Jump to a page

@nightowlsdev/auth-auth0

Auth

Stateless, offline-capable Auth0 AuthProvider that verifies access tokens against Auth0's public JWKS.

What it does

An AuthProvider for @nightowlsdev/core that verifies an Auth0-issued access token with jose against Auth0's public JWKS and maps it into a Night Owls AuthContext, resolving identity server-side at the request boundary (never from the body). It uses public signing keys only (no client secret, no Management API): createRemoteJWKSet is built once at factory scope and jose caches keys, then each request runs jwtVerify(token, JWKS, { issuer, audience }). The issuer is normalized to a trailing slash so both forms work. Claims map to userId (sub, required string), tenantId (orgClaim, default org_id, else 'default'), and capabilities (rolesClaim, default permissions, when an array). An optional allowedOrgs allow-list fails closed: a token with no/non-string org claim is rejected when the list is set. The jwks resolver is injectable for hermetic RS256 tests with no network. Construct with auth0Auth({ issuerBaseUrl, audience, ... }) and pass to a runner. Any verification failure returns null, yielding a 401. Also exports nightOwlsPlugin, the CLI plugin manifest.

Install

pnpm add @nightowlsdev/auth-auth0

Key exports

auth0Auth
nightOwlsPlugin
Auth0AuthOpts (type)

Usage

auth-auth0.ts

import { auth0Auth } from "@nightowlsdev/auth-auth0";
import { createNextjsRunner } from "@nightowlsdev/runner-nextjs";

const auth = auth0Auth({
  issuerBaseUrl: process.env.AUTH0_ISSUER_BASE_URL!,
  audience: process.env.AUTH0_AUDIENCE!,
});

const runner = createNextjsRunner({ engine, auth, storage });