Context
A spike confirmed the auth API is already fully bearer native, so a mobile client can
authenticate against it directly with no server change. What a mobile client cannot
currently do is call the adopter's own API, because the guards in this package read a
cookie and nothing else.
requireAuth reads req.cookies?.[cookieName] and passes it to authenticateCookie.
getSeamlessUser does the same before calling the auth server. A native client has no
cookie jar, so both reject every request.
Scope
- Accept a bearer token as an alternative source in
requireAuth and getSeamlessUser,
keeping the cookie path unchanged and the default behaviour identical.
- Apply the same change to the Fastify adapter so the two do not drift.
- Keep the verification itself shared rather than reimplemented per adapter.
Notes
This is deliberately small. The token issuing, rotation, and reuse detection already
exist upstream; this is only about where the guard looks for a token.
Security sensitive, so it wants tests in core and in both adapters.
Context
A spike confirmed the auth API is already fully bearer native, so a mobile client can
authenticate against it directly with no server change. What a mobile client cannot
currently do is call the adopter's own API, because the guards in this package read a
cookie and nothing else.
requireAuthreadsreq.cookies?.[cookieName]and passes it toauthenticateCookie.getSeamlessUserdoes the same before calling the auth server. A native client has nocookie jar, so both reject every request.
Scope
requireAuthandgetSeamlessUser,keeping the cookie path unchanged and the default behaviour identical.
Notes
This is deliberately small. The token issuing, rotation, and reuse detection already
exist upstream; this is only about where the guard looks for a token.
Security sensitive, so it wants tests in core and in both adapters.