@commercetools-backend/express 0.0.0-FEC-157-preview-releases-20241126230331

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) commercetools GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @commercetools-backend/express
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@commercetools-backend/express"><img src="https://badgen.net/npm/v/@commercetools-backend/express" alt="Latest release (latest dist-tag)" /></a> <a href="https://www.npmjs.com/package/@commercetools-backend/express"><img src="https://badgen.net/npm/v/@commercetools-backend/express/next" alt="Latest release (next dist-tag)" /></a> <a href="https://bundlephobia.com/result?p=@commercetools-backend/express"><img src="https://badgen.net/bundlephobia/minzip/@commercetools-backend/express" alt="Minified + GZipped size" /></a> <a href="https://github.com/commercetools/merchant-center-application-kit/blob/main/LICENSE"><img src="https://badgen.net/github/license/commercetools/merchant-center-application-kit" alt="GitHub license" /></a>
+</p>
+
+Zero-config HTTP server as Express.js to facilitate development.
+
+This package is primarily built for HTTP servers used by Custom Applications and it provides a set of components to facilitate the development of the HTTP server.
+
+## Install
+
+```bash
+$ npm install --save @commercetools-backend/express
+```
+
+Check out the [documentation](https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api) for more information.

package/dist/commercetools-backend-express.cjs.d.ts

@@ -0,0 +1,2 @@
+export * from "./declarations/src/index";
+//# sourceMappingURL=commercetools-backend-express.cjs.d.ts.map

package/dist/commercetools-backend-express.cjs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commercetools-backend-express.cjs.d.ts","sourceRoot":"","sources":["./declarations/src/index.d.ts"],"names":[],"mappings":"AAAA"}

package/dist/commercetools-backend-express.cjs.dev.js

@@ -0,0 +1,291 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
+var _URL = require('@babel/runtime-corejs3/core-js-stable/url');
+var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
+var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
+var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
+var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
+var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
+var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
+var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
+var _Object$getOwnPropertyDescriptors = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors');
+var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/object/define-properties');
+var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
+var expressJwt = require('express-jwt');
+var jwksRsa = require('jwks-rsa');
+var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
+var _findInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/find');
+var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
+var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-array');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+
+var _URL__default = /*#__PURE__*/_interopDefault(_URL);
+var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
+var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
+var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
+var _filterInstanceProperty__default = /*#__PURE__*/_interopDefault(_filterInstanceProperty);
+var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
+var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
+var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
+var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
+var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
+var jwksRsa__default = /*#__PURE__*/_interopDefault(jwksRsa);
+var _findInstanceProperty__default = /*#__PURE__*/_interopDefault(_findInstanceProperty);
+var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
+var _Array$isArray__default = /*#__PURE__*/_interopDefault(_Array$isArray);
+
+const CLOUD_IDENTIFIERS = {
+  GCP_AU: 'gcp-au',
+  GCP_EU: 'gcp-eu',
+  GCP_US: 'gcp-us',
+  AWS_EU: 'aws-eu',
+  AWS_US: 'aws-us',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'aws-fra',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'aws-ohio',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'aws-cn',
+  AZURE_US: 'azure-us',
+  AZURE_EU: 'azure-eu'
+};
+const MC_API_URLS = {
+  GCP_AU: 'https://mc-api.australia-southeast1.gcp.commercetools.com',
+  GCP_EU: 'https://mc-api.europe-west1.gcp.commercetools.com',
+  GCP_US: 'https://mc-api.us-central1.gcp.commercetools.com',
+  AWS_EU: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  AWS_US: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'https://mc-api.cn-northwest-1.aws.commercetools.cn',
+  AZURE_US: 'https://mc-api.eastus.azure.commercetools.com',
+  AZURE_EU: 'https://mc-api.germanywestcentral.azure.commercetools.com'
+};
+const MC_API_PROXY_HEADERS = {
+  FORWARD_TO_VERSION: 'x-mc-api-forward-to-version',
+  CLOUD_IDENTIFIER: 'x-mc-api-cloud-identifier'
+};
+
+const getHeaderByCaseInsensitiveKey = (headers, headerKey) => {
+  var _context;
+  const matchingHeader = _findInstanceProperty__default["default"](_context = _Object$entries__default["default"](headers)).call(_context, _ref => {
+    let _ref2 = _slicedToArray(_ref, 1),
+      key = _ref2[0];
+    return headerKey.toLowerCase() === key.toLowerCase();
+  });
+  if (matchingHeader && matchingHeader.length > 0) {
+    const _matchingHeader = _slicedToArray(matchingHeader, 2),
+      headerValue = _matchingHeader[1];
+    return _Array$isArray__default["default"](headerValue) ? headerValue[0] : headerValue;
+  }
+  return undefined;
+};
+const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
+  const headerValue = getHeaderByCaseInsensitiveKey(headers, headerKey);
+  if (!headerValue) {
+    throw new Error(errorMessage);
+  }
+  return headerValue;
+};
+
+function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+const decodedTokenKey = 'decoded_token';
+// Assign a session object to the request object.
+const writeSessionContext = request => {
+  const decodedToken = request[decodedTokenKey];
+  if (decodedToken) {
+    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
+    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
+    request.session = {
+      userId: decodedToken.sub,
+      projectKey: decodedToken[publicClaimForProjectKey]
+    };
+    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
+    if (Boolean(userPermissions?.length)) {
+      request.session.userPermissions = userPermissions;
+    }
+  }
+
+  // Remove the field used by the JWT middleware.
+  delete request.decoded_token;
+};
+
+// Given a cloud identifier, try to map it to one of the supported
+// environments and return the MC API URL for that environment.
+// The URL points to the new hostnames.
+// https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames
+const mapCloudIdentifierToIssuer = issuer => {
+  switch (issuer) {
+    case CLOUD_IDENTIFIERS.GCP_AU:
+      return MC_API_URLS.GCP_AU;
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return MC_API_URLS.GCP_EU;
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return MC_API_URLS.GCP_US;
+    case CLOUD_IDENTIFIERS.AWS_EU:
+    case CLOUD_IDENTIFIERS.AWS_FRA:
+      return MC_API_URLS.AWS_EU;
+    case CLOUD_IDENTIFIERS.AWS_US:
+    case CLOUD_IDENTIFIERS.AWS_OHIO:
+      return MC_API_URLS.AWS_US;
+    // TODO: remove it
+    case CLOUD_IDENTIFIERS.AWS_CN:
+      return MC_API_URLS.AWS_CN;
+    case CLOUD_IDENTIFIERS.AZURE_US:
+      return MC_API_URLS.AZURE_US;
+    case CLOUD_IDENTIFIERS.AZURE_EU:
+      return MC_API_URLS.AZURE_EU;
+    default:
+      return undefined;
+  }
+};
+// Given a cloud identifier, try to map it to a legacy hostname.
+// This is for backwards compatibility.
+const mapToLegacyIssuer = cloudIdentifier => {
+  switch (cloudIdentifier) {
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return 'https://mc-api.commercetools.com';
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return 'https://mc-api.commercetools.co';
+    default:
+      return undefined;
+  }
+};
+// Verifies that the issuer is a valid URL.
+const throwIfIssuerIsNotAValidUrl = issuer => {
+  try {
+    new _URL__default["default"](issuer);
+  } catch (error) {
+    throw new Error(`Invalid issuer URL "${issuer}". Expected a valid URL to the Merchant Center API Gateway, or a cloud identifier to one of the available cloud regions. See https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames.`);
+  }
+};
+// Validates required option values.
+const validateRequiredValues = options => {
+  if (!options.audience) {
+    throw new Error(`Missing required option "audience"`);
+  }
+  if (!options.issuer) {
+    throw new Error(`Missing required option "issuer"`);
+  }
+};
+// Attempt to parse the given issuer. If the value is a cloud identifier, it will
+// be mapped to one of the supported values. If not, we assume the value is a valid URL.
+const getConfiguredDefaultIssuer = options => {
+  const issuer = mapCloudIdentifierToIssuer(options.issuer);
+  if (!issuer) {
+    throwIfIssuerIsNotAValidUrl(options.issuer);
+    return options.issuer;
+  }
+  return issuer;
+};
+
+// Construct the audience from the given option + the request path.
+// If the request path is `/`, do not append it to the audience, otherwise
+// the token validation might fail because of mismatching audiences.
+const getConfiguredAudience = (options, requestPath) => {
+  // remove the trailing slash
+  const url = new _URL__default["default"](`${options.audience.replace(/\/?$/, '')}${requestPath}`);
+  switch (options.audiencePolicy) {
+    case 'forward-url-origin':
+      return url.origin;
+    default:
+      {
+        if (requestPath === '/') {
+          return url.origin;
+        }
+        return `${url.origin}${url.pathname}`;
+      }
+  }
+};
+function createSessionAuthVerifier(options) {
+  validateRequiredValues(options);
+  const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
+
+  // Returns an async HTTP handler.
+  return async (request, response) => {
+    // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
+    const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
+    let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
+
+    // Get the `Accept-version` header, forwarded by the `/proxy/forward-to` endpoint.
+    // The version should be sent by the client making the request, to use the features of v2.
+    const proxyForwardVersion = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.FORWARD_TO_VERSION, `Missing "X-MC-API-Forward-To-Version" header.`);
+    if (proxyForwardVersion === 'v1') {
+      // Fall back to legacy issuer domains
+      issuer = mapToLegacyIssuer(cloudIdentifierHeader) ?? issuer;
+    }
+    const requestUrlPath = options.getRequestUrl ? options.getRequestUrl(request) : request.originalUrl ?? request.url;
+    if (!requestUrlPath || !_startsWithInstanceProperty__default["default"](requestUrlPath).call(requestUrlPath, '/')) {
+      throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
+    }
+    const audience = getConfiguredAudience(options, requestUrlPath);
+    return new _Promise__default["default"]((resolve, reject) => {
+      expressJwt.expressjwt({
+        // Dynamically provide a signing key based on the kid in the header
+        // and the singing keys provided by the JWKS endpoint
+        secret: jwksRsa__default["default"].expressJwtSecret(_objectSpread(_objectSpread({
+          // Default options
+          cache: true,
+          rateLimit: true,
+          jwksRequestsPerMinute: 5
+        }, options.jwks || {}), {}, {
+          // This should be set by the middleware, no matter what.
+          jwksUri: `${issuer}/.well-known/jwks.json`
+        })),
+        requestProperty: decodedTokenKey,
+        // Validate the audience and the issuer.
+        audience,
+        issuer,
+        algorithms: ['RS256']
+        // @ts-ignore: the middleware expects an Express.js Request/Response objects
+      })(request, response ?? {}, error => {
+        if (error) {
+          reject(error);
+        } else {
+          // @ts-ignore: the Request object does not know about some additional fields
+          // like `decoded_token` and `session`
+          writeSessionContext(request);
+          resolve();
+        }
+      });
+    });
+  };
+}
+
+function createSessionMiddleware(options) {
+  const sessionAuthVerifier = createSessionAuthVerifier(options);
+  return async (request, response, next) => {
+    try {
+      await sessionAuthVerifier(request, response);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+exports.CLOUD_IDENTIFIERS = CLOUD_IDENTIFIERS;
+exports.MC_API_URLS = MC_API_URLS;
+exports.createSessionAuthVerifier = createSessionAuthVerifier;
+exports.createSessionMiddleware = createSessionMiddleware;

package/dist/commercetools-backend-express.cjs.js

@@ -0,0 +1,7 @@
+'use strict';
+
+if (process.env.NODE_ENV === "production") {
+  module.exports = require("./commercetools-backend-express.cjs.prod.js");
+} else {
+  module.exports = require("./commercetools-backend-express.cjs.dev.js");
+}

package/dist/commercetools-backend-express.cjs.prod.js

@@ -0,0 +1,291 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
+var _URL = require('@babel/runtime-corejs3/core-js-stable/url');
+var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
+var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
+var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
+var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
+var _filterInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/filter');
+var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
+var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
+var _Object$getOwnPropertyDescriptors = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors');
+var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/object/define-properties');
+var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
+var expressJwt = require('express-jwt');
+var jwksRsa = require('jwks-rsa');
+var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
+var _findInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/find');
+var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
+var _Array$isArray = require('@babel/runtime-corejs3/core-js-stable/array/is-array');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
+
+var _URL__default = /*#__PURE__*/_interopDefault(_URL);
+var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
+var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
+var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
+var _filterInstanceProperty__default = /*#__PURE__*/_interopDefault(_filterInstanceProperty);
+var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
+var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
+var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
+var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
+var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
+var jwksRsa__default = /*#__PURE__*/_interopDefault(jwksRsa);
+var _findInstanceProperty__default = /*#__PURE__*/_interopDefault(_findInstanceProperty);
+var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
+var _Array$isArray__default = /*#__PURE__*/_interopDefault(_Array$isArray);
+
+const CLOUD_IDENTIFIERS = {
+  GCP_AU: 'gcp-au',
+  GCP_EU: 'gcp-eu',
+  GCP_US: 'gcp-us',
+  AWS_EU: 'aws-eu',
+  AWS_US: 'aws-us',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'aws-fra',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'aws-ohio',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'aws-cn',
+  AZURE_US: 'azure-us',
+  AZURE_EU: 'azure-eu'
+};
+const MC_API_URLS = {
+  GCP_AU: 'https://mc-api.australia-southeast1.gcp.commercetools.com',
+  GCP_EU: 'https://mc-api.europe-west1.gcp.commercetools.com',
+  GCP_US: 'https://mc-api.us-central1.gcp.commercetools.com',
+  AWS_EU: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  AWS_US: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'https://mc-api.cn-northwest-1.aws.commercetools.cn',
+  AZURE_US: 'https://mc-api.eastus.azure.commercetools.com',
+  AZURE_EU: 'https://mc-api.germanywestcentral.azure.commercetools.com'
+};
+const MC_API_PROXY_HEADERS = {
+  FORWARD_TO_VERSION: 'x-mc-api-forward-to-version',
+  CLOUD_IDENTIFIER: 'x-mc-api-cloud-identifier'
+};
+
+const getHeaderByCaseInsensitiveKey = (headers, headerKey) => {
+  var _context;
+  const matchingHeader = _findInstanceProperty__default["default"](_context = _Object$entries__default["default"](headers)).call(_context, _ref => {
+    let _ref2 = _slicedToArray(_ref, 1),
+      key = _ref2[0];
+    return headerKey.toLowerCase() === key.toLowerCase();
+  });
+  if (matchingHeader && matchingHeader.length > 0) {
+    const _matchingHeader = _slicedToArray(matchingHeader, 2),
+      headerValue = _matchingHeader[1];
+    return _Array$isArray__default["default"](headerValue) ? headerValue[0] : headerValue;
+  }
+  return undefined;
+};
+const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
+  const headerValue = getHeaderByCaseInsensitiveKey(headers, headerKey);
+  if (!headerValue) {
+    throw new Error(errorMessage);
+  }
+  return headerValue;
+};
+
+function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+const decodedTokenKey = 'decoded_token';
+// Assign a session object to the request object.
+const writeSessionContext = request => {
+  const decodedToken = request[decodedTokenKey];
+  if (decodedToken) {
+    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
+    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
+    request.session = {
+      userId: decodedToken.sub,
+      projectKey: decodedToken[publicClaimForProjectKey]
+    };
+    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
+    if (Boolean(userPermissions?.length)) {
+      request.session.userPermissions = userPermissions;
+    }
+  }
+
+  // Remove the field used by the JWT middleware.
+  delete request.decoded_token;
+};
+
+// Given a cloud identifier, try to map it to one of the supported
+// environments and return the MC API URL for that environment.
+// The URL points to the new hostnames.
+// https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames
+const mapCloudIdentifierToIssuer = issuer => {
+  switch (issuer) {
+    case CLOUD_IDENTIFIERS.GCP_AU:
+      return MC_API_URLS.GCP_AU;
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return MC_API_URLS.GCP_EU;
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return MC_API_URLS.GCP_US;
+    case CLOUD_IDENTIFIERS.AWS_EU:
+    case CLOUD_IDENTIFIERS.AWS_FRA:
+      return MC_API_URLS.AWS_EU;
+    case CLOUD_IDENTIFIERS.AWS_US:
+    case CLOUD_IDENTIFIERS.AWS_OHIO:
+      return MC_API_URLS.AWS_US;
+    // TODO: remove it
+    case CLOUD_IDENTIFIERS.AWS_CN:
+      return MC_API_URLS.AWS_CN;
+    case CLOUD_IDENTIFIERS.AZURE_US:
+      return MC_API_URLS.AZURE_US;
+    case CLOUD_IDENTIFIERS.AZURE_EU:
+      return MC_API_URLS.AZURE_EU;
+    default:
+      return undefined;
+  }
+};
+// Given a cloud identifier, try to map it to a legacy hostname.
+// This is for backwards compatibility.
+const mapToLegacyIssuer = cloudIdentifier => {
+  switch (cloudIdentifier) {
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return 'https://mc-api.commercetools.com';
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return 'https://mc-api.commercetools.co';
+    default:
+      return undefined;
+  }
+};
+// Verifies that the issuer is a valid URL.
+const throwIfIssuerIsNotAValidUrl = issuer => {
+  try {
+    new _URL__default["default"](issuer);
+  } catch (error) {
+    throw new Error(`Invalid issuer URL "${issuer}". Expected a valid URL to the Merchant Center API Gateway, or a cloud identifier to one of the available cloud regions. See https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames.`);
+  }
+};
+// Validates required option values.
+const validateRequiredValues = options => {
+  if (!options.audience) {
+    throw new Error(`Missing required option "audience"`);
+  }
+  if (!options.issuer) {
+    throw new Error(`Missing required option "issuer"`);
+  }
+};
+// Attempt to parse the given issuer. If the value is a cloud identifier, it will
+// be mapped to one of the supported values. If not, we assume the value is a valid URL.
+const getConfiguredDefaultIssuer = options => {
+  const issuer = mapCloudIdentifierToIssuer(options.issuer);
+  if (!issuer) {
+    throwIfIssuerIsNotAValidUrl(options.issuer);
+    return options.issuer;
+  }
+  return issuer;
+};
+
+// Construct the audience from the given option + the request path.
+// If the request path is `/`, do not append it to the audience, otherwise
+// the token validation might fail because of mismatching audiences.
+const getConfiguredAudience = (options, requestPath) => {
+  // remove the trailing slash
+  const url = new _URL__default["default"](`${options.audience.replace(/\/?$/, '')}${requestPath}`);
+  switch (options.audiencePolicy) {
+    case 'forward-url-origin':
+      return url.origin;
+    default:
+      {
+        if (requestPath === '/') {
+          return url.origin;
+        }
+        return `${url.origin}${url.pathname}`;
+      }
+  }
+};
+function createSessionAuthVerifier(options) {
+  validateRequiredValues(options);
+  const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
+
+  // Returns an async HTTP handler.
+  return async (request, response) => {
+    // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
+    const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
+    let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
+
+    // Get the `Accept-version` header, forwarded by the `/proxy/forward-to` endpoint.
+    // The version should be sent by the client making the request, to use the features of v2.
+    const proxyForwardVersion = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.FORWARD_TO_VERSION, `Missing "X-MC-API-Forward-To-Version" header.`);
+    if (proxyForwardVersion === 'v1') {
+      // Fall back to legacy issuer domains
+      issuer = mapToLegacyIssuer(cloudIdentifierHeader) ?? issuer;
+    }
+    const requestUrlPath = options.getRequestUrl ? options.getRequestUrl(request) : request.originalUrl ?? request.url;
+    if (!requestUrlPath || !_startsWithInstanceProperty__default["default"](requestUrlPath).call(requestUrlPath, '/')) {
+      throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
+    }
+    const audience = getConfiguredAudience(options, requestUrlPath);
+    return new _Promise__default["default"]((resolve, reject) => {
+      expressJwt.expressjwt({
+        // Dynamically provide a signing key based on the kid in the header
+        // and the singing keys provided by the JWKS endpoint
+        secret: jwksRsa__default["default"].expressJwtSecret(_objectSpread(_objectSpread({
+          // Default options
+          cache: true,
+          rateLimit: true,
+          jwksRequestsPerMinute: 5
+        }, options.jwks || {}), {}, {
+          // This should be set by the middleware, no matter what.
+          jwksUri: `${issuer}/.well-known/jwks.json`
+        })),
+        requestProperty: decodedTokenKey,
+        // Validate the audience and the issuer.
+        audience,
+        issuer,
+        algorithms: ['RS256']
+        // @ts-ignore: the middleware expects an Express.js Request/Response objects
+      })(request, response ?? {}, error => {
+        if (error) {
+          reject(error);
+        } else {
+          // @ts-ignore: the Request object does not know about some additional fields
+          // like `decoded_token` and `session`
+          writeSessionContext(request);
+          resolve();
+        }
+      });
+    });
+  };
+}
+
+function createSessionMiddleware(options) {
+  const sessionAuthVerifier = createSessionAuthVerifier(options);
+  return async (request, response, next) => {
+    try {
+      await sessionAuthVerifier(request, response);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+exports.CLOUD_IDENTIFIERS = CLOUD_IDENTIFIERS;
+exports.MC_API_URLS = MC_API_URLS;
+exports.createSessionAuthVerifier = createSessionAuthVerifier;
+exports.createSessionMiddleware = createSessionMiddleware;

package/dist/commercetools-backend-express.esm.js

@@ -0,0 +1,266 @@
+import _defineProperty from '@babel/runtime-corejs3/helpers/esm/defineProperty';
+import _URL from '@babel/runtime-corejs3/core-js-stable/url';
+import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
+import _Promise from '@babel/runtime-corejs3/core-js-stable/promise';
+import _Object$keys from '@babel/runtime-corejs3/core-js-stable/object/keys';
+import _Object$getOwnPropertySymbols from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols';
+import _filterInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/filter';
+import _Object$getOwnPropertyDescriptor from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor';
+import _forEachInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/for-each';
+import _Object$getOwnPropertyDescriptors from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptors';
+import _Object$defineProperties from '@babel/runtime-corejs3/core-js-stable/object/define-properties';
+import _Object$defineProperty from '@babel/runtime-corejs3/core-js-stable/object/define-property';
+import { expressjwt } from 'express-jwt';
+import jwksRsa from 'jwks-rsa';
+import _slicedToArray from '@babel/runtime-corejs3/helpers/esm/slicedToArray';
+import _findInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/find';
+import _Object$entries from '@babel/runtime-corejs3/core-js-stable/object/entries';
+import _Array$isArray from '@babel/runtime-corejs3/core-js-stable/array/is-array';
+
+const CLOUD_IDENTIFIERS = {
+  GCP_AU: 'gcp-au',
+  GCP_EU: 'gcp-eu',
+  GCP_US: 'gcp-us',
+  AWS_EU: 'aws-eu',
+  AWS_US: 'aws-us',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'aws-fra',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'aws-ohio',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'aws-cn',
+  AZURE_US: 'azure-us',
+  AZURE_EU: 'azure-eu'
+};
+const MC_API_URLS = {
+  GCP_AU: 'https://mc-api.australia-southeast1.gcp.commercetools.com',
+  GCP_EU: 'https://mc-api.europe-west1.gcp.commercetools.com',
+  GCP_US: 'https://mc-api.us-central1.gcp.commercetools.com',
+  AWS_EU: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  AWS_US: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_EU` instead
+   */
+  AWS_FRA: 'https://mc-api.eu-central-1.aws.commercetools.com',
+  /**
+   * @deprecated: use `AWS_US` instead
+   */
+  AWS_OHIO: 'https://mc-api.us-east-2.aws.commercetools.com',
+  /**
+   * @deprecated: not supported anymore
+   */
+  AWS_CN: 'https://mc-api.cn-northwest-1.aws.commercetools.cn',
+  AZURE_US: 'https://mc-api.eastus.azure.commercetools.com',
+  AZURE_EU: 'https://mc-api.germanywestcentral.azure.commercetools.com'
+};
+const MC_API_PROXY_HEADERS = {
+  FORWARD_TO_VERSION: 'x-mc-api-forward-to-version',
+  CLOUD_IDENTIFIER: 'x-mc-api-cloud-identifier'
+};
+
+const getHeaderByCaseInsensitiveKey = (headers, headerKey) => {
+  var _context;
+  const matchingHeader = _findInstanceProperty(_context = _Object$entries(headers)).call(_context, _ref => {
+    let _ref2 = _slicedToArray(_ref, 1),
+      key = _ref2[0];
+    return headerKey.toLowerCase() === key.toLowerCase();
+  });
+  if (matchingHeader && matchingHeader.length > 0) {
+    const _matchingHeader = _slicedToArray(matchingHeader, 2),
+      headerValue = _matchingHeader[1];
+    return _Array$isArray(headerValue) ? headerValue[0] : headerValue;
+  }
+  return undefined;
+};
+const getFirstHeaderValueOrThrow = (headers, headerKey, errorMessage) => {
+  const headerValue = getHeaderByCaseInsensitiveKey(headers, headerKey);
+  if (!headerValue) {
+    throw new Error(errorMessage);
+  }
+  return headerValue;
+};
+
+function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+const decodedTokenKey = 'decoded_token';
+// Assign a session object to the request object.
+const writeSessionContext = request => {
+  const decodedToken = request[decodedTokenKey];
+  if (decodedToken) {
+    const publicClaimForProjectKey = `${decodedToken.iss}/claims/project_key`;
+    const publicClaimForUserPermissionsKey = `${decodedToken.iss}/claims/user_permissions`;
+    request.session = {
+      userId: decodedToken.sub,
+      projectKey: decodedToken[publicClaimForProjectKey]
+    };
+    const userPermissions = decodedToken[publicClaimForUserPermissionsKey];
+    if (Boolean(userPermissions?.length)) {
+      request.session.userPermissions = userPermissions;
+    }
+  }
+
+  // Remove the field used by the JWT middleware.
+  delete request.decoded_token;
+};
+
+// Given a cloud identifier, try to map it to one of the supported
+// environments and return the MC API URL for that environment.
+// The URL points to the new hostnames.
+// https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames
+const mapCloudIdentifierToIssuer = issuer => {
+  switch (issuer) {
+    case CLOUD_IDENTIFIERS.GCP_AU:
+      return MC_API_URLS.GCP_AU;
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return MC_API_URLS.GCP_EU;
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return MC_API_URLS.GCP_US;
+    case CLOUD_IDENTIFIERS.AWS_EU:
+    case CLOUD_IDENTIFIERS.AWS_FRA:
+      return MC_API_URLS.AWS_EU;
+    case CLOUD_IDENTIFIERS.AWS_US:
+    case CLOUD_IDENTIFIERS.AWS_OHIO:
+      return MC_API_URLS.AWS_US;
+    // TODO: remove it
+    case CLOUD_IDENTIFIERS.AWS_CN:
+      return MC_API_URLS.AWS_CN;
+    case CLOUD_IDENTIFIERS.AZURE_US:
+      return MC_API_URLS.AZURE_US;
+    case CLOUD_IDENTIFIERS.AZURE_EU:
+      return MC_API_URLS.AZURE_EU;
+    default:
+      return undefined;
+  }
+};
+// Given a cloud identifier, try to map it to a legacy hostname.
+// This is for backwards compatibility.
+const mapToLegacyIssuer = cloudIdentifier => {
+  switch (cloudIdentifier) {
+    case CLOUD_IDENTIFIERS.GCP_EU:
+      return 'https://mc-api.commercetools.com';
+    case CLOUD_IDENTIFIERS.GCP_US:
+      return 'https://mc-api.commercetools.co';
+    default:
+      return undefined;
+  }
+};
+// Verifies that the issuer is a valid URL.
+const throwIfIssuerIsNotAValidUrl = issuer => {
+  try {
+    new _URL(issuer);
+  } catch (error) {
+    throw new Error(`Invalid issuer URL "${issuer}". Expected a valid URL to the Merchant Center API Gateway, or a cloud identifier to one of the available cloud regions. See https://docs.commercetools.com/merchant-center-customizations/concepts/merchant-center-api#hostnames.`);
+  }
+};
+// Validates required option values.
+const validateRequiredValues = options => {
+  if (!options.audience) {
+    throw new Error(`Missing required option "audience"`);
+  }
+  if (!options.issuer) {
+    throw new Error(`Missing required option "issuer"`);
+  }
+};
+// Attempt to parse the given issuer. If the value is a cloud identifier, it will
+// be mapped to one of the supported values. If not, we assume the value is a valid URL.
+const getConfiguredDefaultIssuer = options => {
+  const issuer = mapCloudIdentifierToIssuer(options.issuer);
+  if (!issuer) {
+    throwIfIssuerIsNotAValidUrl(options.issuer);
+    return options.issuer;
+  }
+  return issuer;
+};
+
+// Construct the audience from the given option + the request path.
+// If the request path is `/`, do not append it to the audience, otherwise
+// the token validation might fail because of mismatching audiences.
+const getConfiguredAudience = (options, requestPath) => {
+  // remove the trailing slash
+  const url = new _URL(`${options.audience.replace(/\/?$/, '')}${requestPath}`);
+  switch (options.audiencePolicy) {
+    case 'forward-url-origin':
+      return url.origin;
+    default:
+      {
+        if (requestPath === '/') {
+          return url.origin;
+        }
+        return `${url.origin}${url.pathname}`;
+      }
+  }
+};
+function createSessionAuthVerifier(options) {
+  validateRequiredValues(options);
+  const configuredDefaultIssuer = getConfiguredDefaultIssuer(options);
+
+  // Returns an async HTTP handler.
+  return async (request, response) => {
+    // Get the cloud identifier header, forwarded by the `/proxy/forward-to` endpoint.
+    const cloudIdentifierHeader = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.CLOUD_IDENTIFIER, `Missing "X-MC-API-Cloud-Identifier" header.`);
+    let issuer = options.inferIssuer && cloudIdentifierHeader ? mapCloudIdentifierToIssuer(cloudIdentifierHeader) ?? configuredDefaultIssuer : configuredDefaultIssuer;
+
+    // Get the `Accept-version` header, forwarded by the `/proxy/forward-to` endpoint.
+    // The version should be sent by the client making the request, to use the features of v2.
+    const proxyForwardVersion = getFirstHeaderValueOrThrow(request.headers, MC_API_PROXY_HEADERS.FORWARD_TO_VERSION, `Missing "X-MC-API-Forward-To-Version" header.`);
+    if (proxyForwardVersion === 'v1') {
+      // Fall back to legacy issuer domains
+      issuer = mapToLegacyIssuer(cloudIdentifierHeader) ?? issuer;
+    }
+    const requestUrlPath = options.getRequestUrl ? options.getRequestUrl(request) : request.originalUrl ?? request.url;
+    if (!requestUrlPath || !_startsWithInstanceProperty(requestUrlPath).call(requestUrlPath, '/')) {
+      throw new Error(`Invalid request URI path "${requestUrlPath}". Please make sure that the "request" object has either a property "originalUrl" or "url". If not, you should implement the "getRequestUrl" function and make sure to return a valid URI path value starting with "/". More info at https://docs.commercetools.com/merchant-center-customizations/concepts/integrate-with-your-own-api#validating-the-json-web-token`);
+    }
+    const audience = getConfiguredAudience(options, requestUrlPath);
+    return new _Promise((resolve, reject) => {
+      expressjwt({
+        // Dynamically provide a signing key based on the kid in the header
+        // and the singing keys provided by the JWKS endpoint
+        secret: jwksRsa.expressJwtSecret(_objectSpread(_objectSpread({
+          // Default options
+          cache: true,
+          rateLimit: true,
+          jwksRequestsPerMinute: 5
+        }, options.jwks || {}), {}, {
+          // This should be set by the middleware, no matter what.
+          jwksUri: `${issuer}/.well-known/jwks.json`
+        })),
+        requestProperty: decodedTokenKey,
+        // Validate the audience and the issuer.
+        audience,
+        issuer,
+        algorithms: ['RS256']
+        // @ts-ignore: the middleware expects an Express.js Request/Response objects
+      })(request, response ?? {}, error => {
+        if (error) {
+          reject(error);
+        } else {
+          // @ts-ignore: the Request object does not know about some additional fields
+          // like `decoded_token` and `session`
+          writeSessionContext(request);
+          resolve();
+        }
+      });
+    });
+  };
+}
+
+function createSessionMiddleware(options) {
+  const sessionAuthVerifier = createSessionAuthVerifier(options);
+  return async (request, response, next) => {
+    try {
+      await sessionAuthVerifier(request, response);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
+
+export { CLOUD_IDENTIFIERS, MC_API_URLS, createSessionAuthVerifier, createSessionMiddleware };

package/dist/declarations/src/auth.d.ts

@@ -0,0 +1,13 @@
+import type { TSessionMiddlewareOptions, TSession, TBaseRequest } from './types';
+type TDecodedJWT = {
+    sub: string;
+    iss: string;
+    [property: string]: string | string[];
+};
+declare const writeSessionContext: <Request extends TBaseRequest>(request: Request & {
+    decoded_token?: TDecodedJWT | undefined;
+    session?: TSession | undefined;
+}) => void;
+export declare const getConfiguredAudience: <Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>, requestPath: string) => string;
+declare function createSessionAuthVerifier<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request, response?: unknown) => Promise<void>;
+export { createSessionAuthVerifier, writeSessionContext };

package/dist/declarations/src/constants.d.ts

@@ -0,0 +1,46 @@
+export declare const CLOUD_IDENTIFIERS: {
+    readonly GCP_AU: "gcp-au";
+    readonly GCP_EU: "gcp-eu";
+    readonly GCP_US: "gcp-us";
+    readonly AWS_EU: "aws-eu";
+    readonly AWS_US: "aws-us";
+    /**
+     * @deprecated: use `AWS_EU` instead
+     */
+    readonly AWS_FRA: "aws-fra";
+    /**
+     * @deprecated: use `AWS_US` instead
+     */
+    readonly AWS_OHIO: "aws-ohio";
+    /**
+     * @deprecated: not supported anymore
+     */
+    readonly AWS_CN: "aws-cn";
+    readonly AZURE_US: "azure-us";
+    readonly AZURE_EU: "azure-eu";
+};
+export declare const MC_API_URLS: {
+    readonly GCP_AU: "https://mc-api.australia-southeast1.gcp.commercetools.com";
+    readonly GCP_EU: "https://mc-api.europe-west1.gcp.commercetools.com";
+    readonly GCP_US: "https://mc-api.us-central1.gcp.commercetools.com";
+    readonly AWS_EU: "https://mc-api.eu-central-1.aws.commercetools.com";
+    readonly AWS_US: "https://mc-api.us-east-2.aws.commercetools.com";
+    /**
+     * @deprecated: use `AWS_EU` instead
+     */
+    readonly AWS_FRA: "https://mc-api.eu-central-1.aws.commercetools.com";
+    /**
+     * @deprecated: use `AWS_US` instead
+     */
+    readonly AWS_OHIO: "https://mc-api.us-east-2.aws.commercetools.com";
+    /**
+     * @deprecated: not supported anymore
+     */
+    readonly AWS_CN: "https://mc-api.cn-northwest-1.aws.commercetools.cn";
+    readonly AZURE_US: "https://mc-api.eastus.azure.commercetools.com";
+    readonly AZURE_EU: "https://mc-api.germanywestcentral.azure.commercetools.com";
+};
+export declare const MC_API_PROXY_HEADERS: {
+    readonly FORWARD_TO_VERSION: "x-mc-api-forward-to-version";
+    readonly CLOUD_IDENTIFIER: "x-mc-api-cloud-identifier";
+};

package/dist/declarations/src/index.d.ts

@@ -0,0 +1,3 @@
+export { CLOUD_IDENTIFIERS, MC_API_URLS } from './constants';
+export { createSessionAuthVerifier } from './auth';
+export { default as createSessionMiddleware } from './middlewares/session-middleware';

package/dist/declarations/src/middlewares/session-middleware.d.ts

@@ -0,0 +1,4 @@
+import type { Response, NextFunction } from 'express';
+import type { TBaseRequest, TSessionMiddlewareOptions } from '../types';
+declare function createSessionMiddleware<Request extends TBaseRequest>(options: TSessionMiddlewareOptions<Request>): (request: Request, response: Response, next: NextFunction) => Promise<void>;
+export default createSessionMiddleware;

package/dist/declarations/src/types.d.ts

@@ -0,0 +1,52 @@
+import type { ExpressJwtOptions } from 'jwks-rsa';
+import { CLOUD_IDENTIFIERS } from './constants';
+export type TAudience = string;
+export type TIssuer = string;
+export type TCloudIdentifier = (typeof CLOUD_IDENTIFIERS)[keyof typeof CLOUD_IDENTIFIERS];
+export type TAudiencePolicy = 'forward-url-full-path' | 'forward-url-origin';
+export interface TBaseRequest {
+    headers: Record<string, string | string[] | undefined>;
+    url?: string;
+    originalUrl?: string;
+}
+export type TSessionMiddlewareOptions<Request extends TBaseRequest> = {
+    /**
+     * The public-facing URL used to connect to the server / serverless function.
+     * The value should only contain the origin URL (protocol, hostname, port),
+     * the request path is inferred from the incoming request.
+     */
+    audience: TAudience;
+    /**
+     * How the audience value should be exchanged between the server and the client.
+     * By default it uses the full URL (origin + pathname).
+     */
+    audiencePolicy?: TAudiencePolicy;
+    /**
+     * The cloud identifier (see `CLOUD_IDENTIFIERS`) that maps to the MC API URL
+     * of the related cloud region or the MC API URL.
+     */
+    issuer: TCloudIdentifier | TIssuer;
+    /**
+     * Determines whether the issuer should be inferred from the custom request
+     * HTTP header `x-mc-api-cloud-identifier` which is sent by the MC API when
+     * forwarding the request.
+     * This might be useful in case the server is used in multiple regions.
+     */
+    inferIssuer?: boolean;
+    /**
+     * Options for the `jwksRsa.expressJwtSecret`
+     */
+    jwks?: Omit<ExpressJwtOptions, 'jwksUri'>;
+    /**
+     * By default we assume that the `request` is a Node.js-like object having either
+     * an `originalUrl` or `url` properties.
+     * If that's not the case (for example in AWS Lambda functions) you need to correctly
+     * map the URL (URI path + query string) of the `request`.
+     */
+    getRequestUrl?: (request: Request) => string;
+};
+export type TSession = {
+    userId: string;
+    projectKey: string;
+    userPermissions?: string[];
+};

package/dist/declarations/src/utils.d.ts

@@ -0,0 +1,3 @@
+declare const getHeaderByCaseInsensitiveKey: (headers: Record<string, string | string[] | undefined>, headerKey: string) => string | undefined;
+declare const getFirstHeaderValueOrThrow: (headers: Record<string, string | string[] | undefined>, headerKey: string, errorMessage: string) => string;
+export { getHeaderByCaseInsensitiveKey, getFirstHeaderValueOrThrow };

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@commercetools-backend/express",
+  "version": "0.0.0-FEC-157-preview-releases-20241126230331",
+  "description": "Zero-config HTTP server as Express.js to facilitate development",
+  "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/commercetools/merchant-center-application-kit.git",
+    "directory": "packages-backend/express"
+  },
+  "homepage": "https://docs.commercetools.com/merchant-center-customizations",
+  "keywords": [
+    "javascript",
+    "nodejs",
+    "express",
+    "http",
+    "server",
+    "toolkit"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/commercetools-backend-express.cjs.js",
+  "module": "dist/commercetools-backend-express.esm.js",
+  "files": [
+    "dist",
+    "package.json",
+    "LICENSE",
+    "README.md"
+  ],
+  "dependencies": {
+    "@babel/runtime": "^7.22.15",
+    "@babel/runtime-corejs3": "^7.22.15",
+    "@types/express": "^4.17.17",
+    "@types/node": "^18.17.14",
+    "express": "4.20.0",
+    "express-jwt": "8.4.1",
+    "jwks-rsa": "2.1.5"
+  },
+  "devDependencies": {
+    "@tsconfig/node16": "^16.1.1",
+    "@types/jsonwebtoken": "^9.0.2",
+    "jose": "2.0.7",
+    "msw": "0.49.3"
+  }
+}