npm install @latimer-woods-tech/auth

function issueToken(
  payload: Omit<TokenPayload, 'iat' | 'exp'>,
  secret: string,
  expiresIn?: number, // seconds, default 3600
): Promise<string>;

function verifyToken(token: string, secret: string): Promise<TokenPayload>;

function refreshToken(
  token: string,
  secret: string,
  expiresIn?: number,
): Promise<string>;

function jwtMiddleware(secret: string): MiddlewareHandler;

function requireRole(role: TokenPayload['role']): MiddlewareHandler;
// Roles in ascending order: 'viewer' < 'member' < 'admin' < 'owner'

interface TokenPayload {
  sub: string;
  tenantId: string;
  role: 'owner' | 'admin' | 'member' | 'viewer';
  iat: number;
  exp: number;
}

import { issueToken, jwtMiddleware, requireRole } from '@latimer-woods-tech/auth';

// Issue a token at login
const token = await issueToken(
  { sub: user.id, tenantId: user.tenantId, role: 'member' },
  c.env.JWT_SECRET,
);

// Protect routes
app.use('/api/*', (c, next) => jwtMiddleware(c.env.JWT_SECRET)(c, next));
app.use('/api/admin/*', requireRole('admin'));