@degenerate/endpoints 0.1.7 → 0.4.0

package/README.md

@@ -29,3 +29,21 @@ npm install @degenerate/endpoints
 ts-node ./packages/endpoints/src/examples/express-server/server.ts
 ```
 
+## OpenAPI
+
+The example server exposes a machine-readable description of its HTTP surface at:
+
+```
+GET /openapi.json
+```
+
+This route is public (no JWT) so codegen, Swagger UI, and contract-testing tools can fetch it freely. The document is an OpenAPI 3.0 spec generated by `buildOpenApiDocument()` from the same Zod schemas the routes validate against — request and response shapes never drift from what the handlers actually accept. To build the document outside the server (e.g. to write it to a file):
+
+```ts
+import { buildOpenApiDocument } from '@degenerate/endpoints';
+
+const spec = buildOpenApiDocument();
+```
+
+The operation surface is described by the `OperationDescriptor` arrays under `src/routes/**/**.openapi.ts`; a coverage test asserts the descriptors and the mounted Express routes stay in lockstep.
+

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.d.ts

@@ -0,0 +1,41 @@
+import { RequestHandler } from 'express';
+import { AuthorizationAudience } from '@degenerate/generic';
+/**
+ * Returns an Express middleware that cryptographically verifies the request's
+ * Bearer JWT against the registered authority for the supplied audience.
+ *
+ * Verification flow mirrors `createShareDataAuthenticate` in
+ * `@degenerate/realtime/server/authorities-bridge.ts` — the HTTP and WS auth
+ * paths use the same primitives, so a token issued for one audience verifies
+ * consistently across both transports.
+ *
+ * Steps:
+ *   1. Read `req.app.get('authorizedAuthorities')` — host application must
+ *      have registered an {@link AuthorizedAuthorities} instance at app
+ *      construction time (see `createApp` in the example express server).
+ *   2. Extract the Bearer token from the `Authorization` header. Missing
+ *      header or wrong scheme → `RequestNotAuthorizedError`.
+ *   3. Peek the token's `iss` claim via `determineIssuerFromBearerToken`
+ *      (no signature check yet — just enough to know which key to look up).
+ *   4. Look up the issuer's verification key for the supplied audience. No
+ *      registered key → `RequestNotAuthorizedError` (issuer is unknown to
+ *      this server, regardless of whether the signature would otherwise be
+ *      valid).
+ *   5. Run `decodeBearerToken` — verifies signature, issuer match, and
+ *      payload schema (`verifyTokenPayload` enforces audience/sub/iat/nbf/exp
+ *      formatting). Failure → `RequestNotAuthorizedError`.
+ *   6. Defense-in-depth: re-check `payload.aud === audience`. `decodeBearerToken`
+ *      validates the payload schema but does not assert audience matches the
+ *      route's expectation — without this, a token issued for the EVENTS
+ *      audience could be used on a SHAREDATA route.
+ *   7. Attach the decoded payload to `req.auth` and call `next()`.
+ *
+ * Failure mode is uniform: every reject throws `RequestNotAuthorizedError`.
+ * Pre-verification rejects (missing/empty/wrong-scheme Authorization header,
+ * unregistered authorities) carry a specific message; token-verification
+ * failures are deliberately normalized to "Bearer token verification failed"
+ * so callers can't probe which check failed. The existing
+ * `unauthorizedHandler` error middleware turns these into 403 responses.
+ */
+export declare const buildValidateJWTForAudience: (audience: AuthorizationAudience) => RequestHandler;
+//# sourceMappingURL=build-validate-jwt-for-audience.d.ts.map

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-validate-jwt-for-audience.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/build-validate-jwt-for-audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EACH,qBAAqB,EAKxB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,2BAA2B,GACpC,UAAU,qBAAqB,KAChC,cA0CF,CAAC"}

package/dist/cors/authority/jwt/build-validate-jwt-for-audience.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildValidateJWTForAudience = void 0;
+const generic_1 = require("@degenerate/generic");
+/**
+ * Returns an Express middleware that cryptographically verifies the request's
+ * Bearer JWT against the registered authority for the supplied audience.
+ *
+ * Verification flow mirrors `createShareDataAuthenticate` in
+ * `@degenerate/realtime/server/authorities-bridge.ts` — the HTTP and WS auth
+ * paths use the same primitives, so a token issued for one audience verifies
+ * consistently across both transports.
+ *
+ * Steps:
+ *   1. Read `req.app.get('authorizedAuthorities')` — host application must
+ *      have registered an {@link AuthorizedAuthorities} instance at app
+ *      construction time (see `createApp` in the example express server).
+ *   2. Extract the Bearer token from the `Authorization` header. Missing
+ *      header or wrong scheme → `RequestNotAuthorizedError`.
+ *   3. Peek the token's `iss` claim via `determineIssuerFromBearerToken`
+ *      (no signature check yet — just enough to know which key to look up).
+ *   4. Look up the issuer's verification key for the supplied audience. No
+ *      registered key → `RequestNotAuthorizedError` (issuer is unknown to
+ *      this server, regardless of whether the signature would otherwise be
+ *      valid).
+ *   5. Run `decodeBearerToken` — verifies signature, issuer match, and
+ *      payload schema (`verifyTokenPayload` enforces audience/sub/iat/nbf/exp
+ *      formatting). Failure → `RequestNotAuthorizedError`.
+ *   6. Defense-in-depth: re-check `payload.aud === audience`. `decodeBearerToken`
+ *      validates the payload schema but does not assert audience matches the
+ *      route's expectation — without this, a token issued for the EVENTS
+ *      audience could be used on a SHAREDATA route.
+ *   7. Attach the decoded payload to `req.auth` and call `next()`.
+ *
+ * Failure mode is uniform: every reject throws `RequestNotAuthorizedError`.
+ * Pre-verification rejects (missing/empty/wrong-scheme Authorization header,
+ * unregistered authorities) carry a specific message; token-verification
+ * failures are deliberately normalized to "Bearer token verification failed"
+ * so callers can't probe which check failed. The existing
+ * `unauthorizedHandler` error middleware turns these into 403 responses.
+ */
+const buildValidateJWTForAudience = (audience) => {
+    return (req, _res, next) => {
+        const authorities = req.app.get('authorizedAuthorities');
+        if (!authorities) {
+            throw new generic_1.RequestNotAuthorizedError('authorizedAuthorities is not registered on the app — see createApp()');
+        }
+        const authHeader = req.headers.authorization;
+        if (typeof authHeader !== 'string' || !authHeader.startsWith('Bearer ')) {
+            throw new generic_1.RequestNotAuthorizedError('Missing or malformed Authorization header (expected "Bearer <token>")');
+        }
+        const token = authHeader.slice('Bearer '.length).trim();
+        if (!token) {
+            throw new generic_1.RequestNotAuthorizedError('Bearer token is empty');
+        }
+        let payload;
+        try {
+            // All four verification steps (issuer peek → key lookup →
+            // signature/payload verify → audience defense-in-depth) are
+            // centralized in @degenerate/generic so the HTTP and WS
+            // transports can't drift on which checks they run.
+            payload = (0, generic_1.verifyJwtBearerTokenForAudience)(token, authorities, audience);
+        }
+        catch {
+            // Normalize every failure mode to one Express-friendly error.
+            // The underlying helper throws specific error classes; we
+            // collapse them so the existing unauthorized-handler chain
+            // turns them all into a 403.
+            throw new generic_1.RequestNotAuthorizedError('Bearer token verification failed');
+        }
+        req.auth = payload;
+        next();
+    };
+};
+exports.buildValidateJWTForAudience = buildValidateJWTForAudience;

package/dist/cors/authority/jwt/validate-jwt-authorities.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the AUTHORITIES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTAuthorities(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTAuthorities: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-authorities.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-authorities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-authorities.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-authorities.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAc3F"}
+{"version":3,"file":"validate-jwt-authorities.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-authorities.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,8IAElC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-authorities.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTAuthorities = validateJWTAuthorities;
+exports.validateJWTAuthorities = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the AUTHORITIES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTAuthorities(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.AUTHORITIES) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for authorities');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTAuthorities = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.AUTHORITIES);

package/dist/cors/authority/jwt/validate-jwt-endpoints.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the ENDPOINTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTEndpoints(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTEndpoints: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-endpoints.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-endpoints.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-endpoints.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-endpoints.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTEndpoints = validateJWTEndpoints;
+exports.validateJWTEndpoints = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the ENDPOINTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTEndpoints(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.ENDPOINTS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for endpoints');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTEndpoints = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.ENDPOINTS);

package/dist/cors/authority/jwt/validate-jwt-events.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the EVENTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTEvents(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTEvents: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-events.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-events.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-events.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBActF"}
+{"version":3,"file":"validate-jwt-events.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-events.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,8IAE7B,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-events.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTEvents = validateJWTEvents;
+exports.validateJWTEvents = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the EVENTS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTEvents(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.EVENTS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for events');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTEvents = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.EVENTS);

package/dist/cors/authority/jwt/validate-jwt-functions.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the FUNCTIONS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTFunctions(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTFunctions: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-functions.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-functions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-functions.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-functions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-functions.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-functions.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-functions.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTFunctions = validateJWTFunctions;
+exports.validateJWTFunctions = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the FUNCTIONS audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTFunctions(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.FUNCTIONS) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for functions');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTFunctions = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.FUNCTIONS);

package/dist/cors/authority/jwt/validate-jwt-rules.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the RULES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTRules(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTRules: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-rules.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-rules.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-rules.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAcrF"}
+{"version":3,"file":"validate-jwt-rules.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-rules.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,8IAE5B,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-rules.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTRules = validateJWTRules;
+exports.validateJWTRules = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the RULES audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTRules(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.RULES) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for rules');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTRules = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.RULES);

package/dist/cors/authority/jwt/validate-jwt-share-data.d.ts

@@ -1,16 +1,8 @@
-import { Request, Response, NextFunction } from 'express';
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the SHAREDATA audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-export declare function validateJWTShareData(req: Request, res: Response, next: NextFunction): Promise<void>;
+export declare const validateJWTShareData: import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;
 //# sourceMappingURL=validate-jwt-share-data.d.ts.map

package/dist/cors/authority/jwt/validate-jwt-share-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-jwt-share-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-share-data.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,iBAczF"}
+{"version":3,"file":"validate-jwt-share-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/authority/jwt/validate-jwt-share-data.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8IAEhC,CAAC"}

package/dist/cors/authority/jwt/validate-jwt-share-data.js

@@ -1,32 +1,12 @@
 "use strict";
-/* eslint-disable @typescript-eslint/no-explicit-any */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateJWTShareData = validateJWTShareData;
+exports.validateJWTShareData = void 0;
 const generic_1 = require("@degenerate/generic");
-const get_set_audiences_1 = require("../audience/get-set-audiences");
+const build_validate_jwt_for_audience_1 = require("./build-validate-jwt-for-audience");
 /**
- * This function validates that the incoming request has a valid JWT token and it is authorized
- * for the expected function.
- *
- * Is is used as part of the CORS protection and adds a user object to the request 'req.user'
- * if this is successful.
- *
- * @param req the incoming request
- * @param res the response object
- * @param next CORS next function
- *
- * @returns the next step if the validation succeeds or a unauthorized or disallowed response.
+ * Express middleware that cryptographically verifies the request's Bearer
+ * JWT for the SHAREDATA audience. Thin wrapper around
+ * {@link buildValidateJWTForAudience}; behavior, failure modes, and the
+ * `req.auth` attachment are documented on that helper.
  */
-async function validateJWTShareData(req, res, next) {
-    // get audience from the request
-    const audience = (0, get_set_audiences_1.getAudienceAuthority)(req);
-    if (!audience) {
-        throw new generic_1.RequestNotAuthorizedError('No audience found in the request');
-    }
-    if (audience !== generic_1.AuthorizationAudience.SHAREDATA) {
-        throw new generic_1.RequestNotAuthorizedError('the audience included is not for share data');
-    }
-    // check if an Authority is present.
-    next();
-    return;
-}
+exports.validateJWTShareData = (0, build_validate_jwt_for_audience_1.buildValidateJWTForAudience)(generic_1.AuthorizationAudience.SHAREDATA);

package/dist/cors/endpoints/helpers/validate-incoming-request-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-incoming-request-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/endpoints/helpers/validate-incoming-request-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,SAClE,OAAO,OAAO,QAAQ,QAAQ,YAAY,UAa1D"}
+{"version":3,"file":"validate-incoming-request-data.d.ts","sourceRoot":"","sources":["../../../../src/cors/endpoints/helpers/validate-incoming-request-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,SAAS,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,IACvE,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAa1D"}

package/dist/cors/endpoints/helpers/validate-incoming-request-data.js

@@ -33,5 +33,5 @@ function validateIncomingRequestData(schema) {
  * @returns an array of formatted error messages
  */
 function formatZodErrors(error) {
-    return error.errors.map((issue) => `${issue.path.join('.')} is ${issue.message}`);
+    return error.issues.map((issue) => `${issue.path.join('.')} is ${issue.message}`);
 }

package/dist/cors/index.d.ts

@@ -1,4 +1,5 @@
 export * from './authority/audience/get-set-audiences';
+export * from './authority/jwt/build-validate-jwt-for-audience';
 export * from './authority/jwt/validate-jwt-authorities';
 export * from './authority/jwt/validate-jwt-endpoints';
 export * from './authority/jwt/validate-jwt-events';

package/dist/cors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AAGxD,cAAc,oDAAoD,CAAC;AAEnE,cAAc,2CAA2C,CAAC;AAI1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAI9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cors/index.ts"],"names":[],"mappings":"AAAA,cAAc,wCAAwC,CAAC;AACvD,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,yCAAyC,CAAC;AAGxD,cAAc,oDAAoD,CAAC;AAEnE,cAAc,2CAA2C,CAAC;AAI1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAI9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,2BAA2B,CAAC"}

package/dist/cors/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./authority/audience/get-set-audiences"), exports);
+__exportStar(require("./authority/jwt/build-validate-jwt-for-audience"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-authorities"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-endpoints"), exports);
 __exportStar(require("./authority/jwt/validate-jwt-events"), exports);