@barry-rocks/sdk/auth

The pieces of Barry’s local authentication a service needs: isAuthorized for the instance secret, browser sign-in (handleSignIn, hasBrowserSession, SIGN_IN_PATH), and the session cookie. The security model explains what the secret does and doesn’t protect.

import { … } from "@barry-rocks/sdk/auth";

API

Variables

SESSION_COOKIE

const SESSION_COOKIE: "barry_session" = "barry_session"

---

SIGN_IN_PATH

const SIGN_IN_PATH: "/sign-in" = "/sign-in"

Functions

carriesSecret()

carriesSecret(req, secret): boolean

Whether the request carries the secret as a bearer token or x-barry-secret.

Delegates to requestCredential, the single parser the API server already uses: it rejects duplicate Authorization/x-barry-secret headers (which Node can otherwise silently collapse) and enforces a token charset. Keeping two parsers for “does this request carry the secret” is exactly the drift the auth code warns against.

Parameters

Parameter	Type
req	IncomingMessage
secret	string

Returns

boolean

---

handleSignIn()

handleSignIn(req, res, secret, title): Promise<boolean>

Serve GET /sign-in (the form) and POST /sign-in (the exchange). Returns false for any other request, so a server calls it first and carries on.

A right secret sets the cookie and redirects to /; a wrong one re-renders the form with a 401. The cookie is Secure when the request reached the provider over https, so a page reached over the tunnel never sends it in the clear, and plain http on this Mac still works.

Parameters

Parameter	Type
req	IncomingMessage
res	ServerResponse
secret	string
title	string

Returns

Promise<boolean>

---

hasBrowserSession()

hasBrowserSession(req, secret, now?): boolean

Whether the request carries a session cookie a sign-in with secret issued that has not yet expired. The embedded timestamps are re-signed and compared, and the expiry is checked against now.

Parameters

Parameter	Type
req	IncomingMessage
secret	string
now	number

Returns

boolean

---

isAuthorized()

isAuthorized(req, secret): boolean

The secret, from an app, or a signed-in browser’s cookie. Nothing else counts.

Parameters

Parameter	Type
req	IncomingMessage
secret	string

Returns

boolean

---

sessionToken()

sessionToken(secret, now?, lifetimeMs?): string

What the session cookie holds for an instance whose secret is secret.

now/lifetimeMs are injectable for tests and for callers that want a shorter window; by default a browser stays signed in for 30 days.

Parameters

Parameter	Type	Default value
secret	string	undefined
now	number	...
lifetimeMs	number	THIRTY_DAYS_MS

Returns

string