@authyon/server 0.2.0-beta.5 → 0.2.0-beta.6

package/README.md

@@ -198,6 +198,19 @@ await acme.roles.create({ name: "viewer", permissions: ["reports:read"] });
 vem do backend depois da checagem de revogação, rotação de secret e tenant
 desabilitado; não confie só na claim `scope` quando precisar do estado atual.
 
+Em middleware, quando você já recebeu o bearer tenant-client na requisição, não
+use `clientId`/`clientSecret`; valide o token diretamente:
+
+```ts
+const validation = await authyon.tenantAuth.validate(tenantBearerToken, {
+  clientIp: "203.0.113.10",
+});
+
+if (!validation.valid) {
+  // responda 401
+}
+```
+
 ## Descoberta
 
 ```ts

package/dist/{authorization-NQe6R3am.d.cts → authorization-BGURVMFT.d.cts}

@@ -352,6 +352,12 @@ interface AuthyonServerClientOptions {
      */
     clientId?: string;
     clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -627,6 +633,7 @@ declare class AuthyonServerClient {
     #private;
     private readonly envKey?;
     private readonly clientId?;
+    private readonly clientIp?;
     private readonly transport;
     private readonly http;
     private readonly environmentTokenProvider;
@@ -653,6 +660,8 @@ declare class AuthyonServerClient {
     readonly tenantAuth: {
         /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
         token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
     };
     /**
      * Scopes a client to a single tenant's OAuth credentials — mints and
@@ -824,7 +833,7 @@ declare class TenantScopedClient {
     private getAccessToken;
     private request;
     /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-    validate(): Promise<TenantClientValidationResult>;
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.

package/dist/{authorization-NQe6R3am.d.ts → authorization-BGURVMFT.d.ts}

@@ -352,6 +352,12 @@ interface AuthyonServerClientOptions {
      */
     clientId?: string;
     clientSecret?: string;
+    /**
+     * Originating end-user IP to forward on every API call as `X-Forwarded-For`.
+     * Only set this from infrastructure you trust; the SDK rejects comma-separated
+     * or whitespace-containing values to avoid forwarded-header injection.
+     */
+    clientIp?: string;
     /** API origin. Defaults to `https://api.authyon.com`. */
     baseUrl?: string;
     /** Allow an HTTP `baseUrl`. Intended only for explicitly trusted local development. */
@@ -627,6 +633,7 @@ declare class AuthyonServerClient {
     #private;
     private readonly envKey?;
     private readonly clientId?;
+    private readonly clientIp?;
     private readonly transport;
     private readonly http;
     private readonly environmentTokenProvider;
@@ -653,6 +660,8 @@ declare class AuthyonServerClient {
     readonly tenantAuth: {
         /** POST /tenant/oauth/token — exchanges a tenant's client credentials for a scoped access token. */
         token: (credentials: ClientCredentials) => Promise<TokenResult>;
+        /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+        validate: (accessToken: string, context?: ClientRequestContext) => Promise<TenantClientValidationResult>;
     };
     /**
      * Scopes a client to a single tenant's OAuth credentials — mints and
@@ -824,7 +833,7 @@ declare class TenantScopedClient {
     private getAccessToken;
     private request;
     /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-    validate(): Promise<TenantClientValidationResult>;
+    validate(context?: ClientRequestContext): Promise<TenantClientValidationResult>;
     readonly members: {
         /**
          * GET /tenant/members — members of the token's tenant.

package/dist/index.cjs

@@ -835,6 +835,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -953,7 +961,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -1119,6 +1131,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -1145,7 +1158,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1296,8 +1312,8 @@ var TenantScopedClient = class {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-  validate() {
-    return this.request("/tenant/auth/validate", { method: "POST" });
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
   }
 };
 function createClient(options = {}) {
@@ -1319,6 +1335,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-NQe6R3am.cjs';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-NQe6R3am.cjs';
+import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-BGURVMFT.cjs';
+export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-BGURVMFT.cjs';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +59,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-NQe6R3am.js';
-export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-NQe6R3am.js';
+import { H as HttpAdapter, c as HttpLoggerOptions, A as AuthyonServerClient } from './authorization-BGURVMFT.js';
+export { d as AbilityConditions, e as AbilityEvent, f as AbilityListener, g as AbilityRequirement, h as AbilityRule, a as AbilitySubject, i as AcceptWorkspaceInviteInput, j as AccessTokenSource, k as AuditEvent, l as AuthorizationContext, b as AuthorizationError, m as AuthorizationOptions, n as AuthyonAbility, o as AuthyonAbilityBuilder, p as AuthyonAbilityOptions, q as AuthyonJwksDiscoveryOptions, r as AuthyonJwtClaims, s as AuthyonPermissionSource, t as AuthyonServerClientOptions, C as ClientCredentials, u as ClientRequestContext, v as CreateCredentialInput, w as CreateOrganizationInput, x as CreatePermissionInput, y as CreateTenantCredentialInput, z as CreateUserInput, B as CredentialCreator, D as CredentialDetail, E as CredentialListOptions, F as CredentialPermissionsInput, G as CredentialScope, I as EnvironmentUser, J as ExpressAuthorizationMiddlewareOptions, K as ExpressNext, L as ExpressRequestLike, M as ExpressResponseLike, N as FetchHttpAdapter, O as HttpAdapterRequest, P as HttpLogEvent, Q as HttpLogger, S as IntrospectResult, T as InviteTenantMemberInput, U as InviteWorkspaceMemberInput, V as JsonWebKeySet, W as JwksTokenVerifier, X as JwksTokenVerifierOptions, Y as LoggingHttpAdapter, Z as LoginActivity, _ as OpenIdConfiguration, $ as Organization, a0 as Paged, a1 as PaginationOptions, a2 as Permission, a3 as PermissionsByRole, a4 as PlatformScopedClient, R as RequestAuthorizationOptions, a5 as ReservedPermissions, a6 as Role, a7 as RoleGrant, a8 as RoleInput, a9 as RoleList, aa as RolePermissions, ab as SafeJwtAlgorithm, ac as TenantClientValidationResult, ad as TenantCredentialIssued, ae as TenantCredentialSummary, af as TenantManagementScope, ag as TenantMember, ah as TenantMemberPage, ai as TenantMembership, aj as TenantScopedClient, ak as TokenResult, al as TokenVerificationError, am as TokenVerificationErrorCode, an as UpdateOrganizationInput, ao as User, ap as UserScopedClient, aq as ValidateResult, ar as VerifiedAccessToken, as as WorkspaceInvite, at as WorkspaceInviteAccepted, au as WorkspaceInviteIssued, av as WorkspaceInvitePreview, aw as WorkspaceInvitesClient, ax as WorkspaceMember, ay as WorkspaceRole, az as WorkspaceTeam, aA as authorizeRequest, aB as authorizeToken, aC as createAuthorizationErrorResponse, aD as createAuthyonAbility, aE as createAuthyonRules, aF as createClient, aG as createExpressAuthorizationMiddleware, aH as hasPermission, aI as normalizeClientIp } from './authorization-BGURVMFT.js';
 import 'jose';
 
 declare const ErrorCodes: {
@@ -59,6 +59,7 @@ declare class AuthyonServerClientBuilder {
     #private;
     withEnvironmentKey(envKey: string): this;
     withEnvironmentCredentials(clientId: string, clientSecret: string): this;
+    withClientIp(clientIp: string): this;
     withBaseUrl(baseUrl: string, allowInsecureHttp?: boolean): this;
     withTimeout(timeoutMs: number): this;
     withHttpAdapter(httpAdapter: HttpAdapter): this;

package/dist/index.js

@@ -642,6 +642,14 @@ var AuthyonServerClient = class {
           client_id: credentials.clientId,
           client_secret: credentials.clientSecret
         }
+      }),
+      /** POST /tenant/auth/validate — validates an already-minted tenant-client bearer token. */
+      validate: (accessToken, context) => this.request("/tenant/auth/validate", {
+        method: "POST",
+        headers: {
+          ...clientIpHeaders(context),
+          Authorization: `Bearer ${accessToken}`
+        }
       })
     };
     this.workspaceInvites = new WorkspaceInvitesClient(
@@ -760,7 +768,11 @@ var AuthyonServerClient = class {
           create: (tenantId, input) => this.request(`/env/tenants/${segment(tenantId)}/credentials`, {
             method: "POST",
             envBearer: true,
-            body: { description: input.description, ...lifetimeBody(input), ...permissionsBody(input) }
+            body: {
+              description: input.description,
+              ...lifetimeBody(input),
+              ...permissionsBody(input)
+            }
           }),
           /** Returns a new secret once while keeping the same client id. */
           rotate: (tenantId, credentialId) => this.request(
@@ -926,6 +938,7 @@ var AuthyonServerClient = class {
     this.envKey = options.envKey;
     this.clientId = options.clientId;
     __privateSet(this, _clientSecret, options.clientSecret);
+    this.clientIp = options.clientIp;
     this.transport = createSharedTransport({
       baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
       allowInsecureHttp: options.allowInsecureHttp,
@@ -952,7 +965,10 @@ var AuthyonServerClient = class {
     });
   }
   async request(path, options = {}) {
-    const headers = { ...options.headers };
+    const headers = {
+      ...clientIpHeaders({ clientIp: this.clientIp }),
+      ...options.headers
+    };
     if (options.envBearer) {
       headers.Authorization = `Bearer ${await this.getEnvironmentAccessToken()}`;
     }
@@ -1103,8 +1119,8 @@ var TenantScopedClient = class {
     return this.server._requestAsTenant(await this.getAccessToken(), path, options);
   }
   /** POST /tenant/auth/validate — validates this tenant client's current bearer token. */
-  validate() {
-    return this.request("/tenant/auth/validate", { method: "POST" });
+  async validate(context) {
+    return this.server.tenantAuth.validate(await this.getAccessToken(), context);
   }
 };
 function createClient(options = {}) {
@@ -1126,6 +1142,10 @@ var AuthyonServerClientBuilder = class {
     __privateGet(this, _options).clientSecret = clientSecret;
     return this;
   }
+  withClientIp(clientIp) {
+    __privateGet(this, _options).clientIp = clientIp;
+    return this;
+  }
   withBaseUrl(baseUrl, allowInsecureHttp = false) {
     __privateGet(this, _options).baseUrl = baseUrl;
     __privateGet(this, _options).allowInsecureHttp = allowInsecureHttp;

package/dist/next.d.cts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-NQe6R3am.cjs';
+import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-BGURVMFT.cjs';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/dist/next.d.ts

@@ -1,5 +1,5 @@
 import { ReactNode } from 'react';
-import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-NQe6R3am.js';
+import { R as RequestAuthorizationOptions, A as AuthyonServerClient, a as AbilitySubject, b as AuthorizationError } from './authorization-BGURVMFT.js';
 import 'jose';
 
 interface ServerPermissionGuardFallbackContext {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authyon/server",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.6",
   "description": "Authyon SDK for backends — server-to-server organization/member management and access-token verification.",
   "license": "MIT",
   "type": "module",