@azlib/identity 0.2.0

package/dist/express.cjs

@@ -0,0 +1,405 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-Bcjx9o6g.cjs");
+const require_logger = require("./logger-Be1wDzBC.cjs");
+let express = require("express");
+//#region core/express/middleware.ts
+const extractBearerToken = (req) => {
+	const header = req.headers.authorization;
+	if (!header || !header.startsWith("Bearer ")) return null;
+	const token = header.slice(7).trim();
+	return token.length > 0 ? token : null;
+};
+/**
+* Express middleware that authenticates the request using a Bearer access token and
+* attaches the hydrated principal to `req.identity`. Forwards identity errors to the
+* error-handling middleware.
+*/
+function requireAuth(service) {
+	return async (req, _res, next) => {
+		try {
+			const token = extractBearerToken(req);
+			if (!token) throw new require_errors.UnauthenticatedError();
+			req.identity = await service.authenticate(token);
+			next();
+		} catch (error) {
+			next(error);
+		}
+	};
+}
+/**
+* Express middleware enforcing an authorization requirement (deny-by-default). Must run
+* after {@link requireAuth}. Optionally loads a resource for ownership policies.
+*/
+function requireAuthorization(service, requirement, loadResource) {
+	return async (req, _res, next) => {
+		try {
+			const principal = req.identity;
+			if (!principal) throw new require_errors.UnauthenticatedError();
+			const resource = loadResource ? await loadResource(req) : void 0;
+			if (!(await service.authorize(requirement, {
+				principal,
+				action: requirement.permission ?? "custom",
+				resource
+			})).allowed) throw new require_errors.ForbiddenError();
+			next();
+		} catch (error) {
+			next(error);
+		}
+	};
+}
+/** Convenience: require a single permission. */
+function requirePermission(service, permission) {
+	return requireAuthorization(service, { permission });
+}
+//#endregion
+//#region core/express/oauth-routes.ts
+/**
+* Returns an Express route handler that redirects the user to the OAuth provider's
+* authorization page. Generates and persists a CSRF state value via `options.setState`.
+*
+* @example
+* ```ts
+* app.get("/auth/google", oauthAuthorize(identity.oauth!, "google", {
+*   redirectUri: `${BASE_URL}/auth/google/callback`,
+*   getState: (req) => req.session?.oauthState ?? null,
+*   setState: (req, _res, state) => { req.session!.oauthState = state; },
+*   onSuccess: (_req, res, result) => res.json(result),
+* }));
+* ```
+*/
+function oauthAuthorize(oauthService, providerName, options) {
+	return async (req, res, next) => {
+		try {
+			const { url, state } = oauthService.buildAuthorizationUrl(providerName, options.redirectUri);
+			await options.setState(req, res, state);
+			res.redirect(url);
+		} catch (error) {
+			next(error);
+		}
+	};
+}
+/**
+* Returns an Express route handler that handles the OAuth provider callback. Verifies
+* state, exchanges the code, and calls `options.onSuccess` with the auth result.
+*
+* @example
+* ```ts
+* app.get("/auth/google/callback", oauthCallback(identity.oauth!, "google", {
+*   redirectUri: `${BASE_URL}/auth/google/callback`,
+*   getState: (req) => req.session?.oauthState ?? null,
+*   setState: (req, _res, state) => { req.session!.oauthState = state; },
+*   onSuccess: (_req, res, result) => res.json(result),
+* }));
+* ```
+*/
+function oauthCallback(oauthService, providerName, options) {
+	return async (req, res, next) => {
+		try {
+			const code = typeof req.query["code"] === "string" ? req.query["code"] : null;
+			const state = typeof req.query["state"] === "string" ? req.query["state"] : null;
+			const error = typeof req.query["error"] === "string" ? req.query["error"] : null;
+			if (error) throw new require_errors.IdentityError("identity/oauth-error", `Provider error: ${typeof req.query["error_description"] === "string" ? req.query["error_description"] : error}`, 400);
+			if (!code || !state) throw new require_errors.IdentityError("identity/oauth-invalid-callback", "Missing code or state in OAuth callback.", 400);
+			const expectedState = await options.getState(req);
+			if (!expectedState) throw new require_errors.IdentityError("identity/oauth-state-missing", "No OAuth state found in session. The request may have expired.", 400);
+			const result = await oauthService.handleCallback(providerName, {
+				code,
+				state,
+				expectedState,
+				redirectUri: options.redirectUri
+			});
+			await options.onSuccess(req, res, result);
+		} catch (error) {
+			next(error);
+		}
+	};
+}
+//#endregion
+//#region core/express/identity-router.ts
+const OAUTH_STATE_COOKIE = "azlib_oauth_state";
+function resolveCookieName(opts) {
+	return opts.name ?? "azlib_rt";
+}
+/** Parses cookies from the raw `Cookie` header without a dependency on `cookie-parser`. */
+function readCookie(req, name) {
+	const raw = req.headers.cookie ?? "";
+	for (const part of raw.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		if (part.slice(0, eq).trim() === name) try {
+			return decodeURIComponent(part.slice(eq + 1).trim());
+		} catch {
+			return part.slice(eq + 1).trim();
+		}
+	}
+}
+/**
+* Writes the refresh token into a `Set-Cookie` header and returns a body-safe tokens
+* object that omits the refresh token.
+*/
+function setCookieAndStripRefreshToken(res, tokens, opts) {
+	const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();
+	res.cookie(resolveCookieName(opts), tokens.refreshToken, {
+		httpOnly: opts.httpOnly ?? true,
+		secure: opts.secure ?? process.env.NODE_ENV === "production",
+		sameSite: opts.sameSite ?? "lax",
+		path: opts.path ?? "/",
+		domain: opts.domain,
+		maxAge
+	});
+	const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;
+	return bodyTokens;
+}
+/**
+* Sends the authentication result as JSON. In cookie mode the refresh token is stored
+* in a `Set-Cookie` header and excluded from the body.
+*
+* When the result is an MFA challenge (`{ kind: "mfa_required" }`), it is forwarded as-is
+* with HTTP 200 so the client knows to complete the TOTP step.
+*/
+function sendLoginResult(res, result, cookieOpts) {
+	if ("mfaToken" in result) {
+		res.json(result);
+		return;
+	}
+	sendAuthResult(res, result, cookieOpts);
+}
+function sendAuthResult(res, result, cookieOpts) {
+	if (cookieOpts) {
+		const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);
+		res.json({
+			user: result.user,
+			tokens
+		});
+	} else res.json(result);
+}
+/**
+* Reads the refresh token from the request. In cookie mode it is read from the cookie;
+* in body mode it is expected in `req.body.refreshToken`.
+*/
+function readRefreshToken(req, cookieOpts) {
+	if (cookieOpts) return readCookie(req, resolveCookieName(cookieOpts));
+	const token = req.body?.["refreshToken"];
+	return typeof token === "string" ? token : void 0;
+}
+/**
+* Creates a pre-wired Express `Router` with all standard identity endpoints.
+*
+* Mount it once on your application:
+* ```ts
+* import express from "express";
+* import { createIdentityService } from "@azlib/identity/node";
+* import { createIdentityRouter, identityErrorHandler } from "@azlib/identity/express";
+*
+* const service = createIdentityService(config, store);
+* const app = express();
+*
+* app.use(express.json());
+* // Routes are served at /account/login, /account/register, etc. (default prefix)
+* app.use(createIdentityRouter(service));
+* // Or use a custom prefix:
+* app.use(createIdentityRouter(service, { prefix: "auth" }));
+* app.use(identityErrorHandler()); // optional convenience error handler
+* ```
+*
+* Pre-wired routes:
+*
+* | Method | Path | Description |
+* |--------|------|-------------|
+* | POST | `/register` | Create a new account |
+* | POST | `/login` | Email + password login |
+* | POST | `/refresh` | Rotate the refresh token |
+* | POST | `/logout` | Revoke the current session |
+* | GET  | `/me` | Return the authenticated principal |
+* | GET  | `/:provider` | Start an OAuth 2.0 authorisation flow *(optional)* |
+* | GET  | `/:provider/callback` | Handle an OAuth 2.0 callback *(optional)* |
+*/
+function createIdentityRouter(service, options = {}) {
+	const prefix = options.prefix ?? "account";
+	const log = require_logger.resolveLogger(options.logger);
+	const router = (0, express.Router)();
+	const cookieOpts = typeof options.refreshToken === "object" && "cookie" in options.refreshToken ? options.refreshToken.cookie : void 0;
+	router.use((_req, res, next) => {
+		const start = Date.now();
+		res.on("finish", () => {
+			const ms = Date.now() - start;
+			log.info(`${_req.method} ${_req.originalUrl} ${res.statusCode}`, { durationMs: ms });
+		});
+		next();
+	});
+	router.post("/register", async (req, res, next) => {
+		try {
+			sendAuthResult(res, await service.register(req.body), cookieOpts);
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/login", async (req, res, next) => {
+		try {
+			sendLoginResult(res, await service.login(req.body), cookieOpts);
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/refresh", async (req, res, next) => {
+		try {
+			const token = readRefreshToken(req, cookieOpts);
+			if (!token) throw new require_errors.UnauthenticatedError("Refresh token is missing.");
+			sendAuthResult(res, await service.refresh(token), cookieOpts);
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/logout", async (req, res, next) => {
+		try {
+			const token = readRefreshToken(req, cookieOpts);
+			if (token) await service.logout(token);
+			if (cookieOpts) res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? "/" });
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.get("/me", requireAuth(service), (_req, res) => {
+		res.json(_req.identity);
+	});
+	router.post("/request-email-verification", requireAuth(service), async (req, res, next) => {
+		try {
+			await service.requestEmailVerification(req.identity.userId);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/verify-email", async (req, res, next) => {
+		try {
+			const { token } = req.body;
+			if (!token) throw new require_errors.UnauthenticatedError("token is required.");
+			await service.verifyEmail(token);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/request-password-reset", async (req, res, next) => {
+		try {
+			const { email } = req.body;
+			if (!email) throw new require_errors.UnauthenticatedError("email is required.");
+			await service.requestPasswordReset(email);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/reset-password", async (req, res, next) => {
+		try {
+			const { token, newPassword } = req.body;
+			if (!token || !newPassword) throw new require_errors.UnauthenticatedError("token and newPassword are required.");
+			await service.resetPassword(token, newPassword);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/mfa/verify", async (req, res, next) => {
+		try {
+			const { mfaToken, code } = req.body;
+			if (!mfaToken || !code) throw new require_errors.UnauthenticatedError("mfaToken and code are required.");
+			sendAuthResult(res, await service.verifyMfaChallenge(mfaToken, code), cookieOpts);
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/2fa/setup", requireAuth(service), async (req, res, next) => {
+		try {
+			const result = await service.setup2FA(req.identity.userId);
+			res.json(result);
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/2fa/enable", requireAuth(service), async (req, res, next) => {
+		try {
+			const { code } = req.body;
+			if (!code) throw new require_errors.UnauthenticatedError("code is required.");
+			await service.enable2FA(req.identity.userId, code);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/2fa/disable", requireAuth(service), async (req, res, next) => {
+		try {
+			const { code } = req.body;
+			if (!code) throw new require_errors.UnauthenticatedError("code is required.");
+			await service.disable2FA(req.identity.userId, code);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/admin/lock/:userId", async (req, res, next) => {
+		try {
+			await service.lockAccount(req.params["userId"]);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/admin/unlock/:userId", async (req, res, next) => {
+		try {
+			await service.unlockAccount(req.params["userId"]);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	router.post("/admin/disable/:userId", async (req, res, next) => {
+		try {
+			await service.disableAccount(req.params["userId"]);
+			res.status(204).end();
+		} catch (err) {
+			next(err);
+		}
+	});
+	if (service.oauth) {
+		const oauthService = service.oauth;
+		const baseUrl = options.oauthBaseUrl ?? "";
+		const stateCookieOptions = {
+			httpOnly: true,
+			sameSite: "lax",
+			secure: process.env.NODE_ENV === "production",
+			maxAge: 600 * 1e3
+		};
+		for (const providerName of oauthService.providers) {
+			const redirectUri = `${baseUrl}/${providerName}/callback`;
+			router.get(`/${providerName}`, oauthAuthorize(oauthService, providerName, {
+				redirectUri,
+				setState: (_req, oauthRes, state) => {
+					oauthRes.cookie(OAUTH_STATE_COOKIE, state, stateCookieOptions);
+				}
+			}));
+			router.get(`/${providerName}/callback`, oauthCallback(oauthService, providerName, {
+				redirectUri,
+				getState: (oauthReq) => readCookie(oauthReq, OAUTH_STATE_COOKIE) ?? null,
+				setState: (_oauthReq, oauthRes, _state) => {
+					oauthRes.clearCookie(OAUTH_STATE_COOKIE);
+				},
+				onSuccess: (_oauthReq, oauthRes, result) => {
+					sendAuthResult(oauthRes, result, cookieOpts);
+				}
+			}));
+		}
+	}
+	const outer = (0, express.Router)();
+	if (prefix) outer.use(`/${prefix}`, router);
+	else outer.use(router);
+	return outer;
+}
+//#endregion
+exports.createIdentityRouter = createIdentityRouter;
+exports.oauthAuthorize = oauthAuthorize;
+exports.oauthCallback = oauthCallback;
+exports.requireAuth = requireAuth;
+exports.requireAuthorization = requireAuthorization;
+exports.requirePermission = requirePermission;

package/dist/express.d.cts

@@ -0,0 +1,87 @@
+import { c as AuthResult, d as AuthenticatedIdentity } from "./identity-store-BRRahxcS.cjs";
+import { V as AuthorizationRequirement, f as OAuthService } from "./errors-C2xZAatu.cjs";
+import { t as IdentityService } from "./identity-service-CLzKx8Z7.cjs";
+import { n as IdentityRouterOptions, r as createIdentityRouter, t as CookieRefreshOptions } from "./identity-router-Dib30Waj.cjs";
+import { Request, RequestHandler, Response } from "express";
+
+//#region core/express/middleware.d.ts
+declare global {
+  namespace Express {
+    interface Request {
+      /** The authenticated principal, set by {@link requireAuth}. */
+      identity?: AuthenticatedIdentity;
+    }
+  }
+}
+/** Loads the resource a policy will be evaluated against. */
+type ResourceLoader<TResource> = (req: Request) => TResource | Promise<TResource>;
+/**
+ * Express middleware that authenticates the request using a Bearer access token and
+ * attaches the hydrated principal to `req.identity`. Forwards identity errors to the
+ * error-handling middleware.
+ */
+declare function requireAuth(service: IdentityService): RequestHandler;
+/**
+ * Express middleware enforcing an authorization requirement (deny-by-default). Must run
+ * after {@link requireAuth}. Optionally loads a resource for ownership policies.
+ */
+declare function requireAuthorization<TResource = unknown>(service: IdentityService, requirement: AuthorizationRequirement<TResource>, loadResource?: ResourceLoader<TResource>): RequestHandler;
+/** Convenience: require a single permission. */
+declare function requirePermission(service: IdentityService, permission: string): RequestHandler;
+//#endregion
+//#region core/express/oauth-routes.d.ts
+/**
+ * Options for {@link oauthAuthorize} and {@link oauthCallback}.
+ */
+interface OAuthRouteOptions {
+  /** The full redirect URI registered with the provider (must match exactly). */
+  redirectUri: string;
+  /**
+   * Retrieves the stored CSRF state value from the current request context (e.g. from a
+   * signed cookie or server session). Return `null` if no state has been stored yet.
+   */
+  getState(req: Request): string | null | Promise<string | null>;
+  /**
+   * Persists the generated CSRF state value before redirecting the user to the provider.
+   * Use a signed cookie or server session.
+   */
+  setState(req: Request, res: Response, state: string): void | Promise<void>;
+  /**
+   * Called on a successful OAuth callback with the auth result. Typically sets a session
+   * cookie and redirects to the app.
+   */
+  onSuccess(req: Request, res: Response, result: AuthResult): void | Promise<void>;
+}
+/**
+ * Returns an Express route handler that redirects the user to the OAuth provider's
+ * authorization page. Generates and persists a CSRF state value via `options.setState`.
+ *
+ * @example
+ * ```ts
+ * app.get("/auth/google", oauthAuthorize(identity.oauth!, "google", {
+ *   redirectUri: `${BASE_URL}/auth/google/callback`,
+ *   getState: (req) => req.session?.oauthState ?? null,
+ *   setState: (req, _res, state) => { req.session!.oauthState = state; },
+ *   onSuccess: (_req, res, result) => res.json(result),
+ * }));
+ * ```
+ */
+declare function oauthAuthorize(oauthService: OAuthService, providerName: string, options: Pick<OAuthRouteOptions, "redirectUri" | "setState">): RequestHandler;
+/**
+ * Returns an Express route handler that handles the OAuth provider callback. Verifies
+ * state, exchanges the code, and calls `options.onSuccess` with the auth result.
+ *
+ * @example
+ * ```ts
+ * app.get("/auth/google/callback", oauthCallback(identity.oauth!, "google", {
+ *   redirectUri: `${BASE_URL}/auth/google/callback`,
+ *   getState: (req) => req.session?.oauthState ?? null,
+ *   setState: (req, _res, state) => { req.session!.oauthState = state; },
+ *   onSuccess: (_req, res, result) => res.json(result),
+ * }));
+ * ```
+ */
+declare function oauthCallback(oauthService: OAuthService, providerName: string, options: OAuthRouteOptions): RequestHandler;
+//#endregion
+export { CookieRefreshOptions, IdentityRouterOptions, OAuthRouteOptions, ResourceLoader, createIdentityRouter, oauthAuthorize, oauthCallback, requireAuth, requireAuthorization, requirePermission };
+//# sourceMappingURL=express.d.cts.map

package/dist/express.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.cts","names":[],"sources":["../core/express/middleware.ts","../core/express/oauth-routes.ts"],"mappings":";;;;;;;QAOQ,MAAA;EAAA,UAEI,OAAA;IAAA,UACE,OAAA;MALwC;MAOhD,QAAA,GAAW,qBAAqB;IAAA;EAAA;AAAA;;KAM1B,cAAA,eAA6B,GAAA,EAAK,OAAA,KAAY,SAAA,GAAY,OAAA,CAAQ,SAAA;;;;;AANxC;iBAoBtB,WAAA,CAAY,OAAA,EAAS,eAAA,GAAkB,cAAc;;;;;iBAmBrD,oBAAA,qBAAA,CACd,OAAA,EAAS,eAAA,EACT,WAAA,EAAa,wBAAA,CAAyB,SAAA,GACtC,YAAA,GAAe,cAAA,CAAe,SAAA,IAC7B,cAAA;;iBAwBa,iBAAA,CACd,OAAA,EAAS,eAAA,EACT,UAAA,WACC,cAAc;;;;;;UC1EA,iBAAA;;EAEf,WAAA;EDLoD;;;;ECUpD,QAAA,CAAS,GAAA,EAAK,OAAA,mBAA0B,OAAA;EDL5B;;;;ECUZ,QAAA,CAAS,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,QAAA,EAAU,KAAA,kBAAuB,OAAA;EDRzB;AAMtC;;;ECOE,SAAA,CAAU,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,QAAA,EAAU,MAAA,EAAF,UAAA,UAAiD,OAAA;AAAA;;;;;;;;;;;;ADPD;AAcvF;;iBCUgB,cAAA,CACd,YAAA,EAAc,YAAA,EACd,YAAA,UACA,OAAA,EAAS,IAAA,CAAK,iBAAA,gCACb,cAAA;;;;;;ADdkE;AAmBrE;;;;;;;;iBCqBgB,aAAA,CACd,YAAA,EAAc,YAAA,EACd,YAAA,UACA,OAAA,EAAS,iBAAA,GACR,cAAA"}

package/dist/express.d.mts

@@ -0,0 +1,87 @@
+import { c as AuthResult, d as AuthenticatedIdentity } from "./identity-store-BRRahxcS.mjs";
+import { V as AuthorizationRequirement, f as OAuthService } from "./errors-BGMwaW5s.mjs";
+import { t as IdentityService } from "./identity-service-B9zrvE9z.mjs";
+import { n as IdentityRouterOptions, r as createIdentityRouter, t as CookieRefreshOptions } from "./identity-router-DBL20UWT.mjs";
+import { Request, RequestHandler, Response } from "express";
+
+//#region core/express/middleware.d.ts
+declare global {
+  namespace Express {
+    interface Request {
+      /** The authenticated principal, set by {@link requireAuth}. */
+      identity?: AuthenticatedIdentity;
+    }
+  }
+}
+/** Loads the resource a policy will be evaluated against. */
+type ResourceLoader<TResource> = (req: Request) => TResource | Promise<TResource>;
+/**
+ * Express middleware that authenticates the request using a Bearer access token and
+ * attaches the hydrated principal to `req.identity`. Forwards identity errors to the
+ * error-handling middleware.
+ */
+declare function requireAuth(service: IdentityService): RequestHandler;
+/**
+ * Express middleware enforcing an authorization requirement (deny-by-default). Must run
+ * after {@link requireAuth}. Optionally loads a resource for ownership policies.
+ */
+declare function requireAuthorization<TResource = unknown>(service: IdentityService, requirement: AuthorizationRequirement<TResource>, loadResource?: ResourceLoader<TResource>): RequestHandler;
+/** Convenience: require a single permission. */
+declare function requirePermission(service: IdentityService, permission: string): RequestHandler;
+//#endregion
+//#region core/express/oauth-routes.d.ts
+/**
+ * Options for {@link oauthAuthorize} and {@link oauthCallback}.
+ */
+interface OAuthRouteOptions {
+  /** The full redirect URI registered with the provider (must match exactly). */
+  redirectUri: string;
+  /**
+   * Retrieves the stored CSRF state value from the current request context (e.g. from a
+   * signed cookie or server session). Return `null` if no state has been stored yet.
+   */
+  getState(req: Request): string | null | Promise<string | null>;
+  /**
+   * Persists the generated CSRF state value before redirecting the user to the provider.
+   * Use a signed cookie or server session.
+   */
+  setState(req: Request, res: Response, state: string): void | Promise<void>;
+  /**
+   * Called on a successful OAuth callback with the auth result. Typically sets a session
+   * cookie and redirects to the app.
+   */
+  onSuccess(req: Request, res: Response, result: AuthResult): void | Promise<void>;
+}
+/**
+ * Returns an Express route handler that redirects the user to the OAuth provider's
+ * authorization page. Generates and persists a CSRF state value via `options.setState`.
+ *
+ * @example
+ * ```ts
+ * app.get("/auth/google", oauthAuthorize(identity.oauth!, "google", {
+ *   redirectUri: `${BASE_URL}/auth/google/callback`,
+ *   getState: (req) => req.session?.oauthState ?? null,
+ *   setState: (req, _res, state) => { req.session!.oauthState = state; },
+ *   onSuccess: (_req, res, result) => res.json(result),
+ * }));
+ * ```
+ */
+declare function oauthAuthorize(oauthService: OAuthService, providerName: string, options: Pick<OAuthRouteOptions, "redirectUri" | "setState">): RequestHandler;
+/**
+ * Returns an Express route handler that handles the OAuth provider callback. Verifies
+ * state, exchanges the code, and calls `options.onSuccess` with the auth result.
+ *
+ * @example
+ * ```ts
+ * app.get("/auth/google/callback", oauthCallback(identity.oauth!, "google", {
+ *   redirectUri: `${BASE_URL}/auth/google/callback`,
+ *   getState: (req) => req.session?.oauthState ?? null,
+ *   setState: (req, _res, state) => { req.session!.oauthState = state; },
+ *   onSuccess: (_req, res, result) => res.json(result),
+ * }));
+ * ```
+ */
+declare function oauthCallback(oauthService: OAuthService, providerName: string, options: OAuthRouteOptions): RequestHandler;
+//#endregion
+export { CookieRefreshOptions, IdentityRouterOptions, OAuthRouteOptions, ResourceLoader, createIdentityRouter, oauthAuthorize, oauthCallback, requireAuth, requireAuthorization, requirePermission };
+//# sourceMappingURL=express.d.mts.map

package/dist/express.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.mts","names":[],"sources":["../core/express/middleware.ts","../core/express/oauth-routes.ts"],"mappings":";;;;;;;QAOQ,MAAA;EAAA,UAEI,OAAA;IAAA,UACE,OAAA;MALwC;MAOhD,QAAA,GAAW,qBAAqB;IAAA;EAAA;AAAA;;KAM1B,cAAA,eAA6B,GAAA,EAAK,OAAA,KAAY,SAAA,GAAY,OAAA,CAAQ,SAAA;;;;;AANxC;iBAoBtB,WAAA,CAAY,OAAA,EAAS,eAAA,GAAkB,cAAc;;;;;iBAmBrD,oBAAA,qBAAA,CACd,OAAA,EAAS,eAAA,EACT,WAAA,EAAa,wBAAA,CAAyB,SAAA,GACtC,YAAA,GAAe,cAAA,CAAe,SAAA,IAC7B,cAAA;;iBAwBa,iBAAA,CACd,OAAA,EAAS,eAAA,EACT,UAAA,WACC,cAAc;;;;;;UC1EA,iBAAA;;EAEf,WAAA;EDLoD;;;;ECUpD,QAAA,CAAS,GAAA,EAAK,OAAA,mBAA0B,OAAA;EDL5B;;;;ECUZ,QAAA,CAAS,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,QAAA,EAAU,KAAA,kBAAuB,OAAA;EDRzB;AAMtC;;;ECOE,SAAA,CAAU,GAAA,EAAK,OAAA,EAAS,GAAA,EAAK,QAAA,EAAU,MAAA,EAAF,UAAA,UAAiD,OAAA;AAAA;;;;;;;;;;;;ADPD;AAcvF;;iBCUgB,cAAA,CACd,YAAA,EAAc,YAAA,EACd,YAAA,UACA,OAAA,EAAS,IAAA,CAAK,iBAAA,gCACb,cAAA;;;;;;ADdkE;AAmBrE;;;;;;;;iBCqBgB,aAAA,CACd,YAAA,EAAc,YAAA,EACd,YAAA,UACA,OAAA,EAAS,iBAAA,GACR,cAAA"}