@omni/plugin-auth

OmniAPI 鉴权工具集：JWT (HS256) / API Key 验证 + auth() 中间件构建器。

零外部依赖（仅用 Node 内建 crypto）。

用法

在 HTTP Adapter 注入鉴权

import { createHttpAdapter } from '@omni/http';
import { verifyJWT, createApiKeyVerifier } from '@omni/plugin-auth';

const apiKeys = createApiKeyVerifier({
  keys: { 'sk_live_xxx': { id: 'svc-a', roles: ['service'] } },
});

const adapter = createHttpAdapter({
  registry,
  authenticate: (req) => {
    // 1) Bearer JWT
    const auth = req.headers.authorization;
    if (auth?.startsWith('Bearer ')) {
      try {
        const p = verifyJWT(auth.slice(7), process.env.JWT_SECRET!);
        return { id: p.sub!, roles: (p.roles as string[]) ?? [] };
      } catch { /* fallthrough */ }
    }
    // 2) API Key
    const key = req.headers['x-api-key'] as string | undefined;
    return apiKeys.verify(key);
  },
});

在 Procedure 上挂中间件

import { auth } from '@omni/plugin-auth';

defineProcedure({
  name: 'admin.purge',
  middleware: [auth({ require: 'admin' })],
  // ...
});

API

• signJWT(payload, secret, opts?) / verifyJWT(token, secret, opts?) - HS256 实现，零依赖
• createApiKeyVerifier({ keys }) - 恒定时间比较 key
• auth(options?) - 鉴权中间件：required / require (string | string[] | function)

安全说明

• JWT 仅支持 HS256；需要 RS256 / JWK 轮换请用 jose / jsonwebtoken
• API Key 比较使用 timingSafeEqual，防计时侧信道
• 切勿在客户端代码中直接持有 secret