@cemiar/auth-sdk

Reusable helpers for integrating Cemiar Auth in web front-ends and Node.js APIs.

This package bundles:

• A browser-friendly Cemiar Auth client with email codes, Microsoft login support, token storage, refresh and logout helpers
• Axios utilities to attach automatic Authorization headers and refresh tokens on 401 responses
• A Hapi JWT strategy helper that fetches Cemiar Auth signing keys from JWKS and validates incoming requests

Installation

npm install @cemiar/auth-sdk

When working inside this monorepo, you can add it via a file reference:

npm install @cemiar/auth-sdk@file:../packages/cemiar-auth-sdk

Make sure the host project also has the required peer dependencies installed (@hapi/hapi, hapi-auth-jwt2).

Usage

Front-end (Vue/React/etc.)

import { createCemiarAuthClient } from "@cemiar/auth-sdk";

const authClient = createCemiarAuthClient({
    baseUrl: import.meta.env.VITE_CEMIAR_AUTH_URL!,
    tenantId: import.meta.env.VITE_CEMIAR_TENANT_ID!,
    auds: (import.meta.env.VITE_CEMIAR_AUDS || "").split(","),
    redirectUrl: `${window.location.origin}/auth/microsoft/callback`,
    logoutRedirectUrl: `${window.location.origin}/login`
});

// Trigger Microsoft login
window.location.href = authClient.getMicrosoftLoginUrl();

// Email code flow
await authClient.sendEmailCode("[email protected]");
const { accessToken } = await authClient.verifyEmailCode("[email protected]", "123456");

// Axios client with automatic Authorization header and refresh-on-401
const api = authClient.createApiClient({ baseURL: import.meta.env.VITE_API_BASE });
const jobs = await api.get("/api/jobs");

// Manual interceptor attachment if you already have an axios instance
authClient.attachInterceptors(existingAxiosInstance);

Handling the Microsoft callback

const params = Object.fromEntries(new URLSearchParams(window.location.search));
const user = authClient.handleRedirectMicrosoftCallback(params);

if (user) {
    history.replaceState(null, "", "/dashboard");
}

handleRedirectMicrosoftCallback stores the returned access token, infers the login method for future logouts, and gives you the signed-in user details. Call it once on your redirect page, then clean up the query string if needed.

Token storage hooks

By default the client stores tokens in localStorage. Override storage to customize behaviour:

import { createCemiarAuthClient, TokenStorage } from "@cemiar/auth-sdk";

const storage: TokenStorage = {
    getToken: () => cookies.get("cemiar-access"),
    setToken: token => {
        token ? cookies.set("cemiar-access", token) : cookies.remove("cemiar-access");
    }
};

const authClient = createCemiarAuthClient({
    baseUrl: import.meta.env.VITE_CEMIAR_AUTH_URL!,
    tenantId: import.meta.env.VITE_CEMIAR_TENANT_ID!,
    auds: ["cemiar-jobs"],
    storage
});

Logging out

await authClient.logout();

Logout automatically detects whether the user signed in with Microsoft or email and routes to the matching Cemiar Auth endpoint. Override behaviour with the optional flags:

• redirectUrl: override the post-logout redirect (defaults to logoutRedirectUrl from the constructor)
• performRedirect: set to false to stay on the page and only clear the server session
• clearToken: set to false to retain the locally cached access token

You can still specify method: "microsoft" | "emailCode" if you need to force a flow.

Backend (Hapi)

import { registerCemiarAuthHapi } from "@cemiar/auth-sdk";

await registerCemiarAuthHapi(server, {
    authUrl: process.env.CEMIAR_AUTH_URL!,
    strategyName: "jwt",
    validate: async decoded => ({
        isValid: true,
        credentials: decoded.payload
    })
});

The helper automatically fetches signing keys from Cemiar Auth JWKS endpoint and keeps them cached.

To customise the cache and algorithms:

await registerCemiarAuthHapi(server, {
    authUrl: process.env.CEMIAR_AUTH_URL!,
    algorithms: ["RS256"],
    cacheMaxAgeMs: 12 * 60 * 60 * 1000
});

Environment Variables

| Variable | Description | | -------------------------- | ------------------------------------------------------------------ | | VITE_CEMIAR_AUTH_URL | Base Cemiar Auth URL (e.g. https://cemiar-auth.example.com/auth) | | VITE_CEMIAR_TENANT_ID | Tenant identifier provided by Cemiar Auth | | VITE_CEMIAR_AUDS | Comma separated list of audiences | | VITE_CEMIAR_REDIRECT_URL | Optional override for Microsoft redirect | | CEMIAR_AUTH_URL | Backend URL for Cemiar Auth (no Vite prefix) |

Building

cd packages/cemiar-auth-sdk
npm install
npm run build

Output will be generated under dist/.