Auth SDK ElysiaJS

Auth SDK for ElysiaJS with JWT and JWKS

Installation

1bun add @riligar/auth-elysia

🚀 Basic Usage

1import { Elysia } from 'elysia';
2import { authPlugin } from '@riligar/auth-elysia';
3
4const app = new Elysia()
5    .use(authPlugin({
6        apiUrl: 'https://auth.riligar.com',
7        secretKey: 'your-riligar-secret-key'
8    }))
9    .get('/protected', ({ user, authMeta }) => {
10        return { 
11            message: `Hello ${user?.name}!`,
12            verified_locally: authMeta?.verified_locally, // ⚡ Cache hit!
13            cached: authMeta?.cached
14        };
15    })
16    .listen(3000);

📋 Complete Example

1import { Elysia } from 'elysia';
2import { authPlugin } from '@riligar/auth-elysia';
3
4const app = new Elysia()
5    .use(authPlugin({
6        apiUrl: 'https://auth.riligar.com',
7        secretKey: process.env.RILIGAR_SECRET_KEY,
8        prefix: '/auth',
9        excludePaths: [
10            '/',           // Homepage
11            '/health',     // Health check
12            '/products',   // Product listing
13            '/auth/*'      // All auth routes
14        ]
15    }))
16    
17    // 🌍 PUBLIC ROUTES (in excludePaths)
18    .get('/', () => ({ message: 'Welcome to my API!' }))
19    .get('/health', () => ({ status: 'ok' }))
20    .get('/products', () => ({ 
21        products: [
22            { id: 1, name: 'Product 1', price: 100 },
23            { id: 2, name: 'Product 2', price: 200 }
24        ]
25    }))
26    
27    // 🔒 PRIVATE ROUTES (automatic - use { user })
28    .get('/profile', ({ user }) => {
29        // user ALWAYS exists here (token validated)
30        return { 
31            id: user.id,
32            name: user.name,
33            email: user.email 
34        };
35    })
36    
37    .get('/dashboard', ({ user, authMeta }) => {
38        return {
39            user: user,
40            performance: {
41                verified_locally: authMeta?.verified_locally,
42                cached: authMeta?.cached
43            },
44            data: 'Your private dashboard data...'
45        };
46    })
47    
48    .post('/orders', ({ user, body }) => {
49        // user ALWAYS exists here (token validated)
50        return {
51            message: 'Order created successfully',
52            userId: user.id,
53            order: body
54        };
55    })
56    
57    .get('/admin', ({ user }) => {
58        // Additional role verification
59        if (user.role !== 'admin') {
60            return { error: 'Admin access required' };
61        }
62        return { 
63            message: 'Admin panel',
64            adminData: 'Secret admin data'
65        };
66    })
67    
68    .listen(3000);
69
70console.log('🚀 Server running on http://localhost:3000');
71console.log('🌍 Public routes: /, /health, /products');
72console.log('🔒 Private routes: /profile, /dashboard, /orders, /admin');

⚙️ Configuration

1const config = {
2    prefix: '/auth',                                    // Auth routes prefix
3    apiUrl: 'https://auth.riligar.com',                 // RiLiGar Auth Service URL
4    secretKey: 'se_abc123...',                          // Your RiLiGar Secret Key
5    cookieName: 'auth-token',                           // Cookie name
6    excludePaths: ['/auth/login', '/auth/register'],    // Public routes
7    cookieOptions: {
8        httpOnly: true,
9        secure: process.env.NODE_ENV === 'production',
10        sameSite: 'lax',
11        maxAge: 86400 // 24 hours
12    },
13    onUnauthorized: (set) => {
14        set.status = 401;
15        return { error: 'Access denied' };
16    }
17};

🛡️ Available Routes

• POST /auth/login - Login with email/password
• POST /auth/register - User registration
• POST /auth/logout - Logout (local + remote)
• GET /auth/session - Check current session
• GET /auth/me - User data

⚡ Performance Features

✅ Local JWKS Verification: Public keys cache (1h TTL)
✅ Native JWT: Using Bun's Web Crypto API
✅ Smart Fallback: Local → Remote when needed
✅ Zero Latency: Valid tokens verified instantly

🔧 How It Works

1. First attempt: Local verification with cached JWKS
2. Cache miss: Fetch JWKS from /.well-known/jwks.json
3. Fallback: Remote verification if JWKS fails
4. Performance: ~99% of tokens verified locally

🧪 Testing

1# Register a user
2curl -X POST http://localhost:3000/auth/register \
3  -H "Content-Type: application/json" \
4  -d '{"email":"john@example.com","password":"123456","name":"John Doe"}'
5
6# Login
7curl -X POST http://localhost:3000/auth/login \
8  -H "Content-Type: application/json" \
9  -d '{"email":"john@example.com","password":"123456"}'
10
11# Access protected route (use token from login)
12curl http://localhost:3000/profile \
13  -H "Authorization: Bearer YOUR_TOKEN_HERE"
14
15# Check session
16curl http://localhost:3000/auth/session \
17  -H "Authorization: Bearer YOUR_TOKEN_HERE"

Build

1bun run build

License

MIT