unjwt 0.7.1 → 0.7.3

package/dist/adapters/elysia/index.mjs

@@ -0,0 +1,608 @@
+import { computeDurationInSeconds, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "../../_chunks/utils.mjs";
+import { sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM } from "../../_chunks/jwk.mjs";
+import { sign, verify } from "../../_chunks/jws.mjs";
+import { decrypt, encrypt } from "../../_chunks/jwe.mjs";
+import { Elysia } from "elysia";
+function guardName(contextKey) {
+	return `require${contextKey.charAt(0).toUpperCase()}${contextKey.slice(1)}`;
+}
+const CHUNK_MARKER = "__chunked__";
+const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
+const MAX_CHUNK_COUNT = 100;
+function readChunkedCookie(jar, name) {
+	const main = asString(jar[name]?.value);
+	if (main === void 0) return void 0;
+	if (!main.startsWith(CHUNK_MARKER)) return main;
+	const count = parseChunkCount(main);
+	if (count === 0) return void 0;
+	const parts = [];
+	for (let i = 1; i <= count; i++) {
+		const part = asString(jar[chunkName(name, i)]?.value);
+		if (part === void 0) return void 0;
+		parts.push(part);
+	}
+	return parts.join("");
+}
+function writeChunkedCookie(jar, name, value, options = {}) {
+	const { chunkMaxLength, ...attrs } = options;
+	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
+	const chunkCount = Math.ceil(value.length / max);
+	if (chunkCount > MAX_CHUNK_COUNT) throw new Error(`[unjwt/elysia] Session token requires ${chunkCount} cookie chunks, exceeding the limit of ${MAX_CHUNK_COUNT}.`);
+	const previousCount = parseChunkCount(asString(jar[name]?.value));
+	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
+	for (let i = firstSurplus; i <= previousCount; i++) expireCookie(jar, chunkName(name, i), attrs);
+	if (chunkCount <= 1) {
+		jar[name].set({
+			...attrs,
+			value
+		});
+		return;
+	}
+	jar[name].set({
+		...attrs,
+		value: `${CHUNK_MARKER}${chunkCount}`
+	});
+	for (let i = 1; i <= chunkCount; i++) {
+		const slice = value.slice((i - 1) * max, i * max);
+		jar[chunkName(name, i)].set({
+			...attrs,
+			value: slice
+		});
+	}
+}
+function removeChunkedCookie(jar, name, attrs = {}) {
+	const count = parseChunkCount(asString(jar[name]?.value));
+	expireCookie(jar, name, attrs);
+	for (let i = 1; i <= count; i++) expireCookie(jar, chunkName(name, i), attrs);
+}
+function expireCookie(jar, fullName, attrs) {
+	jar[fullName].set({
+		...attrs,
+		value: "",
+		maxAge: 0,
+		expires: /* @__PURE__ */ new Date(0)
+	});
+}
+function chunkName(name, index) {
+	return `${name}.${index}`;
+}
+function parseChunkCount(main) {
+	if (main === void 0 || !main.startsWith(CHUNK_MARKER)) return 0;
+	const suffix = main.slice(11);
+	if (!/^\d+$/.test(suffix)) return 0;
+	const count = Number.parseInt(suffix, 10);
+	if (count < 1 || count > MAX_CHUNK_COUNT) return 0;
+	return count;
+}
+function asString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+const DEFAULT_NAME$1 = "elysia-jws";
+const DEFAULT_COOKIE$1 = {
+	path: "/",
+	secure: true,
+	httpOnly: false
+};
+async function createJWSSession(context, config) {
+	const state = emptySession$1(config);
+	await initFromToken$1(context, config, state);
+	return buildManager$1(context, config, state);
+}
+function jwsSession(config) {
+	const contextKey = config.contextKey ?? "session";
+	return new Elysia({
+		name: "unjwt/elysia-jws",
+		seed: contextKey
+	}).resolve({ as: "scoped" }, async ({ cookie, request }) => {
+		const session = await createJWSSession({
+			cookie,
+			request
+		}, config);
+		return { [contextKey]: session };
+	}).macro({ [guardName(contextKey)]: { resolve(ctx) {
+		if (!ctx[contextKey]?.id) return ctx.status(401, "Unauthorized");
+		return {};
+	} } });
+}
+function buildManager$1(context, config, state) {
+	const manager = {
+		get id() {
+			return state.id;
+		},
+		get createdAt() {
+			return state.createdAt;
+		},
+		get expiresAt() {
+			return state.expiresAt;
+		},
+		get data() {
+			return state.data;
+		},
+		get token() {
+			return state.token;
+		},
+		update: async (update) => {
+			await updateSession$1(context, config, state, update);
+			return manager;
+		},
+		clear: async () => {
+			await clearSession$1(context, config, state);
+			return manager;
+		}
+	};
+	return manager;
+}
+async function initFromToken$1(context, config, state) {
+	const token = readToken$1(context, config);
+	if (!token) return;
+	state.token = token;
+	let exclusiveHookFired = false;
+	try {
+		const unsealed = await verifySession(context, config, token);
+		Object.assign(state, unsealed);
+	} catch (error_) {
+		exclusiveHookFired = true;
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+			session: {
+				id: error_.cause.jti,
+				createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+				expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+				token
+			},
+			context,
+			error: error_,
+			config
+		});
+		else await config.hooks?.onError?.({
+			session: state,
+			context,
+			error: error_,
+			config
+		});
+	}
+	if (!exclusiveHookFired && state.id !== void 0 && state.token !== void 0) await config.hooks?.onRead?.({
+		session: state,
+		context,
+		config
+	});
+}
+async function updateSession$1(context, config, state, update) {
+	const oldSession = {
+		...state,
+		data: sanitizeObjectCopy(state.data)
+	};
+	const resolvedUpdate = typeof update === "function" ? update(state.data) : update;
+	if (resolvedUpdate) Object.assign(state.data, resolvedUpdate);
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	state.id = config.generateId?.() || crypto.randomUUID();
+	state.createdAt = createdAt;
+	state.expiresAt = config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3;
+	let token;
+	try {
+		token = await signSession(config, state);
+	} catch (error_) {
+		state.id = oldSession.id;
+		state.createdAt = oldSession.createdAt;
+		state.expiresAt = oldSession.expiresAt;
+		state.data = oldSession.data;
+		state.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session: state,
+			context,
+			error: error_,
+			config
+		});
+		throw error_;
+	}
+	state.token = token;
+	if (config.cookie !== false) {
+		const { chunkMaxLength, ...attrs } = {
+			...DEFAULT_COOKIE$1,
+			...config.cookie
+		};
+		writeChunkedCookie(context.cookie, config.name || DEFAULT_NAME$1, token, {
+			...attrs,
+			chunkMaxLength,
+			expires: config.maxAge === void 0 ? void 0 : new Date(createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
+		});
+	}
+	await config.hooks?.onUpdate?.({
+		session: state,
+		oldSession,
+		context,
+		config
+	});
+}
+async function clearSession$1(context, config, state) {
+	const oldSession = state.id !== void 0 || state.token !== void 0 ? {
+		...state,
+		data: sanitizeObjectCopy(state.data)
+	} : void 0;
+	const fresh = emptySession$1(config);
+	state.id = fresh.id;
+	state.createdAt = fresh.createdAt;
+	state.expiresAt = fresh.expiresAt;
+	state.data = fresh.data;
+	state.token = fresh.token;
+	if (config.cookie !== false) {
+		const { chunkMaxLength: _chunkMaxLength, ...attrs } = {
+			...DEFAULT_COOKIE$1,
+			...config.cookie
+		};
+		removeChunkedCookie(context.cookie, config.name || DEFAULT_NAME$1, attrs);
+	}
+	await config.hooks?.onClear?.({
+		oldSession,
+		context,
+		config
+	});
+}
+async function signSession(config, state) {
+	const key = getSignKey(config.key);
+	const iat = Math.floor(state.createdAt / 1e3);
+	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
+	const payload = {
+		...state.data,
+		jti: state.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	return sign(payload, key, {
+		...config.jws?.signOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jws?.signOptions?.protectedHeader,
+			kid: "kid" in key ? key.kid : void 0,
+			typ: resolveTyp$1(config) || "JWT",
+			cty: "application/json"
+		}
+	});
+}
+async function verifySession(context, config, token) {
+	const alg = config.jws?.signOptions?.alg;
+	const { payload } = await verify(token, config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
+		header,
+		context,
+		config
+	}) : getVerifyKey(config.key), {
+		...config.jws?.verifyOptions,
+		requiredClaims: [.../* @__PURE__ */ new Set([
+			...config.jws?.verifyOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: resolveTyp$1(config) || "JWT",
+		algorithms: alg ? [alg] : void 0,
+		forceUint8Array: false,
+		validateClaims: true
+	}).catch((error_) => {
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
+		const message = error_ instanceof Error ? error_.message : String(error_);
+		throw new Error(`Invalid session token: ${message}`);
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : emptyData$1()
+	};
+}
+function emptySession$1(config) {
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	return {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
+		data: emptyData$1(),
+		token: void 0
+	};
+}
+function emptyData$1() {
+	return Object.create(null);
+}
+function readToken$1(context, config) {
+	const sessionName = config.name || DEFAULT_NAME$1;
+	if (config.sessionHeader !== false) {
+		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+		const headerValue = context.request.headers.get(headerName);
+		if (typeof headerValue === "string") return headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false) return readChunkedCookie(context.cookie, sessionName);
+}
+function resolveTyp$1(config) {
+	const typ = config.jws?.signOptions?.protectedHeader?.typ;
+	if (typeof typ === "string" && typ.toLowerCase().includes("jwt")) return typ;
+}
+function getSignKey(key) {
+	if (!key) throw new Error("[unjwt/elysia] JWS key is required.");
+	let _key;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("[unjwt/elysia] Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
+	return _key;
+}
+function getVerifyKey(key) {
+	if (!key) throw new Error("[unjwt/elysia] JWS key is required.");
+	let _key;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key) {
+		const publicKey = key.publicKey;
+		if (isPublicJWK(publicKey)) _key = publicKey;
+		else if (Array.isArray(publicKey)) {
+			const keys = publicKey.filter((candidate) => isPublicJWK(candidate));
+			if (keys.length > 0) _key = { keys };
+		} else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
+			const keys = publicKey.keys.filter((candidate) => isPublicJWK(candidate));
+			if (keys.length > 0) _key = { keys };
+		}
+	}
+	if (!_key) throw new Error("[unjwt/elysia] Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
+	return _key;
+}
+const DEFAULT_NAME = "elysia-jwe";
+const DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: true
+};
+async function createJWESession(context, config) {
+	const state = emptySession(config);
+	await initFromToken(context, config, state);
+	return buildManager(context, config, state);
+}
+function jweSession(config) {
+	const contextKey = config.contextKey ?? "session";
+	return new Elysia({
+		name: "unjwt/elysia-jwe",
+		seed: contextKey
+	}).resolve({ as: "scoped" }, async ({ cookie, request }) => {
+		const session = await createJWESession({
+			cookie,
+			request
+		}, config);
+		return { [contextKey]: session };
+	}).macro({ [guardName(contextKey)]: { resolve(ctx) {
+		if (!ctx[contextKey]?.id) return ctx.status(401, "Unauthorized");
+		return {};
+	} } });
+}
+function buildManager(context, config, state) {
+	const manager = {
+		get id() {
+			return state.id;
+		},
+		get createdAt() {
+			return state.createdAt;
+		},
+		get expiresAt() {
+			return state.expiresAt;
+		},
+		get data() {
+			return state.data;
+		},
+		get token() {
+			return state.token;
+		},
+		update: async (update) => {
+			await updateSession(context, config, state, update);
+			return manager;
+		},
+		clear: async () => {
+			await clearSession(context, config, state);
+			return manager;
+		}
+	};
+	return manager;
+}
+async function initFromToken(context, config, state) {
+	const token = readToken(context, config);
+	if (!token) return;
+	state.token = token;
+	let exclusiveHookFired = false;
+	try {
+		const unsealed = await unsealSession(context, config, token);
+		Object.assign(state, unsealed);
+	} catch (error_) {
+		exclusiveHookFired = true;
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+			session: {
+				id: error_.cause.jti,
+				createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+				expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+				token
+			},
+			context,
+			error: error_,
+			config
+		});
+		else await config.hooks?.onError?.({
+			session: state,
+			context,
+			error: error_,
+			config
+		});
+	}
+	if (!exclusiveHookFired && state.id !== void 0 && state.token !== void 0) await config.hooks?.onRead?.({
+		session: state,
+		context,
+		config
+	});
+}
+async function updateSession(context, config, state, update) {
+	const oldSession = {
+		...state,
+		data: sanitizeObjectCopy(state.data)
+	};
+	const resolvedUpdate = typeof update === "function" ? update(state.data) : update;
+	if (resolvedUpdate) Object.assign(state.data, resolvedUpdate);
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	state.id = config.generateId?.() || crypto.randomUUID();
+	state.createdAt = createdAt;
+	state.expiresAt = config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3;
+	let token;
+	try {
+		token = await sealSession(config, state);
+	} catch (error_) {
+		state.id = oldSession.id;
+		state.createdAt = oldSession.createdAt;
+		state.expiresAt = oldSession.expiresAt;
+		state.data = oldSession.data;
+		state.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session: state,
+			context,
+			error: error_,
+			config
+		});
+		throw error_;
+	}
+	state.token = token;
+	if (config.cookie !== false) {
+		const { chunkMaxLength, ...attrs } = {
+			...DEFAULT_COOKIE,
+			...config.cookie
+		};
+		writeChunkedCookie(context.cookie, config.name || DEFAULT_NAME, token, {
+			...attrs,
+			chunkMaxLength,
+			expires: config.maxAge === void 0 ? void 0 : new Date(createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
+		});
+	}
+	await config.hooks?.onUpdate?.({
+		session: state,
+		oldSession,
+		context,
+		config
+	});
+}
+async function clearSession(context, config, state) {
+	const oldSession = state.id !== void 0 || state.token !== void 0 ? {
+		...state,
+		data: sanitizeObjectCopy(state.data)
+	} : void 0;
+	const fresh = emptySession(config);
+	state.id = fresh.id;
+	state.createdAt = fresh.createdAt;
+	state.expiresAt = fresh.expiresAt;
+	state.data = fresh.data;
+	state.token = fresh.token;
+	if (config.cookie !== false) {
+		const { chunkMaxLength: _chunkMaxLength, ...attrs } = {
+			...DEFAULT_COOKIE,
+			...config.cookie
+		};
+		removeChunkedCookie(context.cookie, config.name || DEFAULT_NAME, attrs);
+	}
+	await config.hooks?.onClear?.({
+		oldSession,
+		context,
+		config
+	});
+}
+async function sealSession(config, state) {
+	const key = getEncryptKey(config.key);
+	const iat = Math.floor(state.createdAt / 1e3);
+	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
+	const payload = {
+		...state.data,
+		jti: state.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	return encrypt(payload, key, {
+		...config.jwe?.encryptOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jwe?.encryptOptions?.protectedHeader,
+			typ: resolveTyp(config) || "JWT",
+			cty: "application/json"
+		}
+	});
+}
+async function unsealSession(context, config, sealed) {
+	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
+		header,
+		context,
+		config
+	}) : getDecryptKey(config.key);
+	const alg = config.jwe?.encryptOptions?.alg;
+	const enc = config.jwe?.encryptOptions?.enc;
+	const { payload } = await decrypt(sealed, key, {
+		...config.jwe?.decryptOptions,
+		requiredClaims: [.../* @__PURE__ */ new Set([
+			...config.jwe?.decryptOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: resolveTyp(config) || "JWT",
+		maxTokenAge: config.maxAge,
+		algorithms: alg ? [alg] : void 0,
+		encryptionAlgorithms: enc ? [enc] : void 0,
+		unwrappedKeyAlgorithm: void 0,
+		keyUsage: void 0,
+		forceUint8Array: false,
+		validateClaims: true
+	}).catch((error_) => {
+		if (error_ instanceof Error) throw error_;
+		throw new Error(String(error_));
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : emptyData()
+	};
+}
+function emptySession(config) {
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	return {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
+		data: emptyData(),
+		token: void 0
+	};
+}
+function emptyData() {
+	return Object.create(null);
+}
+function readToken(context, config) {
+	const sessionName = config.name || DEFAULT_NAME;
+	if (config.sessionHeader !== false) {
+		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+		const headerValue = context.request.headers.get(headerName);
+		if (typeof headerValue === "string") return headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false) return readChunkedCookie(context.cookie, sessionName);
+}
+function resolveTyp(config) {
+	const typ = config.jwe?.encryptOptions?.protectedHeader?.typ;
+	if (typeof typ === "string" && typ.toLowerCase().includes("jwt")) return typ;
+}
+function getEncryptKey(key) {
+	if (!key) throw new Error("[unjwt/elysia] JWE key is required.");
+	let _key;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("[unjwt/elysia] Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
+	return _key;
+}
+function getDecryptKey(key) {
+	if (!key) throw new Error("[unjwt/elysia] JWE key is required.");
+	let _key;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key) _key = key.privateKey;
+	if (!_key) throw new Error("[unjwt/elysia] Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
+	return _key;
+}
+export { createJWESession, createJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession };