@cemiar/auth-sdk 1.0.16 → 1.0.17

package/dist/index.d.ts

@@ -2,3 +2,4 @@ export { CemiarAuthClient, createCemiarAuthClient } from "./browser/CemiarAuthCl
 export { registerCemiarAuthHapi } from "./server/ServerHandler.js";
 export * from "./shared/Types.js";
 export { tokenToClaim, tokenToClaimBrowser, normalizeBaseUrl, isBrowser } from "./shared/Utils.js";
+export { authorizeRoute } from "./server/AuthorizationHandler.js";

package/dist/index.js

@@ -2,3 +2,4 @@ export { CemiarAuthClient, createCemiarAuthClient } from "./browser/CemiarAuthCl
 export { registerCemiarAuthHapi } from "./server/ServerHandler.js";
 export * from "./shared/Types.js";
 export { tokenToClaim, tokenToClaimBrowser, normalizeBaseUrl, isBrowser } from "./shared/Utils.js";
+export { authorizeRoute } from "./server/AuthorizationHandler.js";

package/dist/server/AuthorizationHandler.d.ts

@@ -0,0 +1,5 @@
+import { ReqRefDefaults, ResponseToolkit } from "@hapi/hapi";
+export declare function authorizeRoute({ resource, action }: {
+    resource: string;
+    action: string;
+}): (request: any, h: ResponseToolkit<ReqRefDefaults>) => Promise<symbol | import("@hapi/hapi").ResponseObject>;

package/dist/server/AuthorizationHandler.js

@@ -0,0 +1,52 @@
+import axios from "axios";
+import { tokenToClaim } from "../shared/Utils.js";
+export function authorizeRoute({ resource, action }) {
+    return async (request, h) => {
+        const context = buildContextFromRequest(request);
+        if (!context) {
+            return h.response({ error: "Unauthorized: Invalid token or missing context" }).code(401).takeover();
+        }
+        const authzRequest = {
+            tenantId: context.tenantId,
+            resource,
+            action,
+            context
+        };
+        try {
+            const response = await axios.post(`${process.env.CEMIAR_AUTHZ_URL}/authorize`, authzRequest);
+            h;
+            if (response.status === 200 && response.data.allowed) {
+                h.request.headers["x-user-email"] = context.email || "";
+                return h.continue;
+            }
+            else {
+                return h.response({ error: "Forbidden: Access denied" }).code(403).takeover();
+            }
+        }
+        catch (error) {
+            return h
+                .response({ error: "Authorization service error: " + error.message })
+                .code(500)
+                .takeover();
+        }
+    };
+}
+function buildContextFromRequest(request) {
+    var _a, _b;
+    const token = (_b = (_a = request.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(" ")[1];
+    if (!token) {
+        return null;
+    }
+    if (!token) {
+        return null;
+    }
+    const claim = tokenToClaim(token);
+    if (!claim) {
+        return null;
+    }
+    return {
+        email: claim.sub,
+        roles: [],
+        tenantId: process.env.CEMIAR_AUTH_TENANT_ID || ""
+    };
+}

package/dist/server/index.d.ts

@@ -1,2 +1,3 @@
 export { registerCemiarAuthHapi, createSigningKeyResolver } from "./ServerHandler.js";
 export type { JwtValidateFn, JwtValidateResult, JwtParts, HapiJwtStrategyOptions } from "../shared/Types.js";
+export { authorizeRoute } from "./AuthorizationHandler.js";

package/dist/server/index.js

@@ -1 +1,2 @@
 export { registerCemiarAuthHapi, createSigningKeyResolver } from "./ServerHandler.js";
+export { authorizeRoute } from "./AuthorizationHandler.js";

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cemiar/auth-sdk",
-    "version": "1.0.16",
+    "version": "1.0.17",
     "description": "Cemiar Auth integration helpers for web apps and APIs.",
     "type": "module",
     "main": "dist/index.js",