weifuwu 0.32.0 → 0.32.1

package/README.md

@@ -370,22 +370,27 @@ app.post('/api/chat', async (req, ctx) => {
 
 ### Auth
 
+JWT extraction priority: `cookie` → `Authorization: Bearer` → `?access_token=`. All callbacks receive `ctx` so `ctx.sql` is directly available.
+
 ```ts
 import { auth } from 'weifuwu'
 
-// JWT
+// JWT — cookie, header, or ?access_token=
 app.use(auth({ jwt: { secret: process.env.JWT_SECRET } }))
 
-// Session cookie
+// Session cookie — loadUser gets ctx
 app.use(auth({
   session: {
     secret: '...',
-    loadUser: async (data) => db.findUser(data.userId),
+    loadUser: async (data, ctx) => ctx.sql`SELECT * FROM users WHERE id = ${data.userId}`,
   },
 }))
 
-// API key
-app.use(auth({ apiKey: { validate: async (key) => db.findByApiKey(key) } }))
+// API key — header or ?api_key=
+app.use(auth({ apiKey: {
+  query: 'api_key',
+  validate: async (key, ctx) => ctx.sql`SELECT * FROM users WHERE api_key = ${key}`,
+} }))
 
 // ctx.user is now available
 app.get('/me', (req, ctx) => {

package/dist/index.js

@@ -926,7 +926,7 @@ function auth(opts) {
   return async (req, ctx, next) => {
     if (opts.jwt) {
       const cookie = opts.jwt.cookie ?? "token";
-      const token = parseCookie(req.headers.get("cookie"), cookie) ?? req.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
+      const token = parseCookie(req.headers.get("cookie"), cookie) ?? req.headers.get("authorization")?.replace(/^Bearer\s+/i, "") ?? ctx.query.access_token;
       if (token) {
         try {
           const [headerB64, payloadB64, sigB64] = token.split(".");
@@ -957,7 +957,7 @@ function auth(opts) {
           const expectedBuf = Buffer.from(expectedSig, "base64url");
           if (sigBuf.length === expectedBuf.length && timingSafeEqual(sigBuf, expectedBuf)) {
             const data = JSON.parse(base64urlDecode(dataB64));
-            const user = await opts.session.loadUser(data);
+            const user = await opts.session.loadUser(data, ctx);
             if (user) ctx.user = user;
           }
         } catch {
@@ -967,10 +967,14 @@ function auth(opts) {
     if (opts.apiKey && !ctx.user) {
       const header = opts.apiKey.header ?? "authorization";
       const prefix = opts.apiKey.prefix ?? "Bearer ";
-      const raw = req.headers.get(header);
+      let raw = req.headers.get(header);
+      if (!raw && opts.apiKey.query) {
+        raw = ctx.query[opts.apiKey.query];
+        if (raw) raw = prefix + raw;
+      }
       if (raw?.startsWith(prefix)) {
         const key = raw.slice(prefix.length);
-        const user = await opts.apiKey.validate(key);
+        const user = await opts.apiKey.validate(key, ctx);
         if (user) ctx.user = user;
       }
     }

package/dist/middleware/auth.d.ts

@@ -1,4 +1,4 @@
-import type { Middleware, User } from '../types.ts';
+import type { Middleware, User, Context } from '../types.ts';
 export interface AuthOptions {
     /**
      * JWT authentication.
@@ -23,8 +23,8 @@ export interface AuthOptions {
         secret: string;
         /** Cookie name (default: 'session'). */
         cookie?: string;
-        /** Load user from session data. */
-        loadUser: (data: Record<string, unknown>) => Promise<User | null> | User | null;
+        /** Load user from session data. `ctx` has `ctx.sql`, `ctx.redis`, etc. */
+        loadUser: (data: Record<string, unknown>, ctx: Context) => Promise<User | null> | User | null;
     };
     /**
      * API key authentication via header.
@@ -37,8 +37,10 @@ export interface AuthOptions {
         header?: string;
         /** Prefix to strip (default: 'Bearer '). */
         prefix?: string;
-        /** Validate an API key → User or null. */
-        validate: (key: string) => Promise<User | null> | User | null;
+        /** Query parameter name (e.g. 'api_key'). */
+        query?: string;
+        /** Validate an API key → User or null. `ctx` has `ctx.sql`, `ctx.redis`, etc. */
+        validate: (key: string, ctx: Context) => Promise<User | null> | User | null;
     };
 }
 /**
@@ -57,12 +59,12 @@ export interface AuthOptions {
  * app.use(auth({
  *   session: {
  *     secret: '...',
- *     loadUser: async (data) => db.findUser(data.userId),
+ *     loadUser: async (data, ctx) => ctx.sql`SELECT * FROM users WHERE id = ${data.userId}`,
  *   },
  * }))
  *
  * // API key
- * app.use(auth({ apiKey: { validate: async (key) => db.findByApiKey(key) } }))
+ * app.use(auth({ apiKey: { validate: async (key, ctx) => ctx.sql`...` } }))
  * ```
  */
 export declare function auth(opts: AuthOptions): Middleware;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "weifuwu",
   "type": "module",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "description": "Web-standard HTTP microframework for Node.js — (req, ctx) => Response",
   "exports": {
     ".": {