@forklaunch/core 0.11.0 → 0.11.1

package/lib/http/index.d.mts

@@ -6,6 +6,7 @@ import { CorsOptions } from 'cors';
 import { Counter, Gauge, Histogram, UpDownCounter, ObservableCounter, ObservableGauge, ObservableUpDownCounter, Span } from '@opentelemetry/api';
 import { LevelWithSilentOrString, LevelWithSilent, Logger } from 'pino';
 export { LevelWithSilent, LevelWithSilentOrString, Logger } from 'pino';
+import { JWTPayload } from 'jose';
 import { Readable } from 'stream';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -221,6 +222,7 @@ type JwtAuthMethods = {
 type AuthMethodsBase = {
     readonly tokenPrefix?: string;
     readonly headerName?: string;
+    readonly decodeResource?: (token: string) => JWTPayload | Promise<JWTPayload>;
 } & (BasicAuthMethods | JwtAuthMethods);
 type PermissionSet = {
     readonly allowedPermissions: Set<string>;
@@ -613,7 +615,7 @@ type ExpressLikeSchemaHandler<SV extends AnySchemaValidator, P extends ParamsObj
  * @returns {Set<string> | Promise<Set<string>>} - A set of authorization strings or a promise that resolves to it.
  */
 type ExpressLikeSchemaAuthMapper<SV extends AnySchemaValidator, P extends ParamsObject<SV>, ReqBody extends Body<SV>, ReqQuery extends QueryObject<SV>, ReqHeaders extends HeadersObject<SV>, BaseRequest> = ExpressLikeAuthMapper<SV, P extends infer UnmappedParams ? UnmappedParams extends ParamsObject<SV> ? MapParamsSchema<SV, UnmappedParams> : never : never, ReqBody extends infer UnmappedReqBody ? UnmappedReqBody extends Body<SV> ? MapReqBodySchema<SV, UnmappedReqBody> : never : never, ReqQuery extends infer UnmappedReqQuery ? UnmappedReqQuery extends QueryObject<SV> ? MapReqQuerySchema<SV, UnmappedReqQuery> : never : never, ReqHeaders extends infer UnmappedReqHeaders ? UnmappedReqHeaders extends HeadersObject<SV> ? MapReqHeadersSchema<SV, UnmappedReqHeaders> : never : never, BaseRequest>;
-type ExpressLikeAuthMapper<SV extends AnySchemaValidator, P extends ParamsDictionary, ReqBody extends Record<string, unknown>, ReqQuery extends ParsedQs, ReqHeaders extends Record<string, string>, BaseRequest> = (sub: string, req?: ResolvedForklaunchRequest<SV, P, ReqBody, ReqQuery, ReqHeaders, BaseRequest>) => Set<string> | Promise<Set<string>>;
+type ExpressLikeAuthMapper<SV extends AnySchemaValidator, P extends ParamsDictionary, ReqBody extends Record<string, unknown>, ReqQuery extends ParsedQs, ReqHeaders extends Record<string, string>, BaseRequest> = (payload: JWTPayload, req?: ResolvedForklaunchRequest<SV, P, ReqBody, ReqQuery, ReqHeaders, BaseRequest>) => Set<string> | Promise<Set<string>>;
 type TokenPrefix<Auth extends AuthMethodsBase> = undefined extends Auth['tokenPrefix'] ? Auth extends BasicAuthMethods ? 'Basic ' : 'Bearer ' : `${Auth['tokenPrefix']} `;
 type AuthHeaders<Auth extends AuthMethodsBase> = undefined extends Auth['headerName'] ? {
     authorization: `${TokenPrefix<Auth>}${string}`;

package/lib/http/index.d.ts

@@ -6,6 +6,7 @@ import { CorsOptions } from 'cors';
 import { Counter, Gauge, Histogram, UpDownCounter, ObservableCounter, ObservableGauge, ObservableUpDownCounter, Span } from '@opentelemetry/api';
 import { LevelWithSilentOrString, LevelWithSilent, Logger } from 'pino';
 export { LevelWithSilent, LevelWithSilentOrString, Logger } from 'pino';
+import { JWTPayload } from 'jose';
 import { Readable } from 'stream';
 import { ZodSchemaValidator } from '@forklaunch/validator/zod';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -221,6 +222,7 @@ type JwtAuthMethods = {
 type AuthMethodsBase = {
     readonly tokenPrefix?: string;
     readonly headerName?: string;
+    readonly decodeResource?: (token: string) => JWTPayload | Promise<JWTPayload>;
 } & (BasicAuthMethods | JwtAuthMethods);
 type PermissionSet = {
     readonly allowedPermissions: Set<string>;
@@ -613,7 +615,7 @@ type ExpressLikeSchemaHandler<SV extends AnySchemaValidator, P extends ParamsObj
  * @returns {Set<string> | Promise<Set<string>>} - A set of authorization strings or a promise that resolves to it.
  */
 type ExpressLikeSchemaAuthMapper<SV extends AnySchemaValidator, P extends ParamsObject<SV>, ReqBody extends Body<SV>, ReqQuery extends QueryObject<SV>, ReqHeaders extends HeadersObject<SV>, BaseRequest> = ExpressLikeAuthMapper<SV, P extends infer UnmappedParams ? UnmappedParams extends ParamsObject<SV> ? MapParamsSchema<SV, UnmappedParams> : never : never, ReqBody extends infer UnmappedReqBody ? UnmappedReqBody extends Body<SV> ? MapReqBodySchema<SV, UnmappedReqBody> : never : never, ReqQuery extends infer UnmappedReqQuery ? UnmappedReqQuery extends QueryObject<SV> ? MapReqQuerySchema<SV, UnmappedReqQuery> : never : never, ReqHeaders extends infer UnmappedReqHeaders ? UnmappedReqHeaders extends HeadersObject<SV> ? MapReqHeadersSchema<SV, UnmappedReqHeaders> : never : never, BaseRequest>;
-type ExpressLikeAuthMapper<SV extends AnySchemaValidator, P extends ParamsDictionary, ReqBody extends Record<string, unknown>, ReqQuery extends ParsedQs, ReqHeaders extends Record<string, string>, BaseRequest> = (sub: string, req?: ResolvedForklaunchRequest<SV, P, ReqBody, ReqQuery, ReqHeaders, BaseRequest>) => Set<string> | Promise<Set<string>>;
+type ExpressLikeAuthMapper<SV extends AnySchemaValidator, P extends ParamsDictionary, ReqBody extends Record<string, unknown>, ReqQuery extends ParsedQs, ReqHeaders extends Record<string, string>, BaseRequest> = (payload: JWTPayload, req?: ResolvedForklaunchRequest<SV, P, ReqBody, ReqQuery, ReqHeaders, BaseRequest>) => Set<string> | Promise<Set<string>>;
 type TokenPrefix<Auth extends AuthMethodsBase> = undefined extends Auth['tokenPrefix'] ? Auth extends BasicAuthMethods ? 'Basic ' : 'Bearer ' : `${Auth['tokenPrefix']} `;
 type AuthHeaders<Auth extends AuthMethodsBase> = undefined extends Auth['headerName'] ? {
     authorization: `${TokenPrefix<Auth>}${string}`;

package/lib/http/index.js

@@ -147,16 +147,24 @@ function discriminateAuthMethod(auth) {
   if ("basic" in auth) {
     return {
       type: "basic",
-      auth: auth.basic
+      auth: {
+        decodeResource: auth.decodeResource,
+        login: auth.basic.login
+      }
     };
   } else if ("jwt" in auth) {
     return {
       type: "jwt",
-      auth: auth.jwt
+      auth: {
+        decodeResource: auth.decodeResource
+      }
     };
   } else {
     return {
-      type: "jwt"
+      type: "jwt",
+      auth: {
+        decodeResource: auth.decodeResource
+      }
     };
   }
 }
@@ -209,32 +217,38 @@ async function checkAuthorizationToken(authorizationMethod, authorizationToken,
         return invalidAuthorizationTokenFormat;
       }
       try {
-        const decodedJwt = await (0, import_jose.jwtVerify)(
+        const decodedJwt = await auth?.decodeResource?.(token) ?? (await (0, import_jose.jwtVerify)(
           token,
           new TextEncoder().encode(process.env.JWT_SECRET)
-        );
-        if (!decodedJwt.payload.sub) {
+        )).payload;
+        if (!decodedJwt) {
           return invalidAuthorizationSubject;
         }
-        resourceId = decodedJwt.payload.sub;
+        resourceId = decodedJwt;
       } catch (error) {
-        req.openTelemetryCollector.error(error);
+        req?.openTelemetryCollector.error(error);
         return invalidAuthorizationToken;
       }
       break;
     }
     case "basic": {
-      if (authorizationToken !== (authorizationMethod.tokenPrefix ?? "Basic")) {
-        return invalidAuthorizationTokenFormat;
-      }
-      const [username, password] = Buffer.from(token, "base64").toString("utf-8").split(":");
-      if (!username || !password) {
+      if (tokenPrefix !== (authorizationMethod.tokenPrefix ?? "Basic")) {
         return invalidAuthorizationTokenFormat;
       }
-      if (!auth.login(username, password)) {
-        return invalidAuthorizationLogin;
+      if (auth.decodeResource) {
+        resourceId = await auth.decodeResource(token);
+      } else {
+        const [username, password] = Buffer.from(token, "base64").toString("utf-8").split(":");
+        if (!username || !password) {
+          return invalidAuthorizationTokenFormat;
+        }
+        if (!auth.login(username, password)) {
+          return invalidAuthorizationLogin;
+        }
+        resourceId = {
+          sub: username
+        };
       }
-      resourceId = username;
       break;
     }
     default:
@@ -629,7 +643,18 @@ function parse(req, res, next) {
       enumerable: true,
       configurable: false
     });
-    req.headers = parsedRequest.value.headers ?? {};
+    const parsedHeaders = parsedRequest.value.headers ?? {};
+    req.headers = Object.keys(req.headers).reduce(
+      (acc, key) => {
+        if (parsedHeaders?.[key]) {
+          acc[key] = parsedHeaders[key];
+        } else {
+          acc[key] = req.headers[key];
+        }
+        return acc;
+      },
+      {}
+    );
   }
   if (!parsedRequest.ok) {
     switch (req.contractDetails.options?.requestValidation) {