@degenerate/endpoints 0.1.7 → 0.2.0

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.d.ts

@@ -0,0 +1,41 @@
+import { RequestHandler } from 'express';
+import { AuthorizationAudience } from '@degenerate/generic';
+/**
+ * Returns an Express middleware that cryptographically verifies the request's
+ * Bearer JWT against the registered authority for the supplied audience.
+ *
+ * Verification flow mirrors `createShareDataAuthenticate` in
+ * `@degenerate/realtime/server/authorities-bridge.ts` — the HTTP and WS auth
+ * paths use the same primitives, so a token issued for one audience verifies
+ * consistently across both transports.
+ *
+ * Steps:
+ *   1. Read `req.app.get('authorizedAuthorities')` — host application must
+ *      have registered an {@link AuthorizedAuthorities} instance at app
+ *      construction time (see `createApp` in the example express server).
+ *   2. Extract the Bearer token from the `Authorization` header. Missing
+ *      header or wrong scheme → `RequestNotAuthorizedError`.
+ *   3. Peek the token's `iss` claim via `determineIssuerFromBearerToken`
+ *      (no signature check yet — just enough to know which key to look up).
+ *   4. Look up the issuer's verification key for the supplied audience. No
+ *      registered key → `RequestNotAuthorizedError` (issuer is unknown to
+ *      this server, regardless of whether the signature would otherwise be
+ *      valid).
+ *   5. Run `decodeBearerToken` — verifies signature, issuer match, and
+ *      payload schema (`verifyTokenPayload` enforces audience/sub/iat/nbf/exp
+ *      formatting). Failure → `RequestNotAuthorizedError`.
+ *   6. Defense-in-depth: re-check `payload.aud === audience`. `decodeBearerToken`
+ *      validates the payload schema but does not assert audience matches the
+ *      route's expectation — without this, a token issued for the EVENTS
+ *      audience could be used on a SHAREDATA route.
+ *   7. Attach the decoded payload to `req.auth` and call `next()`.
+ *
+ * Failure mode is uniform: every reject throws `RequestNotAuthorizedError`.
+ * Pre-verification rejects (missing/empty/wrong-scheme Authorization header,
+ * unregistered authorities) carry a specific message; token-verification
+ * failures are deliberately normalized to "Bearer token verification failed"
+ * so callers can't probe which check failed. The existing
+ * `unauthorizedHandler` error middleware turns these into 403 responses.
+ */
+export declare const buildValidateJWTForAudience: (audience: AuthorizationAudience) => RequestHandler;
+//# sourceMappingURL=build-validate-jwt-for-audience.d.ts.map

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-validate-jwt-for-audience.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/build-validate-jwt-for-audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EACH,qBAAqB,EAKxB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,2BAA2B,GACpC,UAAU,qBAAqB,KAChC,cA0CF,CAAC"}

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildValidateJWTForAudience = void 0;
+const generic_1 = require("@degenerate/generic");
+/**
+ * Returns an Express middleware that cryptographically verifies the request's
+ * Bearer JWT against the registered authority for the supplied audience.
+ *
+ * Verification flow mirrors `createShareDataAuthenticate` in
+ * `@degenerate/realtime/server/authorities-bridge.ts` — the HTTP and WS auth
+ * paths use the same primitives, so a token issued for one audience verifies
+ * consistently across both transports.
+ *
+ * Steps:
+ *   1. Read `req.app.get('authorizedAuthorities')` — host application must
+ *      have registered an {@link AuthorizedAuthorities} instance at app
+ *      construction time (see `createApp` in the example express server).
+ *   2. Extract the Bearer token from the `Authorization` header. Missing
+ *      header or wrong scheme → `RequestNotAuthorizedError`.
+ *   3. Peek the token's `iss` claim via `determineIssuerFromBearerToken`
+ *      (no signature check yet — just enough to know which key to look up).
+ *   4. Look up the issuer's verification key for the supplied audience. No
+ *      registered key → `RequestNotAuthorizedError` (issuer is unknown to
+ *      this server, regardless of whether the signature would otherwise be
+ *      valid).
+ *   5. Run `decodeBearerToken` — verifies signature, issuer match, and
+ *      payload schema (`verifyTokenPayload` enforces audience/sub/iat/nbf/exp
+ *      formatting). Failure → `RequestNotAuthorizedError`.
+ *   6. Defense-in-depth: re-check `payload.aud === audience`. `decodeBearerToken`
+ *      validates the payload schema but does not assert audience matches the
+ *      route's expectation — without this, a token issued for the EVENTS
+ *      audience could be used on a SHAREDATA route.
+ *   7. Attach the decoded payload to `req.auth` and call `next()`.
+ *
+ * Failure mode is uniform: every reject throws `RequestNotAuthorizedError`.
+ * Pre-verification rejects (missing/empty/wrong-scheme Authorization header,
+ * unregistered authorities) carry a specific message; token-verification
+ * failures are deliberately normalized to "Bearer token verification failed"
+ * so callers can't probe which check failed. The existing
+ * `unauthorizedHandler` error middleware turns these into 403 responses.
+ */
+const buildValidateJWTForAudience = (audience) => {
+    return (req, _res, next) => {
+        const authorities = req.app.get('authorizedAuthorities');
+        if (!authorities) {
+            throw new generic_1.RequestNotAuthorizedError('authorizedAuthorities is not registered on the app — see createApp()');
+        }
+        const authHeader = req.headers.authorization;
+        if (typeof authHeader !== 'string' || !authHeader.startsWith('Bearer ')) {
+            throw new generic_1.RequestNotAuthorizedError('Missing or malformed Authorization header (expected "Bearer <token>")');
+        }
+        const token = authHeader.slice('Bearer '.length).trim();
+        if (!token) {
+            throw new generic_1.RequestNotAuthorizedError('Bearer token is empty');
+        }
+        let payload;
+        try {
+            // All four verification steps (issuer peek → key lookup →
+            // signature/payload verify → audience defense-in-depth) are
+            // centralized in @degenerate/generic so the HTTP and WS
+            // transports can't drift on which checks they run.
+            payload = (0, generic_1.verifyJwtBearerTokenForAudience)(token, authorities, audience);
+        }
+        catch {
+            // Normalize every failure mode to one Express-friendly error.
+            // The underlying helper throws specific error classes; we
+            // collapse them so the existing unauthorized-handler chain
+            // turns them all into a 403.
+            throw new generic_1.RequestNotAuthorizedError('Bearer token verification failed');
+        }
+        req.auth = payload;
+        next();
+    };
+};
+exports.buildValidateJWTForAudience = buildValidateJWTForAudience;

package/dist/cors/authority/jwt/validate-jwt-authorities.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the AUTHORITIES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTAuthorities(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTAuthorities: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-authorities.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-authorities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-authorities.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-authorities.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAc3F"}
+{"version":3,"file":"validate-jwt-authorities.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-authorities.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,8IAElC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-authorities.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTAuthorities = validateJWTAuthorities;
+exports.validateJWTAuthorities = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the AUTHORITIES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTAuthorities(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.AUTHORITIES) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for authorities');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTAuthorities = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.AUTHORITIES);

package/dist/cors/authority/jwt/validate-jwt-endpoints.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the ENDPOINTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTEndpoints(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTEndpoints: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-endpoints.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-endpoints.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-endpoints.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-endpoints.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTEndpoints = validateJWTEndpoints;
+exports.validateJWTEndpoints = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the ENDPOINTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTEndpoints(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.ENDPOINTS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for endpoints');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTEndpoints = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.ENDPOINTS);

package/dist/cors/authority/jwt/validate-jwt-events.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the EVENTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTEvents(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTEvents: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-events.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-events.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-events.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBActF"}
+{"version":3,"file":"validate-jwt-events.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-events.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8IAE7B,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-events.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTEvents = validateJWTEvents;
+exports.validateJWTEvents = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the EVENTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTEvents(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.EVENTS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for events');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTEvents = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.EVENTS);

package/dist/cors/authority/jwt/validate-jwt-functions.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the FUNCTIONS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTFunctions(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTFunctions: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-functions.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-functions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-functions.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-functions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-functions.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-functions.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-functions.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTFunctions = validateJWTFunctions;
+exports.validateJWTFunctions = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the FUNCTIONS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTFunctions(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.FUNCTIONS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for functions');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTFunctions = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.FUNCTIONS);

package/dist/cors/authority/jwt/validate-jwt-rules.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the RULES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTRules(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTRules: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-rules.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-rules.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-rules.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAcrF"}
+{"version":3,"file":"validate-jwt-rules.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-rules.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,8IAE5B,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-rules.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTRules = validateJWTRules;
+exports.validateJWTRules = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the RULES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTRules(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.RULES) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for rules');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTRules = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.RULES);

package/dist/cors/authority/jwt/validate-jwt-share-data.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the SHAREDATA audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTShareData(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTShareData: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-share-data.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-share-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-share-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-share-data.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-share-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-share-data.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-share-data.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTShareData = validateJWTShareData;
+exports.validateJWTShareData = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the SHAREDATA audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTShareData(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.SHAREDATA) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for share data');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTShareData = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.SHAREDATA);

package/dist/cors/endpoints/helpers/validate-incoming-request-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-incoming-request-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/endpoints/helpers/validate-incoming-request-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,SAClE,OAAO,OAAO,QAAQ,QAAQ,YAAY,UAa1D"}
+{"version":3,"file":"validate-incoming-request-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/endpoints/helpers/validate-incoming-request-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,IACvE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAa1D"}

package/dist/cors/endpoints/helpers/validate-incoming-request-data.js

@@ -33,5 +33,5 @@ function validateIncomingRequestData(schema) {
  * @returns an array of formatted error messages
  */
 function formatZodErrors(error) {
-    return error.errors.map((issue) => `${issue.path.join('.')} is ${issue.message}`);
+    return error.issues.map((issue) => `${issue.path.join('.')} is ${issue.message}`);
 }

package/dist/cors/index.d.ts

@@ -1,4 +1,5 @@
 export * from './authority/audience/get-set-audiences';
+export * from './authority/jwt/build-validate-jwt-for-audience';
 export * from './authority/jwt/validate-jwt-authorities';
 export * from './authority/jwt/validate-jwt-endpoints';
 export * from './authority/jwt/validate-jwt-events';

package/dist/cors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AAGxD,cAAc,oDAAoD,CAAC;AAEnE,cAAc,2CAA2C,CAAC;AAI1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAI9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AAGxD,cAAc,oDAAoD,CAAC;AAEnE,cAAc,2CAA2C,CAAC;AAI1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAI9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC"}

package/dist/cors/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authority/audience/get-set-audiences"), exports);
+__exportStar(require("./authority/jwt/build-validate-jwt-for-audience"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-authorities"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-endpoints"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-events"), exports);

package/dist/examples/express-server/app.d.ts

@@ -1,3 +1,21 @@
-declare const app: import("express-serve-static-core").Express;
-export default app;
+import express, { type Express } from 'express';
+import { AuthorizedAuthorities } from '@degenerate/generic';
+import { ShareDataManager } from '@degenerate/sharedata';
+export interface CreateAppResult {
+    app: Express;
+    authorizedAuthorities: AuthorizedAuthorities;
+    shareDataManager: ShareDataManager;
+}
+/**
+ * Builds a fresh Express app with all SAFE routes wired in. Returns the app
+ * along with the shared `ShareDataManager` instance — handed back so callers
+ * (e.g. `createSafeServer` for realtime attachment) can subscribe to its
+ * events without reaching into `app.locals`.
+ *
+ * Route handlers access the manager via `req.app.get('shareDataManager')`,
+ * matching the existing `authorizedAuthorities` pattern.
+ */
+export declare function createApp(): CreateAppResult;
+declare const _default: express.Express;
+export default _default;
 //# sourceMappingURL=app.d.ts.map

package/dist/examples/express-server/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/examples/express-server/app.ts"],"names":[],"mappings":"AAeA,QAAA,MAAM,GAAG,6CAAY,CAAC;AAsBtB,eAAe,GAAG,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/examples/express-server/app.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAWzD,MAAM,WAAW,eAAe;IAC5B,GAAG,EAAE,OAAO,CAAC;IACb,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAqB3C;;AAKD,wBAAmC"}