npm package: @pauxiel/edge-auth-worker
Description: JWT auth at the edge — Cloudflare Workers + Neon Postgres + Worker AI. No cold starts, no API keys.
Author: Paulo Bayuwana
Latest version: 1.0.1

# edge-auth-worker

JWT authentication at the edge using Cloudflare Workers, Neon Postgres, and Cloudflare Worker AI. No cold starts. No Lambda. No JWKS round trips.

## What it does

- Verifies JWT tokens at the edge using [`@tsndr/cloudflare-worker-jwt`](https://github.com/tsndr/cloudflare-worker-jwt) — zero dependencies, built specifically for Workers
- Stores sessions in [Neon](https://neon.tech) serverless Postgres via HTTP (no connection pooling needed)
- Runs an AI security audit of the auth implementation on demand via Cloudflare Worker AI (no API key required)

## Use as a library

Install into your existing Cloudflare Worker:

```bash
npm install @pauxiel/edge-auth-worker
```

```typescript
import { EdgeAuth } from '@pauxiel/edge-auth-worker';

const auth = new EdgeAuth({
  secret: env.JWT_SECRET,
  neonUrl: env.DATABASE_URL,
});

// Verify a Bearer token from the request
const user = await auth.verify(request);

// Or verify + store the session in Neon in one call
const user = await auth.verifyAndStore(request);

// Look up an existing session by token
const session = await auth.getSession(token);
```

`verify` extracts the `Authorization: Bearer <token>` header, validates the JWT, and returns a `User` object. It throws if the token is missing or invalid.

## Deploy your own in one command

```bash
npx create-cloudflare@latest my-auth-worker --template pauxiel/edge-auth-worker
```

Then add your secrets:

```bash
cd my-auth-worker
npx wrangler secret put JWT_SECRET      # openssl rand -base64 32
npx wrangler secret put DATABASE_URL    # from neon.tech
npx wrangler deploy
```

That's it.

## Manual setup

### 1. Clone and install

```bash
git clone https://github.com/pauxiel/edge-auth-worker
cd edge-auth-worker
npm install
```

### 2. Create Neon database

Go to [neon.tech](https://neon.tech) → create free account → create database named `edge-auth` → run:

```sql
CREATE TABLE sessions (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id TEXT NOT NULL,
  email TEXT NOT NULL,
  token TEXT NOT NULL,
  expires_at TIMESTAMP NOT NULL,
  created_at TIMESTAMP DEFAULT NOW()
);
```

Copy the `DATABASE_URL` connection string.

### 3. Add secrets

```bash
npx wrangler secret put JWT_SECRET    # paste output of: openssl rand -base64 32
npx wrangler secret put DATABASE_URL  # paste your Neon connection string
```

### 4. Deploy

```bash
npx wrangler deploy
```

## API

### `POST /` — Verify token and store session

```bash
curl https://your-worker.workers.dev \
  -H "Authorization: Bearer <your-jwt>"
```

Returns `200` with user JSON on success, `401` on invalid/missing token.

### `GET /audit` — AI security review

```bash
curl https://your-worker.workers.dev/audit
```

Runs the auth implementation through Cloudflare Worker AI (Llama 3.1) and returns a security review. No API key needed.

## Project structure

```
src/
├── index.ts        # Worker entry point — routing + auth flow
├── types.ts        # Env + User interfaces
└── lib/
    ├── auth.ts     # JWT verification via @tsndr/cloudflare-worker-jwt
    ├── session.ts  # Neon session storage + retrieval
    └── ai.ts       # Worker AI security audit
```

## Tech

| | |
|---|---|
| Runtime | Cloudflare Workers |
| JWT | [@tsndr/cloudflare-worker-jwt](https://github.com/tsndr/cloudflare-worker-jwt) |
| Database | [Neon](https://neon.tech) serverless Postgres |
| AI | Cloudflare Worker AI — `@cf/meta/llama-3.1-8b-instruct` |

## License

MIT