@c9up/warden 0.1.8 → 0.1.10

package/dist/middleware.d.ts

@@ -17,35 +17,81 @@
  */
 import { type AuthResult } from "./AuthManager.js";
 import type { BasePolicy } from "./bouncer/BasePolicy.js";
-import { Bouncer } from "./bouncer/Bouncer.js";
 import type { Ability } from "./bouncer/types.js";
 import type { ScopeRequestContext } from "./config.js";
 import type { Scope } from "./rights/types.js";
 import type { SessionStore } from "./strategies/SessionStrategy.js";
+/**
+ * Tokens warden resolves from the container: a service class, or a string/symbol
+ * alias (`"bouncer:registry"`). Mirrors Ream's `ServiceToken` without importing
+ * it — warden declares the shape so it stays framework-agnostic.
+ */
+type ResolvableToken = string | symbol | (abstract new (...args: never[]) => unknown);
+/**
+ * Per-request IoC resolver Ream exposes as `ctx.containerResolver` (Adonis
+ * idiom). Warden resolves AuthManager / RightsResolver / the bouncer registry
+ * through this — reading from the context it is HANDED — so the package never
+ * imports `@c9up/ream` at runtime. A host that provides none (non-Ream, or a
+ * misconfigured kernel) yields no resolution: guarded routes fail CLOSED.
+ */
+interface ContainerResolver {
+    make(token: ResolvableToken): unknown;
+}
+/**
+ * Agnostic authorization slot — structurally Ream's `Authorizer` interface (and
+ * Adonis's bouncer contract): `allows` / `denies` / `authorize`. Typed as the
+ * interface, NOT the concrete `Bouncer`, so a real Ream `HttpContext` — whose
+ * `bouncer` is this same agnostic shape — is assignable to `WardenContext`
+ * without warden importing `@c9up/ream`. `initializeBouncer` fills the slot with
+ * a concrete `Bouncer`, which satisfies this contract.
+ */
+interface Authorizer {
+    allows(ability: string, ...args: unknown[]): Promise<boolean>;
+    denies(ability: string, ...args: unknown[]): Promise<boolean>;
+    authorize(ability: string, ...args: unknown[]): Promise<void>;
+}
 export interface WardenContext {
     request: {
-        method: string;
-        url: string;
-        headers: Record<string, string>;
+        /** Ream's `HttpContext` exposes headers as a METHOD, not a property. */
+        headers(): Record<string, string>;
     };
+    /**
+     * Per-request IoC resolver (Ream's `ctx.containerResolver`). Warden resolves
+     * AuthManager + the bouncer registry through it — agnostic, no `@c9up/ream`
+     * import. Absent on a non-Ream host → guarded routes fail closed.
+     */
+    containerResolver?: ContainerResolver;
     response: {
-        status: (code: number) => void;
+        status: (code: number) => unknown;
         json: (data: unknown) => void;
     };
-    container: {
-        resolve: (key: string | symbol | (abstract new (...args: never[]) => unknown)) => unknown;
-    };
-    /** Session store — set by a session middleware upstream. */
-    session?: SessionStore;
-    /** Set by the middleware after successful auth. */
-    auth?: AuthResult;
-    /** Set by `initializeBouncer` — the per-request authorization entry point. */
-    bouncer?: Bouncer;
-    /** The route handler metadata (decorators). */
+    /**
+     * Matched-route info — Ream (like Adonis) exposes the controller class +
+     * method under `ctx.route` (`ctx.route.controller` / `ctx.route.action`),
+     * NOT top-level. This is the primary source the guard-metadata lookup reads.
+     * Absent for inline-function routes. (context7 `/adonisjs/v7-docs`: "access
+     * the currently matched route via `ctx.route`".)
+     */
     route?: {
         controller?: object;
         action?: string | symbol;
     };
+    /**
+     * Top-level controller/action — kept only as a FALLBACK for hosts that
+     * expose them flat. Ream uses `ctx.route` (above); the lookup prefers it.
+     */
+    controller?: object;
+    action?: string | symbol;
+    /** Session store — set by a session middleware upstream. */
+    session?: SessionStore;
+    /** Set by the middleware after successful auth (Ream's `auth` slot). */
+    auth?: AuthResult;
+    /**
+     * Per-request authorization entry point — set by `initializeBouncer`. Typed
+     * as the agnostic {@link Authorizer} contract (Ream's `ctx.bouncer` slot),
+     * filled with a concrete `Bouncer` at runtime.
+     */
+    bouncer?: Authorizer;
 }
 type WardenNext = () => Promise<void> | void;
 /**
@@ -78,5 +124,15 @@ export interface BouncerRegistry {
  * including for guests — matching AdonisJS's `initialize_bouncer_middleware`.
  */
 export declare function initializeBouncer(ctx: WardenContext, next: WardenNext): Promise<void>;
+/**
+ * Default export — the Adonis-style class form Ream's lazy middleware resolver
+ * expects (`new mod.default().handle(ctx, next)`). Without it the documented
+ * `router.use([() => import('@c9up/warden/middleware')])` crashes with
+ * `new undefined()`. The named `wardenMiddleware` / `initializeBouncer` stay for
+ * direct registration `router.use([wardenMiddleware])`.
+ */
+export default class WardenMiddleware {
+    handle(ctx: WardenContext, next: WardenNext): Promise<void>;
+}
 export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC;IACF,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF,SAAS,EAAE;QACV,OAAO,EAAE,CACR,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,KAC/D,OAAO,CAAC;KACb,CAAC;IACF,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;CACF;AAED,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAwH1E;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAmB3E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEN,KAAK,UAAU,EAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AASvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE;;;;GAIG;AACH,KAAK,eAAe,GACjB,MAAM,GACN,MAAM,GACN,CAAC,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,UAAU,iBAAiB;IAC1B,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,UAAU,UAAU;IACnB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE;QACR,wEAAwE;QACxE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,EAAE;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;KAC9B,CAAC;IACF;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,wEAAwE;IACxE,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,UAAU,CAAC;CACrB;AA0BD,KAAK,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAuI1E;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,CAAC;IAC/C,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CACpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,iBAmB3E;AA0ID;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACpC,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3D"}

package/dist/middleware.js

@@ -17,21 +17,56 @@
  */
 import { AuthManager, sanitizePayload, } from "./AuthManager.js";
 import { Bouncer } from "./bouncer/Bouncer.js";
+import { WardenError } from "./errors.js";
 import { getGuardMetadata, getPermissionMetadata, getRequireMfaMetadata, getRoleMetadata, } from "./Guard.js";
 import { RightsResolver } from "./rights/RightsResolver.js";
 function hasVerifyWithContext(strategy) {
     return (typeof strategy.verifyWithContext === "function");
 }
+/**
+ * Resolve a token from the request's IoC resolver (`ctx.containerResolver`,
+ * Adonis idiom). Returns undefined when no resolver is present or the token is
+ * unbound — callers decide fail-open (the bouncer registry) vs fail-closed (the
+ * AuthManager gate in `wardenMiddleware`). No `@c9up/ream` import: warden reads
+ * only from the context Ream hands it.
+ */
+function resolveFromCtx(ctx, token) {
+    try {
+        return ctx.containerResolver?.make(token);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Bridge Ream's ctx to the `resolveScope` hook's `ScopeRequestContext`, which
+ * takes headers as a plain object (a snapshot) — keeps the app-facing hook
+ * contract stable while warden reads Ream's `headers()` method internally.
+ */
+function toScopeContext(ctx) {
+    return { request: { headers: ctx.request.headers() }, auth: ctx.auth };
+}
 /**
  * Ream auth middleware — resolves AuthManager from the container,
  * reads `@Guard`/`@Permission`/`@Role` metadata from the route handler,
  * and authenticates + authorizes the request.
  */
 export async function wardenMiddleware(ctx, next) {
-    const auth = ctx.container.resolve(AuthManager);
+    const resolvedAuth = resolveFromCtx(ctx, AuthManager);
+    if (!(resolvedAuth instanceof AuthManager)) {
+        // Fail CLOSED — a missing AuthManager (WardenProvider not registered, or
+        // no `ctx.containerResolver` on a non-Ream host) must never silently let
+        // a guarded request through.
+        throw new WardenError("AUTH_NOT_REGISTERED", "AuthManager is not registered in the container — add WardenProvider to your providers list.");
+    }
+    const auth = resolvedAuth;
     // Read guard metadata from the route handler (if declared via decorators).
-    const controller = ctx.route?.controller;
-    const action = ctx.route?.action;
+    // Ream (like Adonis) exposes the controller/method under `ctx.route`; fall
+    // back to top-level only for hosts that expose them flat. Reading the wrong
+    // place silently yields `[]` guards → guarded routes treated as public
+    // (fail-open) — the exact bug this precedence prevents.
+    const controller = ctx.route?.controller ?? ctx.controller;
+    const action = ctx.route?.action ?? ctx.action;
     const strategies = controller && action ? getGuardMetadata(controller, action) : [];
     // No guard on this route — pass through (public endpoint).
     if (strategies.length === 0) {
@@ -43,7 +78,8 @@ export async function wardenMiddleware(ctx, next) {
     // 2. API key header — reads the header name from the ApiKeyStrategy config
     //    (defaults to 'x-api-key' if no ApiKeyStrategy is registered)
     // 3. Cookie/session (Session strategy — handled by the strategy itself via context)
-    const authHeader = ctx.request.headers.authorization ?? "";
+    const headers = ctx.request.headers();
+    const authHeader = headers.authorization ?? "";
     const bearerToken = authHeader.startsWith("Bearer ")
         ? authHeader.slice(7)
         : "";
@@ -61,7 +97,7 @@ export async function wardenMiddleware(ctx, next) {
     // declared with `headerName: "X-Custom-Key"` would never match the
     // incoming `x-custom-key` key without this normalisation — auth
     // would silently fail even with the right header on the wire.
-    const apiKey = ctx.request.headers[apiKeyHeader.toLowerCase()] ?? "";
+    const apiKey = headers[apiKeyHeader.toLowerCase()] ?? "";
     const hasSessionStrategy = strategies.some((s) => s === "session");
     if (!bearerToken && !apiKey && !hasSessionStrategy) {
         ctx.response.status(401);
@@ -150,7 +186,7 @@ export async function initializeBouncer(ctx, next) {
     const registry = isBouncerRegistry(candidate) ? candidate : undefined;
     const user = ctx.auth?.user ?? null;
     const scope = registry?.resolveScope
-        ? await registry.resolveScope(ctx)
+        ? await registry.resolveScope(toScopeContext(ctx))
         : "global";
     ctx.bouncer = new Bouncer(user, registry?.abilities, registry?.policies, {
         scope,
@@ -158,14 +194,9 @@ export async function initializeBouncer(ctx, next) {
     });
     await next();
 }
-/** Resolve a container token, returning undefined instead of throwing when absent. */
+/** Resolve a container token from the request resolver, returning undefined instead of throwing when absent. */
 function tryResolve(ctx, token) {
-    try {
-        return ctx.container.resolve(token);
-    }
-    catch {
-        return undefined;
-    }
+    return resolveFromCtx(ctx, token);
 }
 /** Structural guard — the registry is a plain object carrying ability/policy tables. */
 function isBouncerRegistry(value) {
@@ -183,7 +214,9 @@ function isBouncerRegistry(value) {
 async function resolveRequestScope(ctx) {
     const candidate = tryResolve(ctx, "bouncer:registry");
     const registry = isBouncerRegistry(candidate) ? candidate : undefined;
-    return registry?.resolveScope ? await registry.resolveScope(ctx) : "global";
+    return registry?.resolveScope
+        ? await registry.resolveScope(toScopeContext(ctx))
+        : "global";
 }
 /**
  * Try each declared strategy in order — session strategies via
@@ -271,4 +304,16 @@ async function checkAuthorization(auth, user, controller, action, scope) {
     }
     return null;
 }
+/**
+ * Default export — the Adonis-style class form Ream's lazy middleware resolver
+ * expects (`new mod.default().handle(ctx, next)`). Without it the documented
+ * `router.use([() => import('@c9up/warden/middleware')])` crashes with
+ * `new undefined()`. The named `wardenMiddleware` / `initializeBouncer` stay for
+ * direct registration `router.use([wardenMiddleware])`.
+ */
+export default class WardenMiddleware {
+    handle(ctx, next) {
+        return wardenMiddleware(ctx, next);
+    }
+}
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,WAAW,EAGX,eAAe,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAG/C,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAQ5D,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AAgCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAgB,CAAC;IAE/D,2EAA2E;IAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC;IACjC,MAAM,UAAU,GACf,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,gDAAgD;IAChD,2EAA2E;IAC3E,kEAAkE;IAClE,oFAAoF;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,OAAQ,CAA6B,CAAC,UAAU,IAAI,WAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAErE,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oDAAoD;aAC7D;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACjE,IAAI,EACJ,UAAU,EACV,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,CACjE,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,gFAAgF;iBACjF;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,uBAAuB;aACjD;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACtC,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,MAAM,EACN,KAAK,CACL,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,0DAA0D;iBACnE;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB,EAAE,IAAgB;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,YAAY,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAU,QAAQ,EAAE,YAAY;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC,QAAQ,CAAC;IAEZ,GAAG,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACxE,KAAK;QACL,QAAQ;KACR,CAAC,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,UAAU,CAClB,GAAkB,EAClB,KAA4D;IAE5D,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,WAAW,IAAI,KAAK;QACpB,UAAU,IAAI,KAAK,CACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAkB;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAMD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,oEAAoE;gBACpE,MAAM,UAAU,GACf,YAAY,KAAK,SAAS;oBACzB,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBAC1B,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,IAAiB,EACjB,IAAqC,EACrC,UAAkB,EAClB,MAAuB,EACvB,KAAY;IAEZ,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACN,WAAW,EAGX,eAAe,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAQ5D,SAAS,oBAAoB,CAC5B,QAAsB;IAEtB,OAAO,CACN,OAAQ,QAAgC,CAAC,iBAAiB,KAAK,UAAU,CACzE,CAAC;AACH,CAAC;AAiFD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,GAAkB,EAAE,KAAsB;IACjE,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAkB;IACzC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAID;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB,EAAE,IAAgB;IAC1E,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,CAAC;QAC5C,yEAAyE;QACzE,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,IAAI,WAAW,CACpB,qBAAqB,EACrB,6FAA6F,CAC7F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC;IAE1B,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,wDAAwD;IACxD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;IAC/C,MAAM,UAAU,GACf,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IAED,6CAA6C;IAC7C,gDAAgD;IAChD,2EAA2E;IAC3E,kEAAkE;IAClE,oFAAoF;IACpF,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;QAC1B,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtC,OAAQ,CAA6B,CAAC,UAAU,IAAI,WAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,WAAW,CAAC;QACpB,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IACL,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAEzD,MAAM,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,oDAAoD;aAC7D;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CACjE,IAAI,EACJ,UAAU,EACV,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,kBAAkB,EAAE,CACjE,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,YAAY,GAAG,CAAC,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EACN,gFAAgF;iBACjF;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE;gBACN,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,uBAAuB;aACjD;SACD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACtC,IAAI,EACJ,IAAI,EACJ,UAAU,EACV,MAAM,EACN,KAAK,CACL,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO;QACR,CAAC;QAED,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE;oBACN,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,0DAA0D;iBACnE;aACD,CAAC,CAAC;YACH,OAAO;QACR,CAAC;IACF,CAAC;IAED,oDAAoD;IACpD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB,EAAE,IAAgB;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,YAAY,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;IACpC,MAAM,KAAK,GAAU,QAAQ,EAAE,YAAY;QAC1C,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC;IAEZ,GAAG,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACxE,KAAK;QACL,QAAQ;KACR,CAAC,CAAC;IACH,MAAM,IAAI,EAAE,CAAC;AACd,CAAC;AAED,gHAAgH;AAChH,SAAS,UAAU,CAAC,GAAkB,EAAE,KAAsB;IAC7D,OAAO,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,WAAW,IAAI,KAAK;QACpB,UAAU,IAAI,KAAK,CACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAkB;IACpD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,QAAQ,EAAE,YAAY;QAC5B,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC7B,IAAiB,EACjB,UAAoB,EACpB,KAKC;IAMD,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC;YACJ,IAAI,CAAa,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;gBAChD,MAAM,iBAAiB,GACtB,QAAQ,IAAI,oBAAoB,CAAC,QAAQ,CAAC;oBACzC,CAAC,CAAC,QAAQ,CAAC,iBAAiB;oBAC5B,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,iBAAiB,EAAE,CAAC;oBACvB,YAAY,EAAE,CAAC;oBACf,CAAC,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC5D,+DAA+D;oBAC/D,gEAAgE;oBAChE,IAAI,CAAC,CAAC,IAAI;wBAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,SAAS;gBACV,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,4DAA4D;gBAC5D,+DAA+D;gBAC/D,oEAAoE;gBACpE,MAAM,UAAU,GACf,YAAY,KAAK,SAAS;oBACzB,CAAC,CAAC,MAAM,IAAI,WAAW;oBACvB,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC;gBAC1B,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,YAAY,EAAE,CAAC;gBACf,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACrB,MAAM,GAAG,CAAC,CAAC;gBACX,MAAM;YACP,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,4BAA4B,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,sEAAsE;YACtE,mEAAmE;YACnE,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACZ,sBAAsB,YAAY,0BAA0B,EAC5D,GAAG,CACH,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAChC,IAAiB,EACjB,IAAqC,EACrC,UAAkB,EAClB,MAAuB,EACvB,KAAY;IAEZ,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACpC,MAAM,CAAC,GAAkB,EAAE,IAAgB;QAC1C,OAAO,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;CACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/warden",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Warden — Authentication & authorization for the Ream framework",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,7 @@
     }
   },
   "peerDependencies": {
-    "@c9up/ream": "^0.1.0"
+    "@c9up/ream": "^0.1.10"
   },
   "peerDependenciesMeta": {
     "@c9up/ream": {

package/src/middleware.ts

@@ -26,6 +26,7 @@ import type { BasePolicy } from "./bouncer/BasePolicy.js";
 import { Bouncer } from "./bouncer/Bouncer.js";
 import type { Ability } from "./bouncer/types.js";
 import type { ScopeRequestContext } from "./config.js";
+import { WardenError } from "./errors.js";
 import {
 	getGuardMetadata,
 	getPermissionMetadata,
@@ -48,32 +49,107 @@ function hasVerifyWithContext(
 	);
 }
 
+/**
+ * Tokens warden resolves from the container: a service class, or a string/symbol
+ * alias (`"bouncer:registry"`). Mirrors Ream's `ServiceToken` without importing
+ * it — warden declares the shape so it stays framework-agnostic.
+ */
+type ResolvableToken =
+	| string
+	| symbol
+	| (abstract new (...args: never[]) => unknown);
+
+/**
+ * Per-request IoC resolver Ream exposes as `ctx.containerResolver` (Adonis
+ * idiom). Warden resolves AuthManager / RightsResolver / the bouncer registry
+ * through this — reading from the context it is HANDED — so the package never
+ * imports `@c9up/ream` at runtime. A host that provides none (non-Ream, or a
+ * misconfigured kernel) yields no resolution: guarded routes fail CLOSED.
+ */
+interface ContainerResolver {
+	make(token: ResolvableToken): unknown;
+}
+
+/**
+ * Agnostic authorization slot — structurally Ream's `Authorizer` interface (and
+ * Adonis's bouncer contract): `allows` / `denies` / `authorize`. Typed as the
+ * interface, NOT the concrete `Bouncer`, so a real Ream `HttpContext` — whose
+ * `bouncer` is this same agnostic shape — is assignable to `WardenContext`
+ * without warden importing `@c9up/ream`. `initializeBouncer` fills the slot with
+ * a concrete `Bouncer`, which satisfies this contract.
+ */
+interface Authorizer {
+	allows(ability: string, ...args: unknown[]): Promise<boolean>;
+	denies(ability: string, ...args: unknown[]): Promise<boolean>;
+	authorize(ability: string, ...args: unknown[]): Promise<void>;
+}
+
 export interface WardenContext {
 	request: {
-		method: string;
-		url: string;
-		headers: Record<string, string>;
+		/** Ream's `HttpContext` exposes headers as a METHOD, not a property. */
+		headers(): Record<string, string>;
 	};
+	/**
+	 * Per-request IoC resolver (Ream's `ctx.containerResolver`). Warden resolves
+	 * AuthManager + the bouncer registry through it — agnostic, no `@c9up/ream`
+	 * import. Absent on a non-Ream host → guarded routes fail closed.
+	 */
+	containerResolver?: ContainerResolver;
 	response: {
-		status: (code: number) => void;
+		status: (code: number) => unknown;
 		json: (data: unknown) => void;
 	};
-	container: {
-		resolve: (
-			key: string | symbol | (abstract new (...args: never[]) => unknown),
-		) => unknown;
-	};
-	/** Session store — set by a session middleware upstream. */
-	session?: SessionStore;
-	/** Set by the middleware after successful auth. */
-	auth?: AuthResult;
-	/** Set by `initializeBouncer` — the per-request authorization entry point. */
-	bouncer?: Bouncer;
-	/** The route handler metadata (decorators). */
+	/**
+	 * Matched-route info — Ream (like Adonis) exposes the controller class +
+	 * method under `ctx.route` (`ctx.route.controller` / `ctx.route.action`),
+	 * NOT top-level. This is the primary source the guard-metadata lookup reads.
+	 * Absent for inline-function routes. (context7 `/adonisjs/v7-docs`: "access
+	 * the currently matched route via `ctx.route`".)
+	 */
 	route?: {
 		controller?: object;
 		action?: string | symbol;
 	};
+	/**
+	 * Top-level controller/action — kept only as a FALLBACK for hosts that
+	 * expose them flat. Ream uses `ctx.route` (above); the lookup prefers it.
+	 */
+	controller?: object;
+	action?: string | symbol;
+	/** Session store — set by a session middleware upstream. */
+	session?: SessionStore;
+	/** Set by the middleware after successful auth (Ream's `auth` slot). */
+	auth?: AuthResult;
+	/**
+	 * Per-request authorization entry point — set by `initializeBouncer`. Typed
+	 * as the agnostic {@link Authorizer} contract (Ream's `ctx.bouncer` slot),
+	 * filled with a concrete `Bouncer` at runtime.
+	 */
+	bouncer?: Authorizer;
+}
+
+/**
+ * Resolve a token from the request's IoC resolver (`ctx.containerResolver`,
+ * Adonis idiom). Returns undefined when no resolver is present or the token is
+ * unbound — callers decide fail-open (the bouncer registry) vs fail-closed (the
+ * AuthManager gate in `wardenMiddleware`). No `@c9up/ream` import: warden reads
+ * only from the context Ream hands it.
+ */
+function resolveFromCtx(ctx: WardenContext, token: ResolvableToken): unknown {
+	try {
+		return ctx.containerResolver?.make(token);
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Bridge Ream's ctx to the `resolveScope` hook's `ScopeRequestContext`, which
+ * takes headers as a plain object (a snapshot) — keeps the app-facing hook
+ * contract stable while warden reads Ream's `headers()` method internally.
+ */
+function toScopeContext(ctx: WardenContext): ScopeRequestContext {
+	return { request: { headers: ctx.request.headers() }, auth: ctx.auth };
 }
 
 type WardenNext = () => Promise<void> | void;
@@ -84,11 +160,25 @@ type WardenNext = () => Promise<void> | void;
  * and authenticates + authorizes the request.
  */
 export async function wardenMiddleware(ctx: WardenContext, next: WardenNext) {
-	const auth = ctx.container.resolve(AuthManager) as AuthManager;
+	const resolvedAuth = resolveFromCtx(ctx, AuthManager);
+	if (!(resolvedAuth instanceof AuthManager)) {
+		// Fail CLOSED — a missing AuthManager (WardenProvider not registered, or
+		// no `ctx.containerResolver` on a non-Ream host) must never silently let
+		// a guarded request through.
+		throw new WardenError(
+			"AUTH_NOT_REGISTERED",
+			"AuthManager is not registered in the container — add WardenProvider to your providers list.",
+		);
+	}
+	const auth = resolvedAuth;
 
 	// Read guard metadata from the route handler (if declared via decorators).
-	const controller = ctx.route?.controller;
-	const action = ctx.route?.action;
+	// Ream (like Adonis) exposes the controller/method under `ctx.route`; fall
+	// back to top-level only for hosts that expose them flat. Reading the wrong
+	// place silently yields `[]` guards → guarded routes treated as public
+	// (fail-open) — the exact bug this precedence prevents.
+	const controller = ctx.route?.controller ?? ctx.controller;
+	const action = ctx.route?.action ?? ctx.action;
 	const strategies =
 		controller && action ? getGuardMetadata(controller, action) : [];
 
@@ -103,7 +193,8 @@ export async function wardenMiddleware(ctx: WardenContext, next: WardenNext) {
 	// 2. API key header — reads the header name from the ApiKeyStrategy config
 	//    (defaults to 'x-api-key' if no ApiKeyStrategy is registered)
 	// 3. Cookie/session (Session strategy — handled by the strategy itself via context)
-	const authHeader = ctx.request.headers.authorization ?? "";
+	const headers = ctx.request.headers();
+	const authHeader = headers.authorization ?? "";
 	const bearerToken = authHeader.startsWith("Bearer ")
 		? authHeader.slice(7)
 		: "";
@@ -120,7 +211,7 @@ export async function wardenMiddleware(ctx: WardenContext, next: WardenNext) {
 	// declared with `headerName: "X-Custom-Key"` would never match the
 	// incoming `x-custom-key` key without this normalisation — auth
 	// would silently fail even with the right header on the wire.
-	const apiKey = ctx.request.headers[apiKeyHeader.toLowerCase()] ?? "";
+	const apiKey = headers[apiKeyHeader.toLowerCase()] ?? "";
 
 	const hasSessionStrategy = strategies.some((s) => s === "session");
 	if (!bearerToken && !apiKey && !hasSessionStrategy) {
@@ -240,7 +331,7 @@ export async function initializeBouncer(ctx: WardenContext, next: WardenNext) {
 
 	const user = ctx.auth?.user ?? null;
 	const scope: Scope = registry?.resolveScope
-		? await registry.resolveScope(ctx)
+		? await registry.resolveScope(toScopeContext(ctx))
 		: "global";
 
 	ctx.bouncer = new Bouncer(user, registry?.abilities, registry?.policies, {
@@ -250,16 +341,9 @@ export async function initializeBouncer(ctx: WardenContext, next: WardenNext) {
 	await next();
 }
 
-/** Resolve a container token, returning undefined instead of throwing when absent. */
-function tryResolve(
-	ctx: WardenContext,
-	token: string | (abstract new (...args: never[]) => unknown),
-): unknown {
-	try {
-		return ctx.container.resolve(token);
-	} catch {
-		return undefined;
-	}
+/** Resolve a container token from the request resolver, returning undefined instead of throwing when absent. */
+function tryResolve(ctx: WardenContext, token: ResolvableToken): unknown {
+	return resolveFromCtx(ctx, token);
 }
 
 /** Structural guard — the registry is a plain object carrying ability/policy tables. */
@@ -281,7 +365,9 @@ function isBouncerRegistry(value: unknown): value is BouncerRegistry {
 async function resolveRequestScope(ctx: WardenContext): Promise<Scope> {
 	const candidate = tryResolve(ctx, "bouncer:registry");
 	const registry = isBouncerRegistry(candidate) ? candidate : undefined;
-	return registry?.resolveScope ? await registry.resolveScope(ctx) : "global";
+	return registry?.resolveScope
+		? await registry.resolveScope(toScopeContext(ctx))
+		: "global";
 }
 
 /**
@@ -390,3 +476,16 @@ async function checkAuthorization(
 	}
 	return null;
 }
+
+/**
+ * Default export — the Adonis-style class form Ream's lazy middleware resolver
+ * expects (`new mod.default().handle(ctx, next)`). Without it the documented
+ * `router.use([() => import('@c9up/warden/middleware')])` crashes with
+ * `new undefined()`. The named `wardenMiddleware` / `initializeBouncer` stay for
+ * direct registration `router.use([wardenMiddleware])`.
+ */
+export default class WardenMiddleware {
+	handle(ctx: WardenContext, next: WardenNext): Promise<void> {
+		return wardenMiddleware(ctx, next);
+	}
+}