@cauthyhq/node 0.0.0 → 1.1.0

package/dist/express.d.mts

@@ -0,0 +1,25 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
+import './keys-D5k0omTb.mjs';
+import 'jose';
+import './theme.mjs';
+
+declare global {
+    namespace Express {
+        interface Request {
+            /** Who is signed in, or null. Asked once per request. */
+            cauthy(): Promise<Session | null>;
+        }
+    }
+}
+type Next = (error?: unknown) => void;
+/**
+ * Serves the routes under the handler's `basePath` (and, by contract, the
+ * application's published key), and gives every other
+ * request `req.cauthy()`. Mount it once, before the routes that use it.
+ */
+declare function cauthyExpress(auth: Cauthy): (req: IncomingMessage, res: ServerResponse, next: Next) => void;
+/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */
+declare function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void;
+
+export { cauthyExpress, requireSession };

package/dist/express.d.ts

@@ -0,0 +1,25 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
+import './keys-D5k0omTb.js';
+import 'jose';
+import './theme.js';
+
+declare global {
+    namespace Express {
+        interface Request {
+            /** Who is signed in, or null. Asked once per request. */
+            cauthy(): Promise<Session | null>;
+        }
+    }
+}
+type Next = (error?: unknown) => void;
+/**
+ * Serves the routes under the handler's `basePath` (and, by contract, the
+ * application's published key), and gives every other
+ * request `req.cauthy()`. Mount it once, before the routes that use it.
+ */
+declare function cauthyExpress(auth: Cauthy): (req: IncomingMessage, res: ServerResponse, next: Next) => void;
+/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */
+declare function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void;
+
+export { cauthyExpress, requireSession };

package/dist/express.js

@@ -0,0 +1,103 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/express.ts
+var express_exports = {};
+__export(express_exports, {
+  cauthyExpress: () => cauthyExpress,
+  requireSession: () => requireSession
+});
+module.exports = __toCommonJS(express_exports);
+function originOf(req) {
+  const secure = req.socket?.encrypted === true;
+  return `${req.protocol ?? (secure ? "https" : "http")}://${req.headers.host ?? "localhost"}`;
+}
+async function bodyOf(req) {
+  if (req.method === "GET" || req.method === "HEAD") return void 0;
+  if (req.body !== void 0 && req.body !== null) {
+    if (typeof req.body === "string") return req.body;
+    if (req.body instanceof Uint8Array) return new Uint8Array(req.body);
+    return JSON.stringify(req.body);
+  }
+  const chunks = [];
+  for await (const chunk of req) chunks.push(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+  return chunks.length === 0 ? void 0 : new Blob(chunks);
+}
+async function toWebRequest(req, withBody) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  if (typeof req.ip === "string" && req.ip !== "") headers.set("x-forwarded-for", req.ip);
+  return new Request(new URL(req.originalUrl ?? req.url ?? "/", originOf(req)), {
+    method: req.method,
+    headers,
+    body: withBody ? await bodyOf(req) : void 0
+  });
+}
+function addCookies(res, cookies) {
+  if (cookies.length === 0 || res.headersSent) return;
+  const had = res.getHeader("set-cookie");
+  res.setHeader("set-cookie", [...Array.isArray(had) ? had : typeof had === "string" ? [had] : [], ...cookies]);
+}
+function cauthyExpress(auth) {
+  const base = auth.options.basePath;
+  const key = auth.pact?.contract.jwksPath;
+  return function cauthy(req, res, next) {
+    const request = req;
+    const path = (request.originalUrl ?? request.url ?? "/").split("?")[0];
+    if (path === base || path.startsWith(`${base}/`) || path === key) {
+      void (async () => {
+        const answer = await auth.handler(await toWebRequest(request, true));
+        res.statusCode = answer.status;
+        answer.headers.forEach((value, name) => {
+          if (name !== "set-cookie") res.setHeader(name, value);
+        });
+        addCookies(res, answer.headers.getSetCookie());
+        res.end(answer.body === null ? void 0 : Buffer.from(await answer.arrayBuffer()));
+      })().catch(next);
+      return;
+    }
+    let asked;
+    request.cauthy = () => asked ??= (async () => {
+      const resolved = await auth.resolve(await toWebRequest(request, false));
+      addCookies(res, resolved.cookies);
+      return resolved.session;
+    })();
+    next();
+  };
+}
+function requireSession(req, res, next) {
+  const ask = req.cauthy;
+  if (!ask) return next(new Error("@cauthyhq/node: mount cauthyExpress(auth) before requireSession"));
+  ask().then((session) => {
+    if (session !== null) return next();
+    res.statusCode = 401;
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader("x-cauthy-session", "none");
+    res.end(JSON.stringify({ error: "unauthenticated" }));
+  }, next);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cauthyExpress,
+  requireSession
+});
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`) || path === key) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAOO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK;AAChE,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}

package/dist/express.mjs

@@ -0,0 +1,77 @@
+// src/express.ts
+function originOf(req) {
+  const secure = req.socket?.encrypted === true;
+  return `${req.protocol ?? (secure ? "https" : "http")}://${req.headers.host ?? "localhost"}`;
+}
+async function bodyOf(req) {
+  if (req.method === "GET" || req.method === "HEAD") return void 0;
+  if (req.body !== void 0 && req.body !== null) {
+    if (typeof req.body === "string") return req.body;
+    if (req.body instanceof Uint8Array) return new Uint8Array(req.body);
+    return JSON.stringify(req.body);
+  }
+  const chunks = [];
+  for await (const chunk of req) chunks.push(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+  return chunks.length === 0 ? void 0 : new Blob(chunks);
+}
+async function toWebRequest(req, withBody) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  if (typeof req.ip === "string" && req.ip !== "") headers.set("x-forwarded-for", req.ip);
+  return new Request(new URL(req.originalUrl ?? req.url ?? "/", originOf(req)), {
+    method: req.method,
+    headers,
+    body: withBody ? await bodyOf(req) : void 0
+  });
+}
+function addCookies(res, cookies) {
+  if (cookies.length === 0 || res.headersSent) return;
+  const had = res.getHeader("set-cookie");
+  res.setHeader("set-cookie", [...Array.isArray(had) ? had : typeof had === "string" ? [had] : [], ...cookies]);
+}
+function cauthyExpress(auth) {
+  const base = auth.options.basePath;
+  const key = auth.pact?.contract.jwksPath;
+  return function cauthy(req, res, next) {
+    const request = req;
+    const path = (request.originalUrl ?? request.url ?? "/").split("?")[0];
+    if (path === base || path.startsWith(`${base}/`) || path === key) {
+      void (async () => {
+        const answer = await auth.handler(await toWebRequest(request, true));
+        res.statusCode = answer.status;
+        answer.headers.forEach((value, name) => {
+          if (name !== "set-cookie") res.setHeader(name, value);
+        });
+        addCookies(res, answer.headers.getSetCookie());
+        res.end(answer.body === null ? void 0 : Buffer.from(await answer.arrayBuffer()));
+      })().catch(next);
+      return;
+    }
+    let asked;
+    request.cauthy = () => asked ??= (async () => {
+      const resolved = await auth.resolve(await toWebRequest(request, false));
+      addCookies(res, resolved.cookies);
+      return resolved.session;
+    })();
+    next();
+  };
+}
+function requireSession(req, res, next) {
+  const ask = req.cauthy;
+  if (!ask) return next(new Error("@cauthyhq/node: mount cauthyExpress(auth) before requireSession"));
+  ask().then((session) => {
+    if (session !== null) return next();
+    res.statusCode = 401;
+    res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader("x-cauthy-session", "none");
+    res.end(JSON.stringify({ error: "unauthenticated" }));
+  }, next);
+}
+export {
+  cauthyExpress,
+  requireSession
+};
+//# sourceMappingURL=express.mjs.map

package/dist/express.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`) || path === key) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAOO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK;AAChE,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}

package/dist/fastify.d.mts

@@ -0,0 +1,38 @@
+import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
+import './keys-D5k0omTb.mjs';
+import 'jose';
+import './theme.mjs';
+
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Who is signed in, or null. Asked once per request. */
+        cauthy(): Promise<Session | null>;
+    }
+    interface FastifyInstance {
+        /** A preHandler that answers 401 unless somebody is signed in. */
+        requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+    }
+}
+interface CauthyFastifyOptions {
+    auth: Cauthy;
+    /**
+     * Check, when Fastify is ready, that this plugin is what answers under
+     * basePath (`checkFastifyMount`), and fail startup when another route
+     * does. Default: true.
+     */
+    checkMount?: boolean;
+}
+declare const plugin: FastifyPluginAsync<CauthyFastifyOptions>;
+/**
+ * Checks that the plugin is what answers under basePath, in process, once
+ * Fastify is ready (the plugin already does it by itself at `onReady`; this
+ * is for tests and for `checkMount: false`):
+ *
+ *   await app.ready()
+ *   await checkFastifyMount(app, auth)
+ */
+declare function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void>;
+declare const cauthyFastify: FastifyPluginAsync<CauthyFastifyOptions>;
+
+export { type CauthyFastifyOptions, cauthyFastify, checkFastifyMount, plugin as default };

package/dist/fastify.d.ts

@@ -0,0 +1,38 @@
+import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
+import './keys-D5k0omTb.js';
+import 'jose';
+import './theme.js';
+
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Who is signed in, or null. Asked once per request. */
+        cauthy(): Promise<Session | null>;
+    }
+    interface FastifyInstance {
+        /** A preHandler that answers 401 unless somebody is signed in. */
+        requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+    }
+}
+interface CauthyFastifyOptions {
+    auth: Cauthy;
+    /**
+     * Check, when Fastify is ready, that this plugin is what answers under
+     * basePath (`checkFastifyMount`), and fail startup when another route
+     * does. Default: true.
+     */
+    checkMount?: boolean;
+}
+declare const plugin: FastifyPluginAsync<CauthyFastifyOptions>;
+/**
+ * Checks that the plugin is what answers under basePath, in process, once
+ * Fastify is ready (the plugin already does it by itself at `onReady`; this
+ * is for tests and for `checkMount: false`):
+ *
+ *   await app.ready()
+ *   await checkFastifyMount(app, auth)
+ */
+declare function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void>;
+declare const cauthyFastify: FastifyPluginAsync<CauthyFastifyOptions>;
+
+export { type CauthyFastifyOptions, cauthyFastify, checkFastifyMount, plugin as default };

package/dist/fastify.js

@@ -0,0 +1,105 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/fastify.ts
+var fastify_exports = {};
+__export(fastify_exports, {
+  cauthyFastify: () => cauthyFastify,
+  checkFastifyMount: () => checkFastifyMount,
+  default: () => fastify_default
+});
+module.exports = __toCommonJS(fastify_exports);
+var import_node_http = require("http");
+function originOf(req) {
+  return `${req.protocol}://${req.headers.host ?? "localhost"}`;
+}
+function toWebRequest(req) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  headers.set("x-forwarded-for", req.ip);
+  const body = req.method === "GET" || req.method === "HEAD" || req.body === void 0 || req.body === null ? void 0 : typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body });
+}
+var kSession = /* @__PURE__ */ Symbol("cauthy.session");
+var kReply = /* @__PURE__ */ Symbol("cauthy.reply");
+var plugin = async (app, { auth, checkMount = true }) => {
+  const base = auth.options.basePath;
+  app.decorateRequest("cauthy", async function() {
+    const self = this;
+    self[kSession] ??= (async () => {
+      const resolved = await auth.resolve(toWebRequest(this));
+      const reply = this[kReply];
+      if (resolved.cookies.length > 0 && reply) reply.header("set-cookie", resolved.cookies);
+      return resolved.session;
+    })();
+    return self[kSession];
+  });
+  app.addHook("onRequest", async (req, reply) => {
+    ;
+    req[kReply] = reply;
+  });
+  app.decorate("requireSession", async function(request, reply) {
+    if (await request.cauthy() === null) {
+      await reply.code(401).header("x-cauthy-session", "none").send({ error: "unauthenticated" });
+    }
+  });
+  const serve = async (req, reply) => {
+    const res = await auth.handler(toWebRequest(req));
+    reply.code(res.status);
+    res.headers.forEach((value, name) => {
+      if (name !== "set-cookie") reply.header(name, value);
+    });
+    const cookies = res.headers.getSetCookie();
+    if (cookies.length > 0) reply.header("set-cookie", cookies);
+    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
+  };
+  app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
+  const key = auth.pact?.contract.jwksPath;
+  if (key) app.route({ method: ["GET", "HEAD", "POST"], url: key, handler: serve });
+  if (checkMount && process.env.NODE_ENV !== "test") app.addHook("onReady", () => probe(app, auth));
+};
+async function probe(app, auth) {
+  const server = (0, import_node_http.createServer)((req, res) => app.routing(req, res));
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  try {
+    await auth.checkMount(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    server.closeAllConnections();
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
+}
+function checkFastifyMount(app, auth) {
+  return probe(app, auth);
+}
+plugin[/* @__PURE__ */ Symbol.for("skip-override")] = true;
+plugin[/* @__PURE__ */ Symbol.for("fastify.display-name")] = "@cauthyhq/node";
+var cauthyFastify = plugin;
+var fastify_default = plugin;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cauthyFastify,
+  checkFastifyMount
+});
+//# sourceMappingURL=fastify.js.map

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  if (key) app.route({ method: ['GET', 'HEAD', 'POST'], url: key, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,uBAA6B;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,MAAI,IAAK,KAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,QAAQ,MAAM,GAAG,KAAK,KAAK,SAAS,MAAM,CAAC;AAEhF,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,aAAS,+BAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/fastify.mjs

@@ -0,0 +1,79 @@
+// src/fastify.ts
+import { createServer } from "http";
+function originOf(req) {
+  return `${req.protocol}://${req.headers.host ?? "localhost"}`;
+}
+function toWebRequest(req) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  headers.set("x-forwarded-for", req.ip);
+  const body = req.method === "GET" || req.method === "HEAD" || req.body === void 0 || req.body === null ? void 0 : typeof req.body === "string" ? req.body : JSON.stringify(req.body);
+  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body });
+}
+var kSession = /* @__PURE__ */ Symbol("cauthy.session");
+var kReply = /* @__PURE__ */ Symbol("cauthy.reply");
+var plugin = async (app, { auth, checkMount = true }) => {
+  const base = auth.options.basePath;
+  app.decorateRequest("cauthy", async function() {
+    const self = this;
+    self[kSession] ??= (async () => {
+      const resolved = await auth.resolve(toWebRequest(this));
+      const reply = this[kReply];
+      if (resolved.cookies.length > 0 && reply) reply.header("set-cookie", resolved.cookies);
+      return resolved.session;
+    })();
+    return self[kSession];
+  });
+  app.addHook("onRequest", async (req, reply) => {
+    ;
+    req[kReply] = reply;
+  });
+  app.decorate("requireSession", async function(request, reply) {
+    if (await request.cauthy() === null) {
+      await reply.code(401).header("x-cauthy-session", "none").send({ error: "unauthenticated" });
+    }
+  });
+  const serve = async (req, reply) => {
+    const res = await auth.handler(toWebRequest(req));
+    reply.code(res.status);
+    res.headers.forEach((value, name) => {
+      if (name !== "set-cookie") reply.header(name, value);
+    });
+    const cookies = res.headers.getSetCookie();
+    if (cookies.length > 0) reply.header("set-cookie", cookies);
+    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
+  };
+  app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
+  const key = auth.pact?.contract.jwksPath;
+  if (key) app.route({ method: ["GET", "HEAD", "POST"], url: key, handler: serve });
+  if (checkMount && process.env.NODE_ENV !== "test") app.addHook("onReady", () => probe(app, auth));
+};
+async function probe(app, auth) {
+  const server = createServer((req, res) => app.routing(req, res));
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  try {
+    await auth.checkMount(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    server.closeAllConnections();
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
+}
+function checkFastifyMount(app, auth) {
+  return probe(app, auth);
+}
+plugin[/* @__PURE__ */ Symbol.for("skip-override")] = true;
+plugin[/* @__PURE__ */ Symbol.for("fastify.display-name")] = "@cauthyhq/node";
+var cauthyFastify = plugin;
+var fastify_default = plugin;
+export {
+  cauthyFastify,
+  checkFastifyMount,
+  fastify_default as default
+};
+//# sourceMappingURL=fastify.mjs.map

package/dist/fastify.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  if (key) app.route({ method: ['GET', 'HEAD', 'POST'], url: key, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";AAeA,SAAS,oBAAoB;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,MAAI,IAAK,KAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,QAAQ,MAAM,GAAG,KAAK,KAAK,SAAS,MAAM,CAAC;AAEhF,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/hono.d.mts

@@ -0,0 +1,24 @@
+import { MiddlewareHandler } from 'hono';
+import { S as Session, C as Cauthy } from './cauthy-Bn-i7cKD.mjs';
+import './keys-D5k0omTb.mjs';
+import 'jose';
+import './theme.mjs';
+
+/** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */
+interface CauthyVariables {
+    /** Who is signed in, or null. */
+    session: Session | null;
+}
+type Env = {
+    Variables: CauthyVariables;
+};
+/**
+ * Serves the routes under the handler's `basePath` (and, by contract, the
+ * application's published key), and sets `session` for
+ * every other request. Mount it once, before the routes that use it.
+ */
+declare function cauthyHono(auth: Cauthy): MiddlewareHandler<Env>;
+/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyHono` mounted before it. */
+declare const requireSession: MiddlewareHandler<Env>;
+
+export { type CauthyVariables, cauthyHono, requireSession };

package/dist/hono.d.ts

@@ -0,0 +1,24 @@
+import { MiddlewareHandler } from 'hono';
+import { S as Session, C as Cauthy } from './cauthy-Wy-YDGrM.js';
+import './keys-D5k0omTb.js';
+import 'jose';
+import './theme.js';
+
+/** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */
+interface CauthyVariables {
+    /** Who is signed in, or null. */
+    session: Session | null;
+}
+type Env = {
+    Variables: CauthyVariables;
+};
+/**
+ * Serves the routes under the handler's `basePath` (and, by contract, the
+ * application's published key), and sets `session` for
+ * every other request. Mount it once, before the routes that use it.
+ */
+declare function cauthyHono(auth: Cauthy): MiddlewareHandler<Env>;
+/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyHono` mounted before it. */
+declare const requireSession: MiddlewareHandler<Env>;
+
+export { type CauthyVariables, cauthyHono, requireSession };