Token-based identity and access control - access token validation and permission checking
npm install @schafevormfenster/authToken-based authentication and authorization for secure API access.
``typescript
import { checkAccessToken, checkWriteAccessToken, checkAdminAccessToken } from "@schafevormfenster/auth";
// Protect a read endpoint
export async function GET(request: Request) {
const token = request.headers.get('Authorization')?.replace('Bearer ', '');
checkAccessToken(token); // Throws 401 if invalid
const data = await fetchData();
return Response.json(data);
}
// Protect a write endpoint
export async function POST(request: Request) {
const token = request.headers.get('Authorization')?.replace('Bearer ', '');
checkWriteAccessToken(token); // Requires write or admin token
const body = await request.json();
return Response.json(await createData(body), { status: 201 });
}
`
Environment Setup:
`bash`.env
READ_ACCESS_TOKENS=read-token-1,read-token-2
WRITE_ACCESS_TOKENS=write-token-1,write-token-2
ADMIN_ACCESS_TOKENS=admin-token-1
`bash`
pnpm add @schafevormfenster/auth
For faster development with Vite, use TypeScript sources directly:
`typescript`
// vite.config.ts - Requires tsconfig "target": "ES2022"+
export default defineConfig({
resolve: { conditions: ['source', 'import', 'default'] }
});
Benefits: Faster HMR, direct debugging, better tree-shaking.
- Read access (list all posts)
- POST /api/posts - Write access (create new post)
- DELETE /api/posts/:id - Admin access (delete any post)Features
- Hierarchical Permissions: Admin → Write → Read
- Zero Configuration: Works with environment variables
- Type-Safe: Full TypeScript support
- Flexible: Multiple tokens per permission level
- Secure: Never exposes tokens in logs or responses
- Tested: Comprehensive test coverage
API Reference
$3
####
checkAccessToken(token?: string): voidValidates any valid token (read, write, or admin).
- Throws:
ApiErrorConstructor(401) if token is missing or invalid####
checkWriteAccessToken(token?: string): voidValidates write or admin tokens. Read-only tokens are rejected.
- Throws:
ApiErrorConstructor(401) if token is invalid
- Throws: ApiErrorConstructor(403) if token lacks write permission####
checkAdminAccessToken(token?: string): voidValidates admin tokens only. Write and read tokens are rejected.
- Throws:
ApiErrorConstructor(401) if token is invalid
- Throws: ApiErrorConstructor(403) if token lacks admin permission####
getTokenPermissions(token: string): TokenPermissionsReturns permission object for a token.
`typescript
interface TokenPermissions {
read: boolean;
write: boolean;
admin: boolean;
}
`Domain
Authentication & Authorization.
Purpose
This directory contains logic for verifying access tokens and checking permissions.
Responsibilities
- Token Verification: Validating access tokens.
- Permission Checks: Checking if a token has the required permissions (e.g., admin, write).
- Access Control: Enforcing security policies for API access.
Boundaries
- Usage: Used by the API layer (middleware or route handlers) to secure endpoints.
- No Business Logic: Focuses solely on identity and access, not domain business rules.
Documentation
- CONTRIBUTING.md - Comprehensive guide for developers and AI assistants
- Example Implementation - See
apps/web/app/api/auth-examples/` for working examplesMIT