adam/seahaven-ap
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-ap.git synced 2026-09-30 19:43:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
seahaven-ap/packages/api/docs/auth.md
Adam Moussa 9d3646876e
feat(api): stand up Hono Drizzle foundation with auth and Redocly (AP-14) (#12) 
* feat(api): stand up Hono Drizzle foundation with auth and Redocly

* fix(api): bump drizzle-orm and hono node-server past audit highs

* fix(api): harden auth upsert and Cognito token verification
2026-08-11 00:10:49 +00:00

1.4 KiB
Raw Blame History

Authentication

Cognito bearer tokens

Production and seahaven-dev expect a Bearer Cognito token verified against the user pool JWKS and issuer.

Audience check:

  • ID tokens (token_use=id): aud must equal COGNITO_AUDIENCE (app client id).
  • Access tokens (token_use=access): client_id must equal COGNITO_AUDIENCE.

Identity claims (sub, email, and name or cognito:username) are required. Prefer a Cognito ID token, which carries email/name by default. An access token is accepted only when it includes an email claim (for example via a pre-token-generation enrichment).

Optional role claim mapping:

  • custom:role or role → role (admin, ap_processor, approver, viewer)
  • Missing role defaults to viewer

Users are upserted by sub only. An email already linked to a different sub returns HTTP 409 and does not rebind the account.

Local DEV_AUTH_BYPASS

For local development only, set DEV_AUTH_BYPASS=true. The middleware uses DEV_AUTH_SUB, DEV_AUTH_EMAIL, DEV_AUTH_NAME, and DEV_AUTH_ROLE and skips JWT verification.

Align DEV_AUTH_SUB with the seeded Cognito subject (default seed-sub-admin) so local auth updates the seed user instead of conflicting on email.

DEV_AUTH_BYPASS is allowed only when NODE_ENV is development or test. Any other value (including production, staging, and preview) rejects startup.