@pmcollab/coworkstream-auth

Auth adapter shims for @pmcollab/coworkstream-server. Maps your auth provider's identity into the { id, ... } shape the core handlers expect.

Install

npm install @pmcollab/coworkstream-auth

Use

import express from 'express'
import { createWorkStreamRouter } from '@pmcollab/coworkstream-server/express'
import { fromClerk } from '@pmcollab/coworkstream-auth'
import { clerkMiddleware } from '@clerk/express'

const app = express()
app.use(clerkMiddleware())
app.use('/api/inbox', createWorkStreamRouter({
  listItems: ({ userId, filter }) => db.list(userId, filter),
  applyAction: ({ userId, itemId, action }) => db.action(userId, itemId, action),
  getUser: fromClerk(),
}))

Adapters

| Adapter | Provider | |---|---| | fromClerk() | Clerk (reads req.auth) | | fromAuth0() | Auth0 / OIDC (reads req.user.sub or req.auth.payload.sub) | | fromEntraId() | Microsoft Entra ID / Azure AD — assumes upstream middleware (passport-azure-ad, NextAuth Azure provider, MSAL Node) has already validated the token. Surfaces oid, tid (as tenantId), roles, groups. | | fromEntraIdWithJWKS({ tenantId, audience }) | Same, but validates the bearer token itself against login.microsoftonline.com/{tenant}/discovery/v2.0/keys. Lazy-imports jsonwebtoken and jwks-rsa. | | fromNextAuth(getSession) | NextAuth/Auth.js (call inside Route Handlers with () => getServerSession(authOptions)) | | fromJwt({ secret }) | Raw HMAC-SHA256 JWT (for symmetric setups) | | fromApiKey({ resolve }) | Static API keys via async lookup |

All adapters throw HttpUnauthorized (status 401) on missing/invalid credentials, which the server adapters translate to a JSON error response.

Entra ID example

import express from 'express'
import { createWorkStreamRouter } from '@pmcollab/coworkstream-server/express'
import { fromEntraIdWithJWKS } from '@pmcollab/coworkstream-auth'

const app = express()
app.use('/api/inbox', createWorkStreamRouter({
  listItems: ({ userId, tenantId, filter }) => db.list({ userId, tenantId, filter }),
  applyAction: ({ userId, itemId, action }) => db.action(userId, itemId, action),
  getUser: fromEntraIdWithJWKS({
    tenantId: process.env.AZURE_TENANT_ID,    // or 'common' / 'organizations'
    audience: process.env.AZURE_CLIENT_ID,
  }),
}))

The returned user surfaces tenantId directly so @pmcollab/coworkstream-rbac's tenant isolation works without extra wiring.

License

Commercial. See LICENSE in the repository root.