# @aphrodite/auth

@aphrodite/auth — part of the Oshun monorepo.

TypeScript package. Built with tsc/tsup; consumed by other workspaces.

## Scripts

| Command           | Definition         |
| ----------------- | ------------------ |
| `pnpm build`      | tsup               |
| `pnpm dev`        | tsup --watch       |
| `pnpm start`      | node dist/index.js |
| `pnpm test`       | vitest run         |
| `pnpm test:watch` | vitest             |
| `pnpm lint`       | eslint src/        |
| `pnpm typecheck`  | tsc --noEmit       |

## Layout

- `src/`

## Access-token trust boundary

Access tokens are HS256-signed with `JWT_ACCESS_SECRET` and carry the canonical
user ID in `sub`, a unique `jti`, and the required issuer/audience claims.
`JWTService` defaults those claims to `aphrodite-auth` and `aphrodite` and
rejects a correctly signed token when either claim differs. Viewer-service
deployments must configure the same access secret as `VIEWER_JWT_SECRET` and the
same issuer/audience as `VIEWER_JWT_ISSUER`/`VIEWER_JWT_AUDIENCE`.

The service's process-local JTI revocation set is enforced by `JWTService` but
is not a distributed revocation store. Protected playback therefore relies on
short access-token and playback-grant lifetimes, while media publication
revocation is separately durable and checked on every origin object request.

## Working on this package

The fastest local loop is via Nx:

```bash
pnpm nx test aphrodite-auth
pnpm nx lint aphrodite-auth
pnpm nx build aphrodite-auth
```

When Nx is unhappy (usually because another worktree has duplicate project
names), bypass it with the underlying tools from this directory:

```bash
npx tsc --noEmit
npx vitest run
```

See the [root README](../../../README.md) for monorepo-wide conventions (catalog
deps, commit format, git workflow). See the
[Contributor Guide](../../../docs/CONTRIBUTING.md) for the full PR workflow.