@autolabz/service-auth-hono

Hono / Cloudflare Workers authentication middleware for AutoLab services: JWT verification with OAuth userinfo fallback, client_id and scope enforcement.

Features

• Unified auth chain: JWT first (SIMPLE), then OAuth userinfo fallback
• OAuth validation: X-Client-Id vs azp, optional required scopes
• Framework-agnostic core: Built on @autolabz/service-auth-core
• Worker-ready: No Node-only APIs; works on Cloudflare Workers

Installation

npm install @autolabz/service-auth-hono hono

Quick Start

One-shot middleware chain

import { Hono } from 'hono';
import { authMiddlewareChain } from '@autolabz/service-auth-hono';

const app = new Hono();

const authConfig = {
  jwtAlg: 'HS256' as const,
  jwtAccessSecret: process.env.JWT_ACCESS_SECRET,
  authBaseUrl: process.env.AUTH_BASE_URL!,
  oauthUserinfoPath: '/oauth/userinfo',
  oauthUserinfoTimeoutMs: 2000,
};

app.get('/health', (c) => c.json({ status: 'ok' }));

app.use('/api/*', authMiddlewareChain({
  authConfig,
  clientId: {},
  enforce: { requiredScopes: [] },
}));

app.get('/api/me', (c) => {
  const auth = c.get('auth');
  const clientId = c.get('clientId');
  return c.json({ userId: auth.userId, clientId, scope: auth.scope, tokenType: auth.tokenType });
});

Step-by-step middlewares

import { authMiddleware, clientIdMiddleware, enforceClientScopeMiddleware } from '@autolabz/service-auth-hono';

app.use('/api/*', authMiddleware(authConfig));
app.use('/api/*', clientIdMiddleware({}));
app.use('/api/*', enforceClientScopeMiddleware(authConfig, { requiredScopes: ['data'] }));

app.get('/api/me', (c) => c.json({ userId: c.get('auth').userId }));

Request verification (no middleware)

import { verifyRequest, verifyRequestWithScopes } from '@autolabz/service-auth-hono';

app.get('/api/me', async (c) => {
  const result = await verifyRequest(c.req.raw, authConfig);
  if (!result.success) {
    return c.json({ error: result.error }, 401);
  }
  return c.json({ userId: result.auth.userId });
});

AuthBridge for downstream SDKs

import { makeAuthBridgeFromContext } from '@autolabz/service-auth-hono';
import { createDataClient } from '@autolabz/data-sdk';

app.get('/api/data', async (c) => {
  const auth = makeAuthBridgeFromContext(c, {
    onUnauthorized: () => console.warn('Downstream 401'),
  });
  const client = createDataClient({ baseURL: env.DATA_BASE_URL, auth });
  const data = await client.get('/v1/data/my-key');
  return c.json(data);
});

API

• verifyRequest(request, config) – Verify Request; returns AuthResult
• verifyRequestWithScopes(request, config, requiredScopes) – Verify + scope check
• authMiddleware(config) – Bearer + JWT/userinfo; sets c.set('auth')
• clientIdMiddleware(options?) – X-Client-Id / client_id query; sets c.set('clientId')
• enforceClientScopeMiddleware(config, enforceOptions?) – iss/aud/client/scope check
• authMiddlewareChain(options) – Combined auth + clientId + enforce
• makeAuthBridgeFromContext(c, options?) – AuthBridge for SDK clients

Context variables

After middleware: c.get('auth') (AuthPayload), c.get('clientId') (string).

Environment variables

Same as other service-auth adapters:

• JWT_ALG: HS256 | RS256
• JWT_ACCESS_SECRET: required for HS256
• JWKS_URL: required for RS256
• AUTH_BASE_URL: OAuth base URL
• AUTH_ISSUER, OAUTH_USERINFO_TIMEOUT_MS, OAUTH_EXPECTED_AUDIENCE: optional

License

MIT