@drmhse/authos-node 0.1.3 → 0.1.5

package/README.md

@@ -192,6 +192,78 @@ app.get('/org/:slug/data',
 );
 ```
 
+### requireService(slug, options?)
+
+Requires the user's JWT to have a matching service claim. Use this for service-scoped endpoints.
+
+```ts
+app.get('/services/:slug/data',
+  requireAuth(),
+  requireService((req) => req.params.slug),
+  (req, res) => { ... }
+);
+```
+
+### requireTenant(orgSlug, serviceSlug, options?)
+
+Requires the user to belong to a specific org AND service. Provides complete tenant isolation.
+
+```ts
+app.get('/orgs/:org/services/:service/data',
+  requireAuth(),
+  requireTenant(
+    (req) => req.params.org,
+    (req) => req.params.service
+  ),
+  (req, res) => { ... }
+);
+```
+
+## Understanding JWT Context
+
+The middleware functions check claims embedded in the JWT by the client SDK during login:
+
+| SDK Initialization | JWT Claims | Middleware to Use |
+|-------------------|-----------|------------------|
+| Platform-level (`baseURL` only) | `is_platform_owner: true` | `requirePlatformOwner()` |
+| Org-level (`baseURL` + `org`) | `org: 'slug'` | `requireOrganization()` |
+| Service-level (`baseURL` + `org` + `service`) | `org: 'slug'`, `service: 'app'` | `requireTenant()` or `requireService()` |
+| With permissions | `permissions: ['users:write', ...]` | `requirePermission()` |
+
+### How It Works
+
+1. **Client-side**: User logs in via `@drmhse/sso-sdk` or `@drmhse/authos-react`
+2. **JWT issued**: AuthOS embeds context (`org`, `service`, `is_platform_owner`) in claims
+3. **Server-side**: This package verifies the JWT and middleware checks the claims
+
+```ts
+// Example: Route for tenant-specific data
+app.get('/orgs/:org/services/:service/data',
+  requireAuth(),                                    // 1. Verify JWT signature
+  requireTenant(                                    // 2. Check org + service claims
+    (req) => req.params.org,
+    (req) => req.params.service
+  ),
+  (req, res) => {
+    // User is authenticated AND belongs to this org+service
+    res.json({ 
+      org: req.auth?.claims.org,
+      service: req.auth?.claims.service 
+    });
+  }
+);
+
+// Example: Route for platform owners only
+app.get('/platform/analytics',
+  requireAuth(),           // 1. Verify JWT signature
+  requirePlatformOwner(),  // 2. Check is_platform_owner: true
+  (req, res) => {
+    // User is a platform owner
+    res.json({ data: '...' });
+  }
+);
+```
+
 ## Webhook Verification
 
 Verify webhooks from AuthOS:

package/dist/express.d.mts

@@ -19,6 +19,8 @@ declare function createAuthMiddleware(options: AuthOSNodeOptions): {
     requireAllPermissions: (permissions: string[], permOptions?: RequirePermissionOptions) => RequestHandler;
     requirePlatformOwner: (permOptions?: RequirePermissionOptions) => RequestHandler;
     requireOrganization: (getOrgSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
+    requireService: (getServiceSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
+    requireTenant: (getOrgSlug: string | ((req: Request) => string), getServiceSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
 };
 
 export { createAuthMiddleware };

package/dist/express.d.ts

@@ -19,6 +19,8 @@ declare function createAuthMiddleware(options: AuthOSNodeOptions): {
     requireAllPermissions: (permissions: string[], permOptions?: RequirePermissionOptions) => RequestHandler;
     requirePlatformOwner: (permOptions?: RequirePermissionOptions) => RequestHandler;
     requireOrganization: (getOrgSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
+    requireService: (getServiceSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
+    requireTenant: (getOrgSlug: string | ((req: Request) => string), getServiceSlug: string | ((req: Request) => string), permOptions?: RequirePermissionOptions) => RequestHandler;
 };
 
 export { createAuthMiddleware };

package/dist/express.js

@@ -382,13 +382,76 @@ function createAuthMiddleware(options) {
       next();
     };
   }
+  function requireService(getServiceSlug, permOptions = {}) {
+    const { message = "Service access required" } = permOptions;
+    return (req, res, next) => {
+      if (!req.auth) {
+        res.status(401).json({
+          error: "Unauthorized",
+          message: "Authentication required",
+          code: "NOT_AUTHENTICATED"
+        });
+        return;
+      }
+      const requiredService = typeof getServiceSlug === "function" ? getServiceSlug(req) : getServiceSlug;
+      const userService = req.auth.claims.service;
+      if (!userService || userService !== requiredService) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_SERVICE",
+          required: requiredService
+        });
+        return;
+      }
+      next();
+    };
+  }
+  function requireTenant(getOrgSlug, getServiceSlug, permOptions = {}) {
+    const { message = "Tenant access required" } = permOptions;
+    return (req, res, next) => {
+      if (!req.auth) {
+        res.status(401).json({
+          error: "Unauthorized",
+          message: "Authentication required",
+          code: "NOT_AUTHENTICATED"
+        });
+        return;
+      }
+      const requiredOrg = typeof getOrgSlug === "function" ? getOrgSlug(req) : getOrgSlug;
+      const requiredService = typeof getServiceSlug === "function" ? getServiceSlug(req) : getServiceSlug;
+      const userOrg = req.auth.claims.org;
+      const userService = req.auth.claims.service;
+      if (!userOrg || userOrg !== requiredOrg) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_ORGANIZATION",
+          required: { org: requiredOrg, service: requiredService }
+        });
+        return;
+      }
+      if (!userService || userService !== requiredService) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_SERVICE",
+          required: { org: requiredOrg, service: requiredService }
+        });
+        return;
+      }
+      next();
+    };
+  }
   return {
     requireAuth,
     requirePermission,
     requireAnyPermission,
     requireAllPermissions,
     requirePlatformOwner,
-    requireOrganization
+    requireOrganization,
+    requireService,
+    requireTenant
   };
 }
 

package/dist/express.mjs

@@ -360,13 +360,76 @@ function createAuthMiddleware(options) {
       next();
     };
   }
+  function requireService(getServiceSlug, permOptions = {}) {
+    const { message = "Service access required" } = permOptions;
+    return (req, res, next) => {
+      if (!req.auth) {
+        res.status(401).json({
+          error: "Unauthorized",
+          message: "Authentication required",
+          code: "NOT_AUTHENTICATED"
+        });
+        return;
+      }
+      const requiredService = typeof getServiceSlug === "function" ? getServiceSlug(req) : getServiceSlug;
+      const userService = req.auth.claims.service;
+      if (!userService || userService !== requiredService) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_SERVICE",
+          required: requiredService
+        });
+        return;
+      }
+      next();
+    };
+  }
+  function requireTenant(getOrgSlug, getServiceSlug, permOptions = {}) {
+    const { message = "Tenant access required" } = permOptions;
+    return (req, res, next) => {
+      if (!req.auth) {
+        res.status(401).json({
+          error: "Unauthorized",
+          message: "Authentication required",
+          code: "NOT_AUTHENTICATED"
+        });
+        return;
+      }
+      const requiredOrg = typeof getOrgSlug === "function" ? getOrgSlug(req) : getOrgSlug;
+      const requiredService = typeof getServiceSlug === "function" ? getServiceSlug(req) : getServiceSlug;
+      const userOrg = req.auth.claims.org;
+      const userService = req.auth.claims.service;
+      if (!userOrg || userOrg !== requiredOrg) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_ORGANIZATION",
+          required: { org: requiredOrg, service: requiredService }
+        });
+        return;
+      }
+      if (!userService || userService !== requiredService) {
+        res.status(403).json({
+          error: "Forbidden",
+          message,
+          code: "WRONG_SERVICE",
+          required: { org: requiredOrg, service: requiredService }
+        });
+        return;
+      }
+      next();
+    };
+  }
   return {
     requireAuth,
     requirePermission,
     requireAnyPermission,
     requireAllPermissions,
     requirePlatformOwner,
-    requireOrganization
+    requireOrganization,
+    requireService,
+    requireTenant
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@drmhse/authos-node",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Node.js server adapter for AuthOS authentication - Express middleware and token verification",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -58,7 +58,7 @@
     }
   },
   "dependencies": {
-    "@drmhse/sso-sdk": "^0.3.8"
+    "@drmhse/sso-sdk": "^0.3.10"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",