@daltonr/authwrite-express 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import type { RequestHandler, Request, Response } from 'express';
+import type { AuthEvaluator, Decision, Subject, Resource } from '@daltonr/authwrite-core';
+declare global {
+    namespace Express {
+        interface Request {
+            authDecision?: Decision;
+        }
+    }
+}
+export interface AuthMiddlewareConfig<S extends Subject = Subject, R extends Resource = Resource> {
+    engine: AuthEvaluator<S, R>;
+    subject: (req: Request) => S | Promise<S>;
+    resource?: (req: Request) => R | undefined | Promise<R | undefined>;
+    action: string | ((req: Request) => string);
+    onDeny?: (req: Request, res: Response, decision: Decision) => void | Promise<void>;
+}
+export declare function createAuthMiddleware<S extends Subject = Subject, R extends Resource = Resource>(config: AuthMiddlewareConfig<S, R>): RequestHandler;
+export interface ExpressAuthConfig<S extends Subject = Subject, R extends Resource = Resource> {
+    engine: AuthEvaluator<S, R>;
+    subject: (req: Request) => S | Promise<S>;
+    resource?: (req: Request) => R | undefined | Promise<R | undefined>;
+    onDeny?: (req: Request, res: Response, decision: Decision) => void | Promise<void>;
+}
+export declare function createExpressAuth<S extends Subject = Subject, R extends Resource = Resource>(base: ExpressAuthConfig<S, R>): (action: string | ((req: Request) => string), overrides?: Partial<ExpressAuthConfig<S, R>>) => RequestHandler;

package/dist/index.js

@@ -0,0 +1,30 @@
+// ─── Middleware factory ───────────────────────────────────────────────────────
+export function createAuthMiddleware(config) {
+    return async (req, res, next) => {
+        try {
+            const subject = await config.subject(req);
+            const resource = config.resource ? await config.resource(req) : undefined;
+            const action = typeof config.action === 'function' ? config.action(req) : config.action;
+            const decision = await config.engine.evaluate({ subject, resource, action });
+            req.authDecision = decision;
+            if (decision.allowed) {
+                next();
+                return;
+            }
+            if (config.onDeny) {
+                await config.onDeny(req, res, decision);
+                return;
+            }
+            res.status(403).json({ error: 'forbidden', reason: decision.reason });
+        }
+        catch (err) {
+            next(err);
+        }
+    };
+}
+export function createExpressAuth(base) {
+    return function auth(action, overrides) {
+        return createAuthMiddleware({ ...base, ...overrides, action });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA0BA,iFAAiF;AAEjF,MAAM,UAAU,oBAAoB,CAGlC,MAAkC;IAClC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAI,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACzE,MAAM,MAAM,GAAK,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;YAEzF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAE3E;YAAC,GAA4C,CAAC,YAAY,GAAG,QAAQ,CAAA;YAEtE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,EAAE,CAAA;gBACN,OAAM;YACR,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;gBACvC,OAAM;YACR,CAAC;YAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AA+BD,MAAM,UAAU,iBAAiB,CAG/B,IAA6B;IAC7B,OAAO,SAAS,IAAI,CAClB,MAA2C,EAC3C,SAA4C;QAE5C,OAAO,oBAAoB,CAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtE,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@daltonr/authwrite-express",
+  "version": "0.1.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "Express middleware adapter for AuthEngine.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/richardadalton/authwrite.git",
+    "directory": "packages/express"
+  },
+  "keywords": ["authorization", "authz", "express", "middleware"],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": ["dist", "src", "README.md", "LICENSE"],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "prepublishOnly": "test -d dist && echo 'dist already built, skipping' || (npm run clean && npm run build)"
+  },
+  "dependencies": {
+    "@daltonr/authwrite-core": "*"
+  },
+  "peerDependencies": {
+    "express": ">=4.0.0"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.0",
+    "express": "^5.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/index.ts

@@ -0,0 +1,99 @@
+import type { RequestHandler, Request, Response } from 'express'
+import type { AuthEvaluator, Decision, Subject, Resource } from '@daltonr/authwrite-core'
+
+// ─── Request augmentation ─────────────────────────────────────────────────────
+
+declare global {
+  namespace Express {
+    interface Request {
+      authDecision?: Decision
+    }
+  }
+}
+
+// ─── Per-middleware config ────────────────────────────────────────────────────
+
+export interface AuthMiddlewareConfig<
+  S extends Subject = Subject,
+  R extends Resource = Resource,
+> {
+  engine:    AuthEvaluator<S, R>
+  subject:   (req: Request) => S | Promise<S>
+  resource?: (req: Request) => R | undefined | Promise<R | undefined>
+  action:    string | ((req: Request) => string)
+  onDeny?:   (req: Request, res: Response, decision: Decision) => void | Promise<void>
+}
+
+// ─── Middleware factory ───────────────────────────────────────────────────────
+
+export function createAuthMiddleware<
+  S extends Subject = Subject,
+  R extends Resource = Resource,
+>(config: AuthMiddlewareConfig<S, R>): RequestHandler {
+  return async (req, res, next) => {
+    try {
+      const subject  = await config.subject(req)
+      const resource = config.resource ? await config.resource(req) : undefined
+      const action   = typeof config.action === 'function' ? config.action(req) : config.action
+
+      const decision = await config.engine.evaluate({ subject, resource, action })
+
+      ;(req as Request & { authDecision: Decision }).authDecision = decision
+
+      if (decision.allowed) {
+        next()
+        return
+      }
+
+      if (config.onDeny) {
+        await config.onDeny(req, res, decision)
+        return
+      }
+
+      res.status(403).json({ error: 'forbidden', reason: decision.reason })
+    } catch (err) {
+      next(err)
+    }
+  }
+}
+
+// ─── Bound auth factory ───────────────────────────────────────────────────────
+//
+// Captures the engine, subject resolver, resource resolver, and default onDeny
+// once. Returns a function that produces middleware for a specific action.
+// Eliminates the wrapper function pattern every integration reinvents:
+//
+//   // Before:
+//   function authFor(action: string) {
+//     return createAuthMiddleware({ engine, subject: getUser, resource: getDoc, action, onDeny })
+//   }
+//
+//   // After:
+//   const auth = createExpressAuth({ engine, subject: getUser, resource: getDoc, onDeny })
+//   app.get('/docs/:id', auth('read'), handler)
+//   app.post('/docs/:id', auth('write'), handler)
+//
+// Per-route overrides are supported:
+//   app.get('/docs/:id/admin', auth('admin-view', { resource: () => undefined }), handler)
+
+export interface ExpressAuthConfig<
+  S extends Subject = Subject,
+  R extends Resource = Resource,
+> {
+  engine:    AuthEvaluator<S, R>
+  subject:   (req: Request) => S | Promise<S>
+  resource?: (req: Request) => R | undefined | Promise<R | undefined>
+  onDeny?:   (req: Request, res: Response, decision: Decision) => void | Promise<void>
+}
+
+export function createExpressAuth<
+  S extends Subject = Subject,
+  R extends Resource = Resource,
+>(base: ExpressAuthConfig<S, R>) {
+  return function auth(
+    action: string | ((req: Request) => string),
+    overrides?: Partial<ExpressAuthConfig<S, R>>,
+  ): RequestHandler {
+    return createAuthMiddleware<S, R>({ ...base, ...overrides, action })
+  }
+}