@atlasauth/backend 0.24.0 → 0.26.0

package/dist/policy-bundle.js

@@ -0,0 +1,289 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyBundleError = void 0;
+exports.verifyPolicyBundle = verifyPolicyBundle;
+const jose_1 = require("jose");
+class PolicyBundleError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PolicyBundleError';
+    }
+}
+exports.PolicyBundleError = PolicyBundleError;
+const MAX_BYTES = 16 * 1024 * 1024;
+const MAX_FILES = 5000;
+const TYP = 'atlas-policy-bundle+jws';
+const BLOCK = 512;
+const td = new TextDecoder('utf-8', { fatal: true });
+const te = new TextEncoder();
+const toBytes = (b) => {
+    if (typeof b !== 'string')
+        return b;
+    const bin = atob(b.replace(/-/g, '+').replace(/_/g, '/'));
+    return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+};
+const b64url = (b) => btoa(Array.from(b, (c) => String.fromCharCode(c)).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+const hex = (b) => Array.from(new Uint8Array(b), (x) => x.toString(16).padStart(2, '0')).join('');
+const sha256 = async (b) => hex(await crypto.subtle.digest('SHA-256', typeof b === 'string' ? te.encode(b) : b));
+/** JSON with sorted keys and no whitespace — must match what the signer hashed. */
+function canonicalJson(v) {
+    if (v === null || typeof v !== 'object')
+        return JSON.stringify(v) ?? 'null';
+    if (Array.isArray(v))
+        return `[${v.map(canonicalJson).join(',')}]`;
+    const o = v;
+    return `{${Object.keys(o)
+        .filter((k) => o[k] !== undefined)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${canonicalJson(o[k])}`)
+        .join(',')}}`;
+}
+async function gunzip(bytes) {
+    const stream = new Blob([bytes]).stream().pipeThrough(new DecompressionStream('gzip'));
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.length;
+            if (total > MAX_BYTES) {
+                await reader.cancel();
+                throw new PolicyBundleError('invalid_archive', 'The bundle expands beyond the allowed size.');
+            }
+            chunks.push(value);
+        }
+    }
+    catch (err) {
+        if (err instanceof PolicyBundleError)
+            throw err;
+        throw new PolicyBundleError('invalid_archive', 'The bundle is not a valid gzip archive.');
+    }
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const c of chunks) {
+        out.set(c, off);
+        off += c.length;
+    }
+    return out;
+}
+function untar(tar) {
+    const bad = (m) => new PolicyBundleError('invalid_archive', m);
+    const str = (h, off, len) => {
+        let end = off;
+        while (end < off + len && h[end] !== 0)
+            end++;
+        try {
+            return td.decode(h.subarray(off, end));
+        }
+        catch {
+            throw bad('tar header is not valid UTF-8');
+        }
+    };
+    const oct = (h, off, len) => {
+        const s = str(h, off, len).trim();
+        if (!/^[0-7]+$/.test(s))
+            throw bad('malformed numeric field in tar header');
+        return parseInt(s, 8);
+    };
+    const files = new Map();
+    let off = 0;
+    while (off + BLOCK <= tar.length) {
+        const h = tar.subarray(off, off + BLOCK);
+        if (h.every((b) => b === 0))
+            return files;
+        let sum = 0;
+        for (let i = 0; i < BLOCK; i++)
+            sum += i >= 148 && i < 156 ? 0x20 : h[i];
+        if (oct(h, 148, 8) !== sum)
+            throw bad('tar header checksum mismatch');
+        if (h[156] !== 0x30 && h[156] !== 0)
+            throw bad('tar contains an entry that is not a regular file');
+        const path = str(h, 0, 100);
+        if (!path || path.startsWith('/') || path.includes('\\') || path.split('/').some((p) => p === '' || p === '.' || p === '..')) {
+            throw bad(`unsafe path in archive: '${path.slice(0, 60)}'`);
+        }
+        if (files.has(path))
+            throw bad(`duplicate path in archive: '${path}'`);
+        if (files.size + 1 > MAX_FILES)
+            throw bad('archive has too many files');
+        const size = oct(h, 124, 12);
+        off += BLOCK;
+        if (off + size > tar.length)
+            throw bad('tar is truncated');
+        files.set(path, tar.slice(off, off + size));
+        off += Math.ceil(size / BLOCK) * BLOCK;
+    }
+    throw bad('tar is missing its end marker');
+}
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function readPolicy(v, path) {
+    const bad = (why) => new PolicyBundleError('invalid_content', `${path}: ${why}`);
+    if (!isObj(v) || typeof v.name !== 'string' || !v.name)
+        throw bad('a policy needs a name');
+    if (typeof v.source !== 'string')
+        throw bad('source must be a string');
+    if (typeof v.enabled !== 'boolean')
+        throw bad('enabled must be a boolean');
+    if (v.description !== null && typeof v.description !== 'string')
+        throw bad('description must be a string or null');
+    if (v.fga_store !== null && typeof v.fga_store !== 'string')
+        throw bad('fga_store must be a store name or null');
+    if (!Array.isArray(v.tests))
+        throw bad('tests must be an array');
+    return v;
+}
+function readStore(v, path) {
+    const bad = (why) => new PolicyBundleError('invalid_content', `${path}: ${why}`);
+    if (!isObj(v) || typeof v.name !== 'string' || !v.name)
+        throw bad('a store needs a name');
+    if (v.model !== null && (!isObj(v.model) || !Array.isArray(v.model.type_definitions) || typeof v.model.schema_version !== 'string')) {
+        throw bad('model must be null or { schema_version, type_definitions }');
+    }
+    return v;
+}
+function readTemplate(v, path) {
+    const bad = (why) => new PolicyBundleError('invalid_content', `${path}: ${why}`);
+    if (!isObj(v) || typeof v.name !== 'string' || !v.name)
+        throw bad('a template needs a name');
+    if (typeof v.source !== 'string')
+        throw bad('source must be a string');
+    if (v.description !== null && typeof v.description !== 'string')
+        throw bad('description must be a string or null');
+    if (v.fga_store !== null && typeof v.fga_store !== 'string')
+        throw bad('fga_store must be a store name or null');
+    return v;
+}
+function readLink(v, path) {
+    const bad = (why) => new PolicyBundleError('invalid_content', `${path}: ${why}`);
+    const entity = (e) => e === null || (isObj(e) && typeof e.type === 'string' && !!e.type && typeof e.id === 'string' && !!e.id);
+    if (!isObj(v) || typeof v.name !== 'string' || !v.name)
+        throw bad('a link needs a name');
+    if (typeof v.template !== 'string' || !v.template)
+        throw bad('template must be a template name');
+    if (typeof v.enabled !== 'boolean')
+        throw bad('enabled must be a boolean');
+    if (!entity(v.principal) || !entity(v.resource))
+        throw bad('principal and resource must be null or { type, id }');
+    return v;
+}
+const byName = (xs) => [...xs].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+/**
+ * Verify and open a signed policy bundle. Throws {@link PolicyBundleError} with a
+ * stable `code` on any failure; returns the content only when everything checks out.
+ */
+async function verifyPolicyBundle(opts) {
+    const archive = toBytes(opts.bundle);
+    if (archive.length > MAX_BYTES)
+        throw new PolicyBundleError('invalid_archive', 'The bundle is too large.');
+    // 1. authenticity: the detached JWS over the archive bytes.
+    const parts = opts.signature.split('.');
+    if (parts.length !== 3 || parts[1] !== '' || !parts[0] || !parts[2]) {
+        throw new PolicyBundleError('invalid_signature', 'The signature must be a detached compact JWS ("header..signature").');
+    }
+    const keys = Array.isArray(opts.jwks) ? opts.jwks : opts.jwks.keys;
+    let header;
+    try {
+        header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));
+    }
+    catch {
+        throw new PolicyBundleError('invalid_signature', 'The signature header is not valid.');
+    }
+    if (header.kid && !keys.some((k) => k.kid === header.kid)) {
+        throw new PolicyBundleError('unknown_key', `The bundle was signed with key ${header.kid}, which is not in the trusted keys.`);
+    }
+    try {
+        const { protectedHeader } = await (0, jose_1.compactVerify)(`${parts[0]}.${b64url(archive)}.${parts[2]}`, (0, jose_1.createLocalJWKSet)({ keys }), {
+            algorithms: ['RS256', 'ES256'],
+        });
+        if (protectedHeader.typ !== TYP)
+            throw new Error('not a policy-bundle signature');
+    }
+    catch (err) {
+        throw new PolicyBundleError('invalid_signature', `The bundle's signature does not verify: ${err instanceof Error ? err.message : 'failed'}.`);
+    }
+    // 2 + 3. integrity.
+    const files = untar(await gunzip(archive));
+    const manifestBytes = files.get('manifest.json');
+    if (!manifestBytes)
+        throw new PolicyBundleError('invalid_manifest', 'The bundle has no manifest.json.');
+    let manifest;
+    try {
+        manifest = JSON.parse(td.decode(manifestBytes));
+    }
+    catch {
+        throw new PolicyBundleError('invalid_manifest', 'manifest.json is not valid JSON.');
+    }
+    if (!isObj(manifest) || manifest.format !== 'atlas.policy-bundle' || !Array.isArray(manifest.files) || typeof manifest.revision !== 'string') {
+        throw new PolicyBundleError('invalid_manifest', 'manifest.json is not an Atlas policy bundle manifest.');
+    }
+    if (manifest.format_version !== 1)
+        throw new PolicyBundleError('unsupported_version', `Unsupported bundle format_version ${String(manifest.format_version)}.`);
+    files.delete('manifest.json');
+    const listed = new Set();
+    for (const f of manifest.files) {
+        if (!isObj(f) || typeof f.path !== 'string' || typeof f.sha256 !== 'string')
+            throw new PolicyBundleError('invalid_manifest', 'manifest.json has a malformed file entry.');
+        if (listed.has(f.path))
+            throw new PolicyBundleError('invalid_manifest', `manifest.json lists ${f.path} twice.`);
+        listed.add(f.path);
+        const data = files.get(f.path);
+        if (!data)
+            throw new PolicyBundleError('missing_file', `${f.path} is listed in the manifest but missing from the archive.`);
+        if ((await sha256(data)) !== f.sha256)
+            throw new PolicyBundleError('digest_mismatch', `${f.path} does not match its digest in the manifest.`);
+    }
+    for (const p of files.keys()) {
+        if (!listed.has(p))
+            throw new PolicyBundleError('unlisted_file', `${p} is in the archive but not in the manifest.`);
+    }
+    const policies = [];
+    const fgaStores = [];
+    const templates = [];
+    const links = [];
+    let schema = null;
+    for (const [path, data] of files) {
+        let json;
+        try {
+            json = JSON.parse(td.decode(data));
+        }
+        catch {
+            throw new PolicyBundleError('invalid_content', `${path} is not valid JSON.`);
+        }
+        if (path.startsWith('abac/policies/'))
+            policies.push(readPolicy(json, path));
+        else if (path.startsWith('fga/stores/'))
+            fgaStores.push(readStore(json, path));
+        else if (path === 'abac/schema.json') {
+            if (!isObj(json))
+                throw new PolicyBundleError('invalid_content', `${path}: the schema must be an object.`);
+            schema = json;
+        }
+        else if (path.startsWith('abac/templates/'))
+            templates.push(readTemplate(json, path));
+        else if (path.startsWith('abac/links/'))
+            links.push(readLink(json, path));
+        else
+            throw new PolicyBundleError('invalid_content', `${path} is not a recognised bundle file.`);
+    }
+    // Same normal form as the server: empty template/link lists and a missing schema are left out.
+    const normal = {
+        abac_policies: byName(policies),
+        fga_stores: byName(fgaStores),
+        ...(schema ? { abac_schema: schema } : {}),
+        ...(templates.length ? { abac_templates: byName(templates) } : {}),
+        ...(links.length ? { abac_links: byName(links) } : {}),
+    };
+    const recomputed = `rev_${(await sha256(canonicalJson(normal))).slice(0, 32)}`;
+    if (recomputed !== manifest.revision)
+        throw new PolicyBundleError('revision_mismatch', "The bundle's content does not match the revision in its manifest.");
+    if (opts.expectedRevision && opts.expectedRevision !== manifest.revision) {
+        throw new PolicyBundleError('unexpected_revision', `Expected revision ${opts.expectedRevision} but the bundle is ${manifest.revision}.`);
+    }
+    return { revision: manifest.revision, manifest, policies: byName(policies), fgaStores: byName(fgaStores), abacSchema: schema, abacTemplates: byName(templates), abacLinks: byName(links), keyId: header.kid, algorithm: header.alg ?? '' };
+}
+//# sourceMappingURL=policy-bundle.js.map

package/dist/policy-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-bundle.js","sourceRoot":"","sources":["../src/policy-bundle.ts"],"names":[],"mappings":";;;AAyPA,gDA0FC;AAnVD,+BAAkE;AA8BlE,MAAa,iBAAkB,SAAQ,KAAK;IAE/B;IADX,YACW,IAA2B,EACpC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAuB;QAIpC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AARD,8CAQC;AAmED,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,GAAG,GAAG,yBAAyB,CAAC;AACtC,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,EAAE,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;AAE7B,MAAM,OAAO,GAAG,CAAC,CAAsB,EAAc,EAAE;IACrD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjK,MAAM,GAAG,GAAG,CAAC,CAAc,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,MAAM,GAAG,KAAK,EAAE,CAAsB,EAAmB,EAAE,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC;AAEpL,mFAAmF;AACnF,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACjC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,KAAiB;IACrC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;gBACtB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,MAAM,GAAG,CAAC;QAChD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,KAAK,CAAC,GAAe;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QACtD,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,OAAO,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QACtD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC,uCAAuC,CAAC,CAAC;QAC5E,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAC1E,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC,kDAAkD,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7H,MAAM,GAAG,CAAC,4BAA4B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,SAAS;YAAE,MAAM,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7B,GAAG,IAAI,KAAK,CAAC;QACb,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC3D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5C,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;IACzC,CAAC;IACD,MAAM,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAErH,SAAS,UAAU,CAAC,CAAU,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnH,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACjH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACjE,OAAO,CAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,CAAU,EAAE,IAAY;IACzC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpI,MAAM,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAA8B,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,CAAU,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC7F,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnH,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACjH,OAAO,CAAkC,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,IAAY;IACxC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,MAAM,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjG,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,MAAM,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAClH,OAAO,CAA8B,CAAC;AACxC,CAAC;AAED,MAAM,MAAM,GAAG,CAA6B,EAAO,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjI;;;GAGG;AACI,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;IAE3G,4DAA4D;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,qEAAqE,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAkB,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,kCAAkC,MAAM,CAAC,GAAG,qCAAqC,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,IAAA,oBAAa,EAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAA,wBAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE;YACzH,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,GAAG,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,2CAA2C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChJ,CAAC;IAED,oBAAoB;IACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IACxG,IAAI,QAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7I,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,qCAAqC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/J,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;QAC1K,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;QAChH,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,0DAA0D,CAAC,CAAC;QAC5H,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,IAAI,6CAA6C,CAAC,CAAC;IAChJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,GAAG,CAAC,6CAA6C,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,qBAAqB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aACxE,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aAC1E,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,iCAAiC,CAAC,CAAC;YAC3G,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aACnF,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;;YACrE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,IAAI,mCAAmC,CAAC,CAAC;IAClG,CAAC;IACD,+FAA+F;IAC/F,MAAM,MAAM,GAAG;QACb,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/E,IAAI,UAAU,KAAK,QAAQ,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,mEAAmE,CAAC,CAAC;IAC5J,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,qBAAqB,IAAI,CAAC,gBAAgB,sBAAsB,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC3I,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;AAC7O,CAAC"}

package/dist/request-auth.d.ts

@@ -0,0 +1,32 @@
+import { type ProtectCondition } from '@atlasauth/authz';
+import type { AtlasBackend, SessionClaims } from './verify';
+/**
+ * Framework-neutral request authentication, shared by the Koa, Hapi and GraphQL
+ * adapters: read the `__session` cookie or `Authorization: Bearer` header
+ * (the header wins), verify locally against the JWKS and return the auth state.
+ * It never throws: a missing or bad token is the signed-out state, whose
+ * `has()` is `false` and `protect()` throws.
+ */
+export interface RequestAuth {
+    userId: string | null;
+    sessionId: string | null;
+    orgId: string | null;
+    orgRole: string | null;
+    claims: SessionClaims | null;
+    isSignedIn: boolean;
+    /** The impersonator (RFC 8693 `act`) or null. */
+    actor: {
+        sub: string;
+    } | null;
+    has(condition?: ProtectCondition): boolean;
+    /** Assert a condition; returns the claims or throws `ForbiddenError`. */
+    protect(condition?: ProtectCondition): SessionClaims;
+}
+export declare function signedOutAuth(): RequestAuth;
+export declare function signedInAuth(claims: SessionClaims): RequestAuth;
+type HeaderValue = string | string[] | undefined;
+/** The raw session token a request carries (bearer header first, then the `__session` cookie), or null. */
+export declare function sessionTokenFromHeaders(headers: Record<string, HeaderValue>): string | null;
+/** Verify a request's headers into a {@link RequestAuth}. Never throws. */
+export declare function authenticateHeaders(backend: AtlasBackend, headers: Record<string, HeaderValue>): Promise<RequestAuth>;
+export {};

package/dist/request-auth.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signedOutAuth = signedOutAuth;
+exports.signedInAuth = signedInAuth;
+exports.sessionTokenFromHeaders = sessionTokenFromHeaders;
+exports.authenticateHeaders = authenticateHeaders;
+const authz_1 = require("@atlasauth/authz");
+function signedOutAuth() {
+    return {
+        userId: null,
+        sessionId: null,
+        orgId: null,
+        orgRole: null,
+        claims: null,
+        isSignedIn: false,
+        actor: null,
+        has: () => false,
+        protect: (condition = {}) => {
+            throw new authz_1.ForbiddenError('signed_out', condition);
+        },
+    };
+}
+function signedInAuth(claims) {
+    return {
+        userId: claims.sub,
+        sessionId: claims.sid,
+        orgId: claims.org_id ?? null,
+        orgRole: claims.org_role ?? null,
+        claims,
+        isSignedIn: true,
+        actor: claims.act && typeof claims.act.sub === 'string' && claims.act.sub ? { sub: claims.act.sub } : null,
+        has: (condition = {}) => (0, authz_1.hasFromClaims)(claims, condition),
+        protect: (condition = {}) => {
+            const outcome = (0, authz_1.evaluate)(claims, condition);
+            if (!outcome.allowed)
+                throw new authz_1.ForbiddenError(outcome.reason, condition);
+            return claims;
+        },
+    };
+}
+function first(v) {
+    return Array.isArray(v) ? v[0] : v;
+}
+/** The raw session token a request carries (bearer header first, then the `__session` cookie), or null. */
+function sessionTokenFromHeaders(headers) {
+    const authz = first(headers.authorization ?? headers.Authorization);
+    if (authz?.startsWith('Bearer '))
+        return authz.slice(7) || null;
+    const cookie = first(headers.cookie ?? headers.Cookie);
+    if (cookie) {
+        for (const part of cookie.split(';')) {
+            const [key, ...rest] = part.trim().split('=');
+            if (key === '__session')
+                return rest.join('=') || null;
+        }
+    }
+    return null;
+}
+/** Verify a request's headers into a {@link RequestAuth}. Never throws. */
+async function authenticateHeaders(backend, headers) {
+    try {
+        const token = sessionTokenFromHeaders(headers);
+        if (!token)
+            return signedOutAuth();
+        const result = await backend.verify(token);
+        return result.ok ? signedInAuth(result.claims) : signedOutAuth();
+    }
+    catch {
+        return signedOutAuth();
+    }
+}
+//# sourceMappingURL=request-auth.js.map

package/dist/request-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-auth.js","sourceRoot":"","sources":["../src/request-auth.ts"],"names":[],"mappings":";;AAwBA,sCAcC;AAED,oCAgBC;AASD,0DAWC;AAGD,kDASC;AAxFD,4CAAkG;AAwBlG,SAAgB,aAAa;IAC3B,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,IAAI,sBAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,MAAqB;IAChD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;QAC5B,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QAChC,MAAM;QACN,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI;QAC1G,GAAG,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE,CAAC,IAAA,qBAAa,EAAC,MAAM,EAAE,SAAS,CAAC;QACzD,OAAO,EAAE,CAAC,SAAS,GAAG,EAAE,EAAE,EAAE;YAC1B,MAAM,OAAO,GAAG,IAAA,gBAAQ,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,sBAAc,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,SAAS,KAAK,CAAC,CAAc;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,2GAA2G;AAC3G,SAAgB,uBAAuB,CAAC,OAAoC;IAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACpE,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,mBAAmB,CAAC,OAAqB,EAAE,OAAoC;IACnG,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,OAAO,aAAa,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/uma.d.ts

@@ -0,0 +1,77 @@
+/**
+ * User-Managed Access 2.0 for a RESOURCE SERVER: register what your users own, ask Atlas for permission tickets,
+ * answer a request without a token with the UMA challenge, and read the permissions of a Requesting Party Token.
+ * Atlas is the authorization server; the protection API needs a Protection API Access Token (PAT), which this
+ * client fetches and refreshes with your confidential client's credentials (client_credentials, scope uma_protection).
+ */
+export declare const UMA_PROTECTION_SCOPE = "uma_protection";
+export interface UmaResourceBody {
+    name: string;
+    type?: string;
+    uri?: string;
+    icon_uri?: string;
+    /** The scopes a requesting party can be granted on this resource. */
+    resource_scopes?: string[];
+    /** The Atlas user id of the resource owner, who can then share it from the hosted account page. */
+    owner?: string;
+    /** A resource-scoped roles resource whose role assignments decide who holds each scope. */
+    rbac_resource_id?: string;
+    /** Let a requesting party with no access ask the owner (the grant answers request_submitted until they decide). */
+    owner_approval?: boolean;
+}
+export interface UmaResource extends UmaResourceBody {
+    _id: string;
+}
+export interface UmaPermission {
+    resource_id: string;
+    resource_scopes: string[];
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+}
+/** The RPT introspection answer (UMA Federated Authorization 5.1.1): no `scope`, with `permissions`. */
+export interface UmaIntrospection {
+    active: boolean;
+    sub?: string;
+    exp?: number;
+    iat?: number;
+    client_id?: string;
+    permissions?: UmaPermission[];
+}
+export declare class UmaProtectionError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export interface UmaProtectionOptions {
+    /** Your Atlas sign-in origin, e.g. `https://auth.example.com`. */
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** For tests or a proxy; defaults to the global fetch. */
+    fetch?: typeof fetch;
+}
+export declare function createUmaProtection(options: UmaProtectionOptions): {
+    /** A Protection API Access Token (cached until shortly before it expires). */
+    getPat: () => Promise<string>;
+    resources: {
+        create: (body: UmaResourceBody) => Promise<{
+            _id: string;
+        }>;
+        list: () => Promise<string[]>;
+        get: (id: string) => Promise<UmaResource>;
+        update: (id: string, body: UmaResourceBody) => Promise<UmaResource>;
+        remove: (id: string) => Promise<void>;
+    };
+    /** Ask for a permission ticket covering one or more resources and scopes. */
+    requestTicket(permissions: Array<{
+        resource_id: string;
+        resource_scopes?: string[];
+    }>): Promise<string>;
+    /** The `WWW-Authenticate` value for a 401 that hands the client a ticket. */
+    challenge(ticket: string, realm?: string): string;
+    /** Introspect a Requesting Party Token with the PAT. */
+    introspect(rpt: string): Promise<UmaIntrospection>;
+};
+/** Whether an introspected RPT grants `scope` on `resourceId` (and has not expired). */
+export declare function umaAllows(introspection: UmaIntrospection, resourceId: string, scope: string, nowSeconds?: number): boolean;

package/dist/uma.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * User-Managed Access 2.0 for a RESOURCE SERVER: register what your users own, ask Atlas for permission tickets,
+ * answer a request without a token with the UMA challenge, and read the permissions of a Requesting Party Token.
+ * Atlas is the authorization server; the protection API needs a Protection API Access Token (PAT), which this
+ * client fetches and refreshes with your confidential client's credentials (client_credentials, scope uma_protection).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UmaProtectionError = exports.UMA_PROTECTION_SCOPE = void 0;
+exports.createUmaProtection = createUmaProtection;
+exports.umaAllows = umaAllows;
+exports.UMA_PROTECTION_SCOPE = 'uma_protection';
+class UmaProtectionError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'UmaProtectionError';
+    }
+}
+exports.UmaProtectionError = UmaProtectionError;
+function createUmaProtection(options) {
+    const issuer = options.issuer.replace(/\/+$/, '');
+    const doFetch = options.fetch ?? fetch;
+    let pat;
+    const getPat = async () => {
+        if (pat && pat.expiresAt - 30_000 > Date.now())
+            return pat.token;
+        const res = await doFetch(`${issuer}/oauth2/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded', authorization: `Basic ${btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`)}` },
+            body: new URLSearchParams({ grant_type: 'client_credentials', scope: exports.UMA_PROTECTION_SCOPE }).toString(),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || !body.access_token)
+            throw new UmaProtectionError(res.status, body.error ?? 'invalid_client', body.error_description ?? 'Could not obtain a Protection API Access Token.');
+        pat = { token: body.access_token, expiresAt: Date.now() + (body.expires_in ?? 3600) * 1000 };
+        return pat.token;
+    };
+    const call = async (method, path, body) => {
+        const res = await doFetch(`${issuer}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${await getPat()}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (res.status === 204)
+            return undefined;
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (res.status === 401)
+                pat = undefined;
+            throw new UmaProtectionError(res.status, data.error ?? data.errors?.[0]?.code ?? 'error', data.message ?? data.errors?.[0]?.message ?? 'The protection API refused the request.');
+        }
+        return data;
+    };
+    return {
+        /** A Protection API Access Token (cached until shortly before it expires). */
+        getPat,
+        resources: {
+            create: (body) => call('POST', '/oauth2/uma/resource_set', body),
+            list: () => call('GET', '/oauth2/uma/resource_set'),
+            get: (id) => call('GET', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`),
+            update: (id, body) => call('PUT', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`, body),
+            remove: (id) => call('DELETE', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`),
+        },
+        /** Ask for a permission ticket covering one or more resources and scopes. */
+        async requestTicket(permissions) {
+            return (await call('POST', '/oauth2/uma/permission', permissions)).ticket;
+        },
+        /** The `WWW-Authenticate` value for a 401 that hands the client a ticket. */
+        challenge(ticket, realm = 'uma') {
+            return `UMA realm="${realm}", as_uri="${issuer}", ticket="${ticket}"`;
+        },
+        /** Introspect a Requesting Party Token with the PAT. */
+        async introspect(rpt) {
+            const res = await doFetch(`${issuer}/oauth2/introspect`, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${await getPat()}`, 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({ token: rpt }).toString(),
+            });
+            if (!res.ok)
+                throw new UmaProtectionError(res.status, 'introspection_failed', 'Introspection was refused.');
+            return (await res.json());
+        },
+    };
+}
+/** Whether an introspected RPT grants `scope` on `resourceId` (and has not expired). */
+function umaAllows(introspection, resourceId, scope, nowSeconds = Math.floor(Date.now() / 1000)) {
+    if (!introspection.active)
+        return false;
+    return (introspection.permissions ?? []).some((p) => p.resource_id === resourceId && p.resource_scopes.includes(scope) && (p.exp ?? introspection.exp ?? Infinity) > nowSeconds && (p.nbf ?? 0) <= nowSeconds);
+}
+//# sourceMappingURL=uma.js.map

package/dist/uma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uma.js","sourceRoot":"","sources":["../src/uma.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA6DH,kDA8DC;AAGD,8BAKC;AAjIY,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAuCrD,MAAa,kBAAmB,SAAQ,KAAK;IAEhC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AATD,gDASC;AAWD,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,IAAI,GAAqD,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,IAAqB,EAAE;QACzC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE;YACvL,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,4BAAoB,EAAE,CAAC,CAAC,QAAQ,EAAE;SACxG,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA+F,CAAC;QAChJ,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,IAAI,iDAAiD,CAAC,CAAC;QACzL,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAK,MAAc,EAAE,IAAY,EAAE,IAAc,EAAc,EAAE;QACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;YAC7H,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA8F,CAAC;QAC/I,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,GAAG,GAAG,SAAS,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,yCAAyC,CAAC,CAAC;QACpL,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL,8EAA8E;QAC9E,MAAM;QACN,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAqB,EAA4B,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,0BAA0B,EAAE,IAAI,CAAC;YAC3G,IAAI,EAAE,GAAsB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC;YACtE,GAAG,EAAE,CAAC,EAAU,EAAwB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5G,MAAM,EAAE,CAAC,EAAU,EAAE,IAAqB,EAAwB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;YAC5I,MAAM,EAAE,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;SAC5G;QACD,6EAA6E;QAC7E,KAAK,CAAC,aAAa,CAAC,WAAuE;YACzF,OAAO,CAAC,MAAM,IAAI,CAAqB,MAAM,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,CAAC;QACD,6EAA6E;QAC7E,SAAS,CAAC,MAAc,EAAE,KAAK,GAAG,KAAK;YACrC,OAAO,cAAc,KAAK,cAAc,MAAM,cAAc,MAAM,GAAG,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,UAAU,CAAC,GAAW;YAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAC3G,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;YAC5G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAgB,SAAS,CAAC,aAA+B,EAAE,UAAkB,EAAE,KAAa,EAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACtI,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,aAAa,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,UAAU,CAChK,CAAC;AACJ,CAAC"}

package/dist/verify.d.ts

@@ -69,6 +69,8 @@ export interface SessionClaims {
     app_roles?: string[];
     /** Permissions granted by the app roles; gate with `has({ appPermission })`. Absent when none. */
     app_permissions?: string[];
+    /** USR-03: slugs of the instance groups the user belongs to (and their ancestors), when any. */
+    groups?: string[];
     /** §billing entitlement — active plan slug; gate with `has({ plan })`. */
     pla?: string;
     /** §billing entitlement — granted feature keys; gate with `has({ feature })`. */