? entry.rule : entry;
-    if (typeof entry === "object" && entry.inject && identity !== null) {
-      const fields = entry.inject(identity, ctx);
-      if (typeof fields === "object" && fields !== null && isThenable(fields)) {
-        throw new Error(`[stitchkit] auth: the inject of scope "${scope}" must be synchronous — an async inject merges a Promise, not fields`);
-      }
-      mergeContextContribution(ctx, fields, scope);
-    }
-    if (rule === "public")
-      return;
-    if (!identity) {
-      onAnonymous();
-      return;
-    }
-    if (rule === "authenticated")
-      return;
-    const result = await rule(identity, ctx);
-    if (result === false) {
-      onForbidden();
-      return;
-    }
-    if (result === true)
-      return;
-    mergeContextContribution(ctx, result, scope);
-  }
-  auth[scopedAuthHookBrand] = () => {
-    return;
-  };
-  authOwnershipPlans.set(auth, {
-    defaultScope: config.defaultScope,
-    hook: auth,
-    scopes: new Set(Object.keys(config.rules))
-  });
-  return auth;
-}
-function composeAuthHooks(config) {
-  const plans = [];
-  for (const hook of config.hooks) {
-    const plan = authOwnershipPlans.get(hook);
-    if (!plan) {
-      throw new TypeError("[stitchkit] auth: composeAuthHooks accepts only hooks created by createAuthHook or composeAuthHooks");
-    }
-    if (plan.defaultScope !== undefined && plan.defaultScope !== config.defaultScope) {
-      throw new TypeError(`[stitchkit] auth: child default scope ${JSON.stringify(plan.defaultScope)} must match the composite default scope`);
-    }
-    plans.push(plan);
-  }
-  const defaultScope = config.defaultScope;
-  if (defaultScope !== undefined && !plans.some((plan) => plan.scopes.has(defaultScope))) {
-    throw new TypeError(`[stitchkit] auth: composite default scope ${JSON.stringify(defaultScope)} has no owner`);
-  }
-  const ownedScopes = new Set;
-  for (const plan of plans) {
-    for (const scope of plan.scopes)
-      ownedScopes.add(scope);
-  }
-  async function composed(ctx, endpoint) {
-    const scope = endpoint.scope ?? config.defaultScope;
-    if (!scope)
-      return;
-    const owners = plans.filter((plan) => plan.scopes.has(scope));
-    if (owners.length === 0) {
-      throw new Error(`[stitchkit] auth: no rule for scope "${scope}"`);
-    }
-    const scopedEndpoint = { ...endpoint, scope };
-    const contribution = Object.create(null);
-    const contributionOwners = new Set;
-    for (const owner of owners) {
-      ctx.signal?.throwIfAborted();
-      const shadow = createShadowContext(ctx);
-      await owner.hook(shadow, scopedEndpoint);
-      const ownerContribution = prepareContextContribution(contextContributionDelta(ctx, shadow, scope), scope);
-      for (const key of Object.keys(ownerContribution)) {
-        if (contributionOwners.has(key)) {
-          throw new TypeError(`[stitchkit] auth: multiple owners contributed context key ${JSON.stringify(key)} for scope ${JSON.stringify(scope)}`);
-        }
-        contributionOwners.add(key);
-      }
-      Object.assign(contribution, ownerContribution);
-    }
-    ctx.signal?.throwIfAborted();
-    mergeContextContribution(ctx, contribution, scope);
-  }
-  composed[scopedAuthHookBrand] = () => {
-    return;
-  };
-  authOwnershipPlans.set(composed, {
-    defaultScope: config.defaultScope,
-    hook: composed,
-    scopes: ownedScopes
-  });
-  return composed;
-}
-function createBearerResolver(config) {
-  return async (req) => {
-    const token = extractToken(req);
-    if (!token)
-      return null;
-    return config.lookup(token, req);
-  };
-}
-
-// src/server/middleware/pkce.ts
-async function verifyPkce(verifier, challenge) {
-  if (!verifier || !challenge)
-    return false;
-  const derived = await deriveCodeChallenge(verifier);
-  return derived === challenge;
-}
-
-export { parseCookieHeader, parseCookies, serializeCookie, defineCookie, verifyJwt, signJwt, extractToken, createAuthHook, composeAuthHooks, createBearerResolver, verifyPkce };