@ngriffin_uk/auth-protocol

Runtime-neutral request parsing, response validation, and flow serialisation for authentication clients and servers.

pnpm add @ngriffin_uk/auth-protocol

import {
  parseAuthRequest,
  serializeAuthFlowResult,
} from "@ngriffin_uk/auth-protocol";

const request = parseAuthRequest(await incomingRequest.json());
const { result, sessionToken } = serializeAuthFlowResult(flow, {
  mapUser: (user) => ({ id: user.id }),
});

parseAuthRequest rejects unknown fields, unsupported discriminants, and unbounded values. serializeAuthFlowResult returns a wire-safe result and keeps the raw session token separate so the server can set it in a secure cookie instead of exposing it in JSON.

Browser redirect policy is intentionally not part of this package. Validate allowed redirect origins at the browser or application boundary.