@cauthyhq/node 1.2.0 → 1.3.0

package/dist/{cauthy-C7gZ-pbv.d.ts → cauthy-DHLBEuqP.d.ts}

@@ -1,95 +1,5 @@
-import { K as KeyStore, P as PactKeys } from './keys-D5k0omTb.js';
 import { JWTVerifyGetKey, JWK } from 'jose';
 import { CauthyTheme } from './theme.js';
-import { I as Identity } from './identity-BTJ8NB_w.js';
-
-/** What createCauthy is given to run by contract. */
-interface ContractOptions {
-    /** The context graph, as `cauthy contracts pull` writes it (contracts/graph.json). */
-    graph: unknown;
-    /** This application's system in the graph: `"acme-crm"`. */
-    system: string;
-    /** The link to read, when the system has more than one with Cauthy. */
-    link?: string;
-    /** Cauthy's system in the graph. Default: `"cauthy"`. */
-    provider?: string;
-}
-/** What an application reads of its contract. */
-interface ResolvedContract {
-    system: string;
-    link: string;
-    /** Cauthy's public address. */
-    issuer: string;
-    /** The workspace's id, and its slug (what the application's own screens send). */
-    tenantId: string;
-    tenant: string;
-    /** The public client people sign in with: `pact.<link>`. */
-    clientId: string;
-    /** Where people may return after signing in. */
-    redirectUris: string[];
-    /** Whether Cauthy asks the system's proof on the code exchange now (`systemProof` is `required`). */
-    requireSystemProof: boolean;
-    /** How the link asks for the proof: never, from the first proved sign-in on (`auto`), or always. */
-    systemProof: 'off' | 'auto' | 'required';
-    /** Whether Cauthy issues no token through this link before the address is confirmed. */
-    requireVerifiedEmail: boolean;
-    /** Whether the link lets its people ask to stay signed in. */
-    persistentSessions: boolean;
-    /** The system's own client, when the link gives it one: `pact.<link>.service`. */
-    serviceClientId?: string;
-    /** Where the system publishes its keys, and the path of that address. */
-    jwksUrl?: string;
-    jwksPath?: string;
-    /** Where the system receives Cauthy's events, when it says. */
-    eventsUrl?: string;
-}
-/**
- * The variables of the standard mode. With a contract none may be set: two
- * sources of the same thing, one silently winning, is how a system ends up
- * signing people in through a client nobody meant.
- */
-declare const STANDARD_VARIABLES: readonly ["CAUTHY_ISSUER", "CAUTHY_CLIENT_ID", "CAUTHY_CLIENT_SECRET", "CAUTHY_SECRET", "CAUTHY_SYSTEM", "CAUTHY_TENANT", "CAUTHY_SYSTEM_KEY", "CAUTHY_SYSTEM_KEY_ID"];
-/** Refuses to run by contract with a variable of the standard mode set: names it. */
-declare function failClosed(environment: Record<string, string | undefined> | undefined): void;
-/** Reads what the graph says of the system's link with Cauthy. */
-declare function readContract(options: ContractOptions): ResolvedContract;
-/** One difference between a contract and what Cauthy holds. */
-interface PactItem {
-    kind: 'client' | 'redirect_uri' | 'grant_type' | 'role' | 'organization' | 'require_system_proof' | 'persistent_sessions' | 'jwks_url';
-    client_id?: string;
-    value: string;
-    detail?: string;
-}
-/** How the system stands against its contract, as Cauthy checks it (GET /v1/pact/status). Moments are UTC. */
-interface PactStatus {
-    system: string;
-    tenant_id: string;
-    checked_at: string;
-    /** When Cauthy's daily reconciliation last checked it; null before the first. */
-    reconciled_at: string | null;
-    in_step: boolean;
-    /** In Cauthy, and the contract does not name it. Nothing is ever deleted for it. */
-    outside: PactItem[];
-    /** Named by the contract, and Cauthy does not hold it as it says. */
-    missing: PactItem[];
-    contract: {
-        clients: {
-            client_id: string;
-            link: string;
-            purpose: 'sign_in' | 'service';
-            redirect_uris?: string[];
-            grant_types: string[];
-            require_system_proof?: boolean;
-            jwks_url?: string;
-        }[];
-        roles?: Record<string, string[]>;
-    };
-    held: {
-        clients: Record<string, unknown>[];
-        roles: string[];
-        organizations: Record<string, number>;
-    };
-}
 
 /** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */
 interface CauthyEvent {
@@ -157,7 +67,7 @@ interface CauthyOptions {
      * `CAUTHY_KEY`. With it nothing else is read: the workspace, the system and
      * the application's addresses come from Cauthy (`GET /v1/connect/self`),
      * and passing `issuer`, `clientId`, `clientSecret`, `secret`, `system`,
-     * `tenant`, `audience`, `tenantId`, `systemKey` or `rootKey` is refused.
+     * `tenant`, `audience`, `tenantId` or `systemKey` is refused.
      */
     key?: string;
     /** The key being replaced, during a rotation: read, never written with. Default: `CAUTHY_KEY_PREVIOUS`. */
@@ -203,8 +113,8 @@ interface CauthyOptions {
      */
     audience?: string;
     /**
-     * The workspace's id (a lowercase UUID) for `auth.verifyToken`. By contract
-     * it comes from the link's `tenant_id`; otherwise: this, or `CAUTHY_TENANT_ID`.
+     * The workspace's id (a lowercase UUID) for `auth.verifyToken`. On
+     * CAUTHY_KEY it is Cauthy's answer; otherwise: this, or `CAUTHY_TENANT_ID`.
      */
     tenantId?: string;
     /**
@@ -268,23 +178,18 @@ interface CauthyOptions {
         request?: number;
     };
     /**
-     * Run by contract: the issuer, the workspace, the clients and where the
-     * application's keys are published all come from its link in the network's
-     * context graph, and none of the CAUTHY_* variables may be set. See
-     * "Connect a system by contract".
-     *
-     *   createCauthy({ contract: { graph, system: 'acme-crm' }, keys: postgresKeyStore(query) })
-     */
-    contract?: ContractOptions;
-    /** Where the application keeps its own key, with a contract (@cauthyhq/node/keys). */
-    keys?: KeyStore;
-    /**
-     * The one secret of a contracted application: every key it needs is
-     * derived from it. 32 random bytes or more. Default: `PACT_ROOT_KEY`.
+     * Removed in 1.3: contracts are retired. Given, `createCauthy` refuses to
+     * start (as it does with `PACT_ROOT_KEY` or `PACT_ROOT_KEY_PREVIOUS` set):
+     * run on CAUTHY_KEY alone, and protect sign-in with the "Protect sign-in"
+     * switches on the application's card in Cauthy's dashboard.
      */
-    rootKey?: string;
-    /** The root key before the current one, while rotating it. Default: `PACT_ROOT_KEY_PREVIOUS`. */
-    rootKeyPrevious?: string;
+    contract?: never;
+    /** Removed in 1.3 with contracts: given, `createCauthy` refuses to start. */
+    keys?: never;
+    /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY`): given, `createCauthy` refuses to start. */
+    rootKey?: never;
+    /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY_PREVIOUS`): given, `createCauthy` refuses to start. */
+    rootKeyPrevious?: never;
     /**
      * Where `auth.webhook` remembers the deliveries it took, so one sent twice
      * is refused. Default: this process's memory. Give a shared one (a table)
@@ -411,7 +316,7 @@ declare class CauthyConfigError extends Error {
     constructor(message: string);
 }
 /** Why a CAUTHY_KEY was refused (key/cauthy-key.md §3, §8, §9). */
-type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret' | 'key_contract_issuer' | 'key_previous_mismatch';
+type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret' | 'key_previous_mismatch';
 /** A refused CAUTHY_KEY. The message names the reason, never the key. */
 declare class CauthyKeyError extends CauthyConfigError {
     readonly reason: CauthyKeyReason;
@@ -703,17 +608,10 @@ interface SystemOptions {
      * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.
      */
     acceptInviteUrl?: string;
-    /**
-     * The application's own keys, kept in its database (contract mode): it
-     * signs with the newest and publishes them. Takes the place of `key`.
-     */
-    keys?: PactKeys;
-    /** The client the keys prove: the system's own, beside the sign-in client. */
-    keysClientId?: string;
     /**
      * CAUTHY_KEY's Ed25519 key (key/cauthy-key.md §6) and the client it proves:
-     * every token is asked with an EdDSA assertion. Takes the place of `key`,
-     * `keys` and the secret.
+     * every token is asked with an EdDSA assertion. Takes the place of `key`
+     * and the secret.
      */
     signer?: {
         clientId: string;
@@ -939,8 +837,8 @@ interface VerifyTokenOptions {
     /**
      * The client this backend signs people in through. When set, a person's
      * token issued through another client (an `azp` naming another) is refused
-     * with `wrong_client` (rule R15); a token with no `azp` passes. In contract
-     * mode it is the link's sign-in client. Default: none, and `azp` is not checked.
+     * with `wrong_client` (rule R15); a token with no `azp` passes. Default:
+     * none, and `azp` is not checked.
      */
     clientId?: string;
 }
@@ -988,6 +886,25 @@ declare function createVerifierFromEnv(options?: Omit<VerifyTokenOptions, 'issue
  */
 type MountTarget = string | ((request: Request) => Response | Promise<Response>);
 
+/** What `GET /v1/connect/self` answers. */
+interface Identity {
+    issuer: string;
+    audience: string;
+    tenant: {
+        id: string;
+        slug: string;
+    };
+    system: string;
+    client_id: string;
+    sign_in_client_id: string;
+    app_urls: string[];
+    callback_path: string;
+    key: {
+        kid: string;
+        retires_at: string | null;
+    } | null;
+}
+
 /** What `resolve` answers: who is there, and the cookies that must go back. */
 interface Resolved {
     session: Session | null;
@@ -1071,10 +988,9 @@ interface Cauthy {
     /**
      * Verifies a Cauthy access token (or a request's `Authorization: Bearer`) for
      * an API of this application: `verifyToken` with this instance's issuer, its
-     * workspace (by contract, the link's `tenant_id`; otherwise `tenantId` or
-     * `CAUTHY_TENANT_ID`) and its audience (`audience` or `CAUTHY_AUDIENCE`).
-     * By contract it also refuses a person's token issued through another
-     * client than the link's (`wrong_client`).
+     * workspace (on CAUTHY_KEY, Cauthy's answer; otherwise `tenantId` or
+     * `CAUTHY_TENANT_ID`) and its audience (on CAUTHY_KEY, Cauthy's answer;
+     * otherwise `audience` or `CAUTHY_AUDIENCE`).
      */
     verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>;
     /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */
@@ -1085,11 +1001,6 @@ interface Cauthy {
      * `systemKey`.
      */
     system: CauthySystem;
-    /**
-     * The application's contract, when it runs by one: what its link says,
-     * its own keys, and how it stands against its contract in Cauthy.
-     */
-    pact?: CauthyPact;
     /** What the browser may be told of a session. */
     toPublic(session: Session): Promise<PublicSession>;
     /** Paths of this application that start a sign-in, a sign-out, or open the account page. */
@@ -1101,20 +1012,6 @@ interface Cauthy {
     };
     options: Readonly<Required<Pick<CauthyOptions, 'issuer' | 'clientId' | 'basePath' | 'afterSignIn' | 'afterSignOut' | 'cookieName'>>>;
 }
-/** A contracted application's view of its contract (`auth.pact`). */
-interface CauthyPact {
-    /** What its link in the graph says. */
-    contract: ResolvedContract;
-    /** Its own keys: the one that signs, the ones published, rotating them. */
-    keys: PactKeys;
-    /**
-     * The response for its jwks_url: the published keys. `handler` serves it
-     * at that path too, when the route reaches it.
-     */
-    jwks(): Promise<Response>;
-    /** How it stands against its contract, as Cauthy checks it now. For a health endpoint. */
-    status(): Promise<PactStatus>;
-}
 declare function createCauthy(given?: CauthyOptions): Cauthy;
 
-export { createCauthy as $, type AttributeType as A, type PolicyRole as B, type Cauthy as C, type PublicSession as D, type PushPolicyOptions as E, type Resolved as F, type ResolvedContract as G, type RoleOf as H, STANDARD_VARIABLES as I, type JsonValue as J, type SessionOrganization as K, type SessionStatus as L, type MountTarget as M, type NewMember as N, type Organization as O, type PactItem as P, type SessionUser as Q, type ReplayStore as R, type Session as S, type SystemKey as T, type SystemOptions as U, type SystemPolicy as V, type TokenIdentity as W, type TokenRefusal as X, type VerifyTokenOptions as Y, type VerifyWebhookOptions as Z, can as _, type CatalogResource as a, createSystem as a0, createTokenVerifier as a1, createVerifierFromEnv as a2, definePolicy as a3, failClosed as a4, memoryReplayStore as a5, policySource as a6, pullCatalog as a7, pullPolicy as a8, pushCatalog as a9, pushPolicy as aa, readContract as ab, remoteKeys as ac, verifyToken as ad, verifyWebhook as ae, CauthyApiError as b, CauthyConfigError as c, type CauthyEvent as d, CauthyKeyError as e, type CauthyKeyReason as f, type CauthyOptions as g, type CauthyPact as h, type CauthySystem as i, CauthyTokenError as j, CauthyUnavailableError as k, CauthyWebhookError as l, type CheckOf as m, type CheckQuestion as n, type CheckResult as o, type CheckRule as p, type ConditionalPermission as q, type ContractOptions as r, type OrganizationMember as s, type OrganizationRef as t, type PactStatus as u, type PermissionOf as v, type Permitted as w, type Policy as x, type PolicyDefinition as y, type PolicyPermission as z };
+export { memoryReplayStore as $, type AttributeType as A, type RoleOf as B, type Cauthy as C, type SessionOrganization as D, type SessionStatus as E, type SessionUser as F, type SystemKey as G, type SystemOptions as H, type Identity as I, type JsonValue as J, type SystemPolicy as K, type TokenRefusal as L, type MountTarget as M, type NewMember as N, type Organization as O, type PermissionOf as P, type VerifyWebhookOptions as Q, type ReplayStore as R, type Session as S, type TokenIdentity as T, can as U, type VerifyTokenOptions as V, createCauthy as W, createSystem as X, createTokenVerifier as Y, createVerifierFromEnv as Z, definePolicy as _, type CatalogResource as a, policySource as a0, pullCatalog as a1, pullPolicy as a2, pushCatalog as a3, pushPolicy as a4, remoteKeys as a5, verifyToken as a6, verifyWebhook as a7, CauthyApiError as b, CauthyConfigError as c, type CauthyEvent as d, CauthyKeyError as e, type CauthyKeyReason as f, type CauthyOptions as g, type CauthySystem as h, CauthyTokenError as i, CauthyUnavailableError as j, CauthyWebhookError as k, type CheckOf as l, type CheckQuestion as m, type CheckResult as n, type CheckRule as o, type ConditionalPermission as p, type OrganizationMember as q, type OrganizationRef as r, type Permitted as s, type Policy as t, type PolicyDefinition as u, type PolicyPermission as v, type PolicyRole as w, type PublicSession as x, type PushPolicyOptions as y, type Resolved as z };

package/dist/express.d.mts

@@ -1,9 +1,7 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { S as Session, C as Cauthy } from './cauthy-CCSSj3Lg.mjs';
-import './keys-D5k0omTb.mjs';
+import { S as Session, C as Cauthy } from './cauthy-CsWUgyv_.mjs';
 import 'jose';
 import './theme.mjs';
-import './identity-BTJ8NB_w.mjs';
 
 declare global {
     namespace Express {
@@ -15,8 +13,7 @@ declare global {
 }
 type Next = (error?: unknown) => void;
 /**
- * Serves the routes under the handler's `basePath` (and, by contract, the
- * application's published key), and gives every other
+ * Serves the routes under the handler's `basePath`, and gives every other
  * request `req.cauthy()`. Mount it once, before the routes that use it.
  */
 declare function cauthyExpress(auth: Cauthy): (req: IncomingMessage, res: ServerResponse, next: Next) => void;

package/dist/express.d.ts

@@ -1,9 +1,7 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { S as Session, C as Cauthy } from './cauthy-C7gZ-pbv.js';
-import './keys-D5k0omTb.js';
+import { S as Session, C as Cauthy } from './cauthy-DHLBEuqP.js';
 import 'jose';
 import './theme.js';
-import './identity-BTJ8NB_w.js';
 
 declare global {
     namespace Express {
@@ -15,8 +13,7 @@ declare global {
 }
 type Next = (error?: unknown) => void;
 /**
- * Serves the routes under the handler's `basePath` (and, by contract, the
- * application's published key), and gives every other
+ * Serves the routes under the handler's `basePath`, and gives every other
  * request `req.cauthy()`. Mount it once, before the routes that use it.
  */
 declare function cauthyExpress(auth: Cauthy): (req: IncomingMessage, res: ServerResponse, next: Next) => void;

package/dist/express.js

@@ -59,11 +59,10 @@ function addCookies(res, cookies) {
 }
 function cauthyExpress(auth) {
   const base = auth.options.basePath;
-  const key = auth.pact?.contract.jwksPath;
   return function cauthy(req, res, next) {
     const request = req;
     const path = (request.originalUrl ?? request.url ?? "/").split("?")[0];
-    if (path === base || path.startsWith(`${base}/`) || path === key) {
+    if (path === base || path.startsWith(`${base}/`)) {
       void (async () => {
         const answer = await auth.handler(await toWebRequest(request, true));
         res.statusCode = answer.status;

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`) || path === key) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAOO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK;AAChE,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath`, and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`)) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAMO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,GAAG;AAChD,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}

package/dist/express.mjs

@@ -34,11 +34,10 @@ function addCookies(res, cookies) {
 }
 function cauthyExpress(auth) {
   const base = auth.options.basePath;
-  const key = auth.pact?.contract.jwksPath;
   return function cauthy(req, res, next) {
     const request = req;
     const path = (request.originalUrl ?? request.url ?? "/").split("?")[0];
-    if (path === base || path.startsWith(`${base}/`) || path === key) {
+    if (path === base || path.startsWith(`${base}/`)) {
       void (async () => {
         const answer = await auth.handler(await toWebRequest(request, true));
         res.statusCode = answer.status;

package/dist/express.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath` (and, by contract, the\n * application's published key), and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`) || path === key) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAOO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAE1B,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK;AAChE,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["// Express (and anything else that speaks Node's http): the routes, and who is\n// signed in on every request.\n//\n//   app.use(cauthyExpress(auth))\n//\n//   app.get('/api/me', async (req, res) => {\n//     const session = await req.cauthy()\n//     if (!session) return res.status(401).json({ error: 'unauthenticated' })\n//     res.json(session.user)\n//   })\n//\n//   app.get('/api/books', requireSession, (req, res) => { … })\n//\n// A session that needs renewing is renewed on the spot, and its new cookie\n// leaves with whatever the route answers.\n\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** Who is signed in, or null. Asked once per request. */\n      cauthy(): Promise<Session | null>\n    }\n  }\n}\n\n/** A request as Node gives it, with what Express adds when it is Express. */\ntype NodeRequest = IncomingMessage & { originalUrl?: string; protocol?: string; ip?: string; body?: unknown; cauthy?: () => Promise<Session | null> }\ntype Next = (error?: unknown) => void\n\nfunction originOf(req: NodeRequest): string {\n  const secure = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true\n  return `${req.protocol ?? (secure ? 'https' : 'http')}://${req.headers.host ?? 'localhost'}`\n}\n\nasync function bodyOf(req: NodeRequest): Promise<BodyInit | undefined> {\n  if (req.method === 'GET' || req.method === 'HEAD') return undefined\n  // A body parser was here first (express.json()): what it read is the body.\n  if (req.body !== undefined && req.body !== null) {\n    if (typeof req.body === 'string') return req.body\n    if (req.body instanceof Uint8Array) return new Uint8Array(req.body)\n    return JSON.stringify(req.body)\n  }\n  const chunks: Uint8Array[] = []\n  for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : (chunk as Uint8Array))\n  return chunks.length === 0 ? undefined : new Blob(chunks as BlobPart[])\n}\n\nasync function toWebRequest(req: NodeRequest, withBody: boolean): Promise<Request> {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Express knows who is calling (it applies `trust proxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  if (typeof req.ip === 'string' && req.ip !== '') headers.set('x-forwarded-for', req.ip)\n  return new Request(new URL(req.originalUrl ?? req.url ?? '/', originOf(req)), {\n    method: req.method,\n    headers,\n    body: withBody ? await bodyOf(req) : undefined,\n  })\n}\n\nfunction addCookies(res: ServerResponse, cookies: string[]): void {\n  if (cookies.length === 0 || res.headersSent) return\n  const had = res.getHeader('set-cookie')\n  res.setHeader('set-cookie', [...(Array.isArray(had) ? had : typeof had === 'string' ? [had] : []), ...cookies])\n}\n\n/**\n * Serves the routes under the handler's `basePath`, and gives every other\n * request `req.cauthy()`. Mount it once, before the routes that use it.\n */\nexport function cauthyExpress(auth: Cauthy) {\n  const base = auth.options.basePath\n  return function cauthy(req: IncomingMessage, res: ServerResponse, next: Next): void {\n    const request = req as NodeRequest\n    const path = (request.originalUrl ?? request.url ?? '/').split('?')[0]\n\n    if (path === base || path.startsWith(`${base}/`)) {\n      void (async () => {\n        const answer = await auth.handler(await toWebRequest(request, true))\n        res.statusCode = answer.status\n        answer.headers.forEach((value, name) => {\n          if (name !== 'set-cookie') res.setHeader(name, value)\n        })\n        addCookies(res, answer.headers.getSetCookie())\n        res.end(answer.body === null ? undefined : Buffer.from(await answer.arrayBuffer()))\n      })().catch(next)\n      return\n    }\n\n    let asked: Promise<Session | null> | undefined\n    request.cauthy = () =>\n      (asked ??= (async () => {\n        const resolved = await auth.resolve(await toWebRequest(request, false))\n        addCookies(res, resolved.cookies)\n        return resolved.session\n      })())\n    next()\n  }\n}\n\n/** For a route only a signed-in person may call: answers 401 otherwise. Needs `cauthyExpress` mounted before it. */\nexport function requireSession(req: IncomingMessage, res: ServerResponse, next: Next): void {\n  const ask = (req as NodeRequest).cauthy\n  if (!ask) return next(new Error('@cauthyhq/node: mount cauthyExpress(auth) before requireSession'))\n  ask().then((session) => {\n    if (session !== null) return next()\n    res.statusCode = 401\n    res.setHeader('content-type', 'application/json; charset=utf-8')\n    res.setHeader('x-cauthy-session', 'none')\n    res.end(JSON.stringify({ error: 'unauthenticated' }))\n  }, next)\n}\n"],"mappings":";AAkCA,SAAS,SAAS,KAA0B;AAC1C,QAAM,SAAU,IAAI,QAAgD,cAAc;AAClF,SAAO,GAAG,IAAI,aAAa,SAAS,UAAU,OAAO,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC5F;AAEA,eAAe,OAAO,KAAiD;AACrE,MAAI,IAAI,WAAW,SAAS,IAAI,WAAW,OAAQ,QAAO;AAE1D,MAAI,IAAI,SAAS,UAAa,IAAI,SAAS,MAAM;AAC/C,QAAI,OAAO,IAAI,SAAS,SAAU,QAAO,IAAI;AAC7C,QAAI,IAAI,gBAAgB,WAAY,QAAO,IAAI,WAAW,IAAI,IAAI;AAClE,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AACA,QAAM,SAAuB,CAAC;AAC9B,mBAAiB,SAAS,IAAK,QAAO,KAAK,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAK,KAAoB;AAC9H,SAAO,OAAO,WAAW,IAAI,SAAY,IAAI,KAAK,MAAoB;AACxE;AAEA,eAAe,aAAa,KAAkB,UAAqC;AACjF,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,MAAI,OAAO,IAAI,OAAO,YAAY,IAAI,OAAO,GAAI,SAAQ,IAAI,mBAAmB,IAAI,EAAE;AACtF,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,eAAe,IAAI,OAAO,KAAK,SAAS,GAAG,CAAC,GAAG;AAAA,IAC5E,QAAQ,IAAI;AAAA,IACZ;AAAA,IACA,MAAM,WAAW,MAAM,OAAO,GAAG,IAAI;AAAA,EACvC,CAAC;AACH;AAEA,SAAS,WAAW,KAAqB,SAAyB;AAChE,MAAI,QAAQ,WAAW,KAAK,IAAI,YAAa;AAC7C,QAAM,MAAM,IAAI,UAAU,YAAY;AACtC,MAAI,UAAU,cAAc,CAAC,GAAI,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,GAAI,GAAG,OAAO,CAAC;AAChH;AAMO,SAAS,cAAc,MAAc;AAC1C,QAAM,OAAO,KAAK,QAAQ;AAC1B,SAAO,SAAS,OAAO,KAAsB,KAAqB,MAAkB;AAClF,UAAM,UAAU;AAChB,UAAM,QAAQ,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAErE,QAAI,SAAS,QAAQ,KAAK,WAAW,GAAG,IAAI,GAAG,GAAG;AAChD,YAAM,YAAY;AAChB,cAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,IAAI,CAAC;AACnE,YAAI,aAAa,OAAO;AACxB,eAAO,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACtC,cAAI,SAAS,aAAc,KAAI,UAAU,MAAM,KAAK;AAAA,QACtD,CAAC;AACD,mBAAW,KAAK,OAAO,QAAQ,aAAa,CAAC;AAC7C,YAAI,IAAI,OAAO,SAAS,OAAO,SAAY,OAAO,KAAK,MAAM,OAAO,YAAY,CAAC,CAAC;AAAA,MACpF,GAAG,EAAE,MAAM,IAAI;AACf;AAAA,IACF;AAEA,QAAI;AACJ,YAAQ,SAAS,MACd,WAAW,YAAY;AACtB,YAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,aAAa,SAAS,KAAK,CAAC;AACtE,iBAAW,KAAK,SAAS,OAAO;AAChC,aAAO,SAAS;AAAA,IAClB,GAAG;AACL,SAAK;AAAA,EACP;AACF;AAGO,SAAS,eAAe,KAAsB,KAAqB,MAAkB;AAC1F,QAAM,MAAO,IAAoB;AACjC,MAAI,CAAC,IAAK,QAAO,KAAK,IAAI,MAAM,iEAAiE,CAAC;AAClG,MAAI,EAAE,KAAK,CAAC,YAAY;AACtB,QAAI,YAAY,KAAM,QAAO,KAAK;AAClC,QAAI,aAAa;AACjB,QAAI,UAAU,gBAAgB,iCAAiC;AAC/D,QAAI,UAAU,oBAAoB,MAAM;AACxC,QAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,EACtD,GAAG,IAAI;AACT;","names":[]}

package/dist/fastify.d.mts

@@ -1,9 +1,7 @@
 import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
-import { S as Session, C as Cauthy } from './cauthy-CCSSj3Lg.mjs';
-import './keys-D5k0omTb.mjs';
+import { S as Session, C as Cauthy } from './cauthy-CsWUgyv_.mjs';
 import 'jose';
 import './theme.mjs';
-import './identity-BTJ8NB_w.mjs';
 
 declare module 'fastify' {
     interface FastifyRequest {

package/dist/fastify.d.ts

@@ -1,9 +1,7 @@
 import { FastifyReply, FastifyPluginAsync, FastifyInstance } from 'fastify';
-import { S as Session, C as Cauthy } from './cauthy-C7gZ-pbv.js';
-import './keys-D5k0omTb.js';
+import { S as Session, C as Cauthy } from './cauthy-DHLBEuqP.js';
 import 'jose';
 import './theme.js';
-import './identity-BTJ8NB_w.js';
 
 declare module 'fastify' {
     interface FastifyRequest {

package/dist/fastify.js

@@ -73,8 +73,6 @@ var plugin = async (app, { auth, checkMount = true }) => {
     return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
   };
   app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
-  const key = auth.pact?.contract.jwksPath;
-  if (key) app.route({ method: ["GET", "HEAD", "POST"], url: key, handler: serve });
   if (checkMount && process.env.NODE_ENV !== "test") app.addHook("onReady", () => probe(app, auth));
 };
 async function probe(app, auth) {

package/dist/fastify.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  if (key) app.route({ method: ['GET', 'HEAD', 'POST'], url: key, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,uBAA6B;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,MAAI,IAAK,KAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,QAAQ,MAAM,GAAG,KAAK,KAAK,SAAS,MAAM,CAAC;AAEhF,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,aAAS,+BAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,uBAA6B;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,aAAS,+BAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/fastify.mjs

@@ -47,8 +47,6 @@ var plugin = async (app, { auth, checkMount = true }) => {
     return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
   };
   app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
-  const key = auth.pact?.contract.jwksPath;
-  if (key) app.route({ method: ["GET", "HEAD", "POST"], url: key, handler: serve });
   if (checkMount && process.env.NODE_ENV !== "test") app.addHook("onReady", () => probe(app, auth));
 };
 async function probe(app, auth) {

package/dist/fastify.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // By contract the application also publishes its key, outside basePath.\n  const key = auth.pact?.contract.jwksPath\n  if (key) app.route({ method: ['GET', 'HEAD', 'POST'], url: key, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";AAeA,SAAS,oBAAoB;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,QAAM,MAAM,KAAK,MAAM,SAAS;AAChC,MAAI,IAAK,KAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,QAAQ,MAAM,GAAG,KAAK,KAAK,SAAS,MAAM,CAAC;AAEhF,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport { createServer } from 'node:http'\nimport type { AddressInfo } from 'node:net'\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n  /**\n   * Check, when Fastify is ready, that this plugin is what answers under\n   * basePath (`checkFastifyMount`), and fail startup when another route\n   * does. Default: true.\n   */\n  checkMount?: boolean\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // Fastify knows who is calling (it applies `trustProxy`): that address is\n  // the one passed on to Cauthy, whatever the header claimed.\n  headers.set('x-forwarded-for', req.ip)\n  // What Fastify parsed is the body: the application's own sign-in screens post JSON.\n  const body = req.method === 'GET' || req.method === 'HEAD' || req.body === undefined || req.body === null\n    ? undefined\n    : typeof req.body === 'string' ? req.body : JSON.stringify(req.body)\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers, body })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth, checkMount = true }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n  // Tests build many apps with routes of their own, and mount nothing for real.\n  if (checkMount && process.env.NODE_ENV !== 'test') app.addHook('onReady', () => probe(app, auth))\n}\n\n/**\n * Sends the probes of checkMount through Fastify's own router, over a private\n * loopback socket that only lives for the check. Not `app.inject`: inside\n * `onReady` it would wait for the very ready it runs in.\n */\nasync function probe(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  const server = createServer((req, res) => app.routing(req, res))\n  await new Promise<void>((resolve, reject) => {\n    server.once('error', reject)\n    server.listen(0, '127.0.0.1', resolve)\n  })\n  try {\n    await auth.checkMount(`http://127.0.0.1:${(server.address() as AddressInfo).port}`)\n  } finally {\n    server.closeAllConnections()\n    await new Promise<void>((resolve) => server.close(() => resolve()))\n  }\n}\n\n/**\n * Checks that the plugin is what answers under basePath, in process, once\n * Fastify is ready (the plugin already does it by itself at `onReady`; this\n * is for tests and for `checkMount: false`):\n *\n *   await app.ready()\n *   await checkFastifyMount(app, auth)\n */\nexport function checkFastifyMount(app: FastifyInstance, auth: Cauthy): Promise<void> {\n  return probe(app, auth)\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = '@cauthyhq/node'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";AAeA,SAAS,oBAAoB;AA2B7B,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAGA,UAAQ,IAAI,mBAAmB,IAAI,EAAE;AAErC,QAAM,OAAO,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,UAAa,IAAI,SAAS,OACjG,SACA,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,KAAK,UAAU,IAAI,IAAI;AACrE,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,SAAS,KAAK,CAAC;AAC3F;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,MAAM,aAAa,KAAK,MAAM;AACpH,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AAEvE,MAAI,cAAc,QAAQ,IAAI,aAAa,OAAQ,KAAI,QAAQ,WAAW,MAAM,MAAM,KAAK,IAAI,CAAC;AAClG;AAOA,eAAe,MAAM,KAAsB,MAA6B;AACtE,QAAM,SAAS,aAAa,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,GAAG,CAAC;AAC/D,QAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,GAAG,aAAa,OAAO;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,KAAK,WAAW,oBAAqB,OAAO,QAAQ,EAAkB,IAAI,EAAE;AAAA,EACpF,UAAE;AACA,WAAO,oBAAoB;AAC3B,UAAM,IAAI,QAAc,CAAC,YAAY,OAAO,MAAM,MAAM,QAAQ,CAAC,CAAC;AAAA,EACpE;AACF;AAUO,SAAS,kBAAkB,KAAsB,MAA6B;AACnF,SAAO,MAAM,KAAK,IAAI;AACxB;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/hono.d.mts

@@ -1,9 +1,7 @@
 import { MiddlewareHandler } from 'hono';
-import { S as Session, C as Cauthy } from './cauthy-CCSSj3Lg.mjs';
-import './keys-D5k0omTb.mjs';
+import { S as Session, C as Cauthy } from './cauthy-CsWUgyv_.mjs';
 import 'jose';
 import './theme.mjs';
-import './identity-BTJ8NB_w.mjs';
 
 /** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */
 interface CauthyVariables {
@@ -14,8 +12,7 @@ type Env = {
     Variables: CauthyVariables;
 };
 /**
- * Serves the routes under the handler's `basePath` (and, by contract, the
- * application's published key), and sets `session` for
+ * Serves the routes under the handler's `basePath`, and sets `session` for
  * every other request. Mount it once, before the routes that use it.
  */
 declare function cauthyHono(auth: Cauthy): MiddlewareHandler<Env>;

package/dist/hono.d.ts

@@ -1,9 +1,7 @@
 import { MiddlewareHandler } from 'hono';
-import { S as Session, C as Cauthy } from './cauthy-C7gZ-pbv.js';
-import './keys-D5k0omTb.js';
+import { S as Session, C as Cauthy } from './cauthy-DHLBEuqP.js';
 import 'jose';
 import './theme.js';
-import './identity-BTJ8NB_w.js';
 
 /** What the middleware keeps on the context: `new Hono<{ Variables: CauthyVariables }>()`. */
 interface CauthyVariables {
@@ -14,8 +12,7 @@ type Env = {
     Variables: CauthyVariables;
 };
 /**
- * Serves the routes under the handler's `basePath` (and, by contract, the
- * application's published key), and sets `session` for
+ * Serves the routes under the handler's `basePath`, and sets `session` for
  * every other request. Mount it once, before the routes that use it.
  */
 declare function cauthyHono(auth: Cauthy): MiddlewareHandler<Env>;

package/dist/hono.js

@@ -26,10 +26,9 @@ __export(hono_exports, {
 module.exports = __toCommonJS(hono_exports);
 function cauthyHono(auth) {
   const base = auth.options.basePath;
-  const key = auth.pact?.contract.jwksPath;
   return async (c, next) => {
     const path = new URL(c.req.url).pathname;
-    if (path === base || path.startsWith(`${base}/`) || path === key) return auth.handler(c.req.raw);
+    if (path === base || path.startsWith(`${base}/`)) return auth.handler(c.req.raw);
     const resolved = await auth.resolve(c.req.raw);
     c.set("session", resolved.session);
     await next();