@geekmidas/auth 10.0.0-alpha.11 → 10.0.0-alpha.110

package/dist/lambda/jwt.cjs

@@ -1,19 +1,18 @@
-const require_cookies = require('../cookies-Bc6gUjb6.cjs');
-const require_jwt = require('../jwt-clq6I6vG.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_cookies = require("../cookies.cjs");
+const require_jwt = require("../jwt.cjs");
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
-	const policyDocument = {
-		Version: "2012-10-17",
-		Statement: [{
-			Action: "execute-api:Invoke",
-			Effect: effect,
-			Resource: resource
-		}]
-	};
 	return {
 		principalId,
-		policyDocument,
+		policyDocument: {
+			Version: "2012-10-17",
+			Statement: [{
+				Action: "execute-api:Invoke",
+				Effect: effect,
+				Resource: resource
+			}]
+		},
 		context
 	};
 }
@@ -67,8 +66,7 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -107,8 +105,7 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -119,7 +116,7 @@ var JwtAuthorizer = class {
 		};
 	}
 };
-
 //#endregion
 exports.JwtAuthorizer = JwtAuthorizer;
+
 //# sourceMappingURL=jwt.cjs.map

package/dist/lambda/jwt.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","JwtVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,2BAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.cjs","names":["JwtVerifier","readCookie"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,gBAAb,MAAkE;CACjE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAwC;EACnD,KAAK,WAAW,IAAIA,YAAAA,YAAY,QAAQ,MAAM;EAC9C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;;;;CAKA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;;;;CAKA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAASC,gBAAAA,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}

package/dist/lambda/jwt.d.cts

@@ -1,8 +1,7 @@
-import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-3eIuY2dg.cjs";
+import { a as JwtVerifier, n as JwtConfig, o as TokenExtractionOptions, t as JwtClaims } from "../jwt-CoKrpeMB.cjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
-
 //#region src/lambda/jwt.d.ts
-interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
+export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
   config: JwtConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -30,7 +29,7 @@ interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
+export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -47,7 +46,6 @@ declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
    */
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
-//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export { JwtAuthorizer, JwtAuthorizerOptions, JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
+export type { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
 //# sourceMappingURL=jwt.d.cts.map

package/dist/lambda/jwt.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAgGY;cAhGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAoEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.cts","names":["LambdaContext"],"sources":["../../src/lambda/jwt.ts"],"mappings":";;;iBA8CiB,qBAAqB,gBAAgB,YAAY;EACjE,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;;;;qBAuB/B,cAAc,gBAAgB,YAAY;mBACrC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,qBAAqB;;;;EAY1C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;;;;EAiCZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}

package/dist/lambda/jwt.d.mts

@@ -1,8 +1,7 @@
-import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
+import { a as JwtVerifier, n as JwtConfig, o as TokenExtractionOptions, t as JwtClaims } from "../jwt-CoKrpeMB.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
-
 //#region src/lambda/jwt.d.ts
-interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
+export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
   config: JwtConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -30,7 +29,7 @@ interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
+export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -47,7 +46,6 @@ declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
    */
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
-//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export { JwtAuthorizer, JwtAuthorizerOptions, JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
+export type { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
 //# sourceMappingURL=jwt.d.mts.map

package/dist/lambda/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAgGY;cAhGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAoEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.mts","names":["LambdaContext"],"sources":["../../src/lambda/jwt.ts"],"mappings":";;;iBA8CiB,qBAAqB,gBAAgB,YAAY;EACjE,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;;;;qBAuB/B,cAAc,gBAAgB,YAAY;mBACrC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,qBAAqB;;;;EAY1C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;;;;EAiCZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}

package/dist/lambda/jwt.mjs

@@ -1,19 +1,17 @@
-import { readCookie } from "../cookies-C80f8JtE.mjs";
-import { JwtVerifier } from "../jwt-bZR2_t8F.mjs";
-
+import { readCookie } from "../cookies.mjs";
+import { JwtVerifier } from "../jwt.mjs";
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
-	const policyDocument = {
-		Version: "2012-10-17",
-		Statement: [{
-			Action: "execute-api:Invoke",
-			Effect: effect,
-			Resource: resource
-		}]
-	};
 	return {
 		principalId,
-		policyDocument,
+		policyDocument: {
+			Version: "2012-10-17",
+			Statement: [{
+				Action: "execute-api:Invoke",
+				Effect: effect,
+				Resource: resource
+			}]
+		},
 		context
 	};
 }
@@ -67,8 +65,7 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -107,8 +104,7 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -119,7 +115,7 @@ var JwtAuthorizer = class {
 		};
 	}
 };
-
 //#endregion
 export { JwtAuthorizer };
+
 //# sourceMappingURL=jwt.mjs.map

package/dist/lambda/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.mjs","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,gBAAb,MAAkE;CACjE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAwC;EACnD,KAAK,WAAW,IAAI,YAAY,QAAQ,MAAM;EAC9C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;;;;CAKA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;;;;CAKA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.cjs

@@ -1,19 +1,18 @@
-const require_cookies = require('../cookies-Bc6gUjb6.cjs');
-const require_oidc = require('../oidc-jdMfVyyC.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_cookies = require("../cookies.cjs");
+const require_oidc = require("../oidc.cjs");
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
-	const policyDocument = {
-		Version: "2012-10-17",
-		Statement: [{
-			Action: "execute-api:Invoke",
-			Effect: effect,
-			Resource: resource
-		}]
-	};
 	return {
 		principalId,
-		policyDocument,
+		policyDocument: {
+			Version: "2012-10-17",
+			Statement: [{
+				Action: "execute-api:Invoke",
+				Effect: effect,
+				Resource: resource
+			}]
+		},
 		context
 	};
 }
@@ -61,8 +60,7 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -98,8 +96,7 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -110,7 +107,7 @@ var OidcAuthorizer = class {
 		};
 	}
 };
-
 //#endregion
 exports.OidcAuthorizer = OidcAuthorizer;
+
 //# sourceMappingURL=oidc.cjs.map

package/dist/lambda/oidc.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","OidcVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,2BAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.cjs","names":["OidcVerifier","readCookie"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCA,IAAa,iBAAb,MAAqE;CACpE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAyC;EACpD,KAAK,WAAW,IAAIA,aAAAA,aAAa,QAAQ,MAAM;EAC/C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;CAEA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;CAEA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAASC,gBAAAA,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}

package/dist/lambda/oidc.d.cts

@@ -1,9 +1,8 @@
-import { TokenExtractionOptions } from "../jwt-3eIuY2dg.cjs";
-import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-ChA17wLB.cjs";
+import { o as TokenExtractionOptions } from "../jwt-CoKrpeMB.cjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc.cjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
-
 //#region src/lambda/oidc.d.ts
-interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
   config: OidcConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -28,7 +27,7 @@ interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -39,7 +38,6 @@ declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
-//# sourceMappingURL=oidc.d.ts.map
 //#endregion
-export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+export type { OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
 //# sourceMappingURL=oidc.d.cts.map

package/dist/lambda/oidc.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AAyFa,cAzFA,cAyFA,CAAA,gBAzF+B,UAyF/B,GAzF4C,UAyF5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAhFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAiEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.cts","names":["LambdaContext"],"sources":["../../src/lambda/oidc.ts"],"mappings":";;;;iBA8CiB,sBAChB,gBAAgB,aAAa;EAE7B,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;qBAoB/B,eAAe,gBAAgB,aAAa;mBACvC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,sBAAsB;EAS3C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;EA8BZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}

package/dist/lambda/oidc.d.mts

@@ -1,9 +1,8 @@
-import { TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
-import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc-Ca7GYwmM.mjs";
+import { o as TokenExtractionOptions } from "../jwt-CoKrpeMB.mjs";
+import { OidcClaims, OidcConfig, OidcVerifier } from "../oidc.mjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
-
 //#region src/lambda/oidc.d.ts
-interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
+export interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
   config: OidcConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -28,7 +27,7 @@ interface OidcAuthorizerOptions<TClaims extends OidcClaims = OidcClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
+export declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -39,7 +38,6 @@ declare class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {
   tokenHandler(): (event: APIGatewayTokenAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
-//# sourceMappingURL=oidc.d.ts.map
 //#endregion
-export { OidcAuthorizer, OidcAuthorizerOptions, OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
+export type { OidcClaims, OidcConfig, OidcVerifier, TokenExtractionOptions };
 //# sourceMappingURL=oidc.d.mts.map

package/dist/lambda/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa;UAErB;EAHQ,UAAA,CAAA,EAIH,sBAJwB;EAAA,gBAAA,CAAA,EAAA,OAAA;EAAA,cACrB,CAAA,EAAA,CAAA,MAAA,EAKU,OALV,EAAA,GAAA,MAAA;EAAU,UAAG,CAAA,EAAA,CAAA,MAAA,EAOpB,OAPoB,EAAA,GAQxB,MARwB,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAU,SAE/B,CAAA,EAAA,CAAA,MAAA,EAOa,OAPb,EAAA,GAAA,OAAA,GAOmC,OAPnC,CAAA,OAAA,CAAA;;;;;;;AAO0C;AAoBnD;;;;;;;;;;;AAyFa,cAzFA,cAyFA,CAAA,gBAzF+B,UAyF/B,GAzF4C,UAyF5C,CAAA,CAAA;EAAa,iBACb,QAAA;EAA0B,iBAAlC,UAAA;EAAO,iBAAA,gBAAA;;;;uBAhFU,sBAAsB;0BAWlC,0CACG,YACR,QAAQ;4BAiEH,4CACG,YACR,QAAQ"}
+{"version":3,"file":"oidc.d.mts","names":["LambdaContext"],"sources":["../../src/lambda/oidc.ts"],"mappings":";;;;iBA8CiB,sBAChB,gBAAgB,aAAa;EAE7B,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;qBAoB/B,eAAe,gBAAgB,aAAa;mBACvC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,sBAAsB;EAS3C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;EA8BZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}

package/dist/lambda/oidc.mjs

@@ -1,19 +1,17 @@
-import { readCookie } from "../cookies-C80f8JtE.mjs";
-import { OidcVerifier } from "../oidc-BYHREHir.mjs";
-
+import { readCookie } from "../cookies.mjs";
+import { OidcVerifier } from "../oidc.mjs";
 //#region src/lambda/oidc.ts
 function generatePolicy(principalId, effect, resource, context) {
-	const policyDocument = {
-		Version: "2012-10-17",
-		Statement: [{
-			Action: "execute-api:Invoke",
-			Effect: effect,
-			Resource: resource
-		}]
-	};
 	return {
 		principalId,
-		policyDocument,
+		policyDocument: {
+			Version: "2012-10-17",
+			Statement: [{
+				Action: "execute-api:Invoke",
+				Effect: effect,
+				Resource: resource
+			}]
+		},
 		context
 	};
 }
@@ -61,8 +59,7 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -98,8 +95,7 @@ var OidcAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					const isAuthorized = await this.authorize(claims);
-					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
+					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -110,7 +106,7 @@ var OidcAuthorizer = class {
 		};
 	}
 };
-
 //#endregion
 export { OidcAuthorizer };
+
 //# sourceMappingURL=oidc.mjs.map

package/dist/lambda/oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.mjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: OidcAuthorizerOptions<TClaims>","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;AAgCD,IAAa,iBAAb,MAAqE;CACpE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAyC;AACpD,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;CAED,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;CAED,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,WAAW;AACvE,QAAI,OACH,QAAO;GAER;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"oidc.mjs","names":[],"sources":["../../src/lambda/oidc.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type { OidcVerifier, OidcClaims, OidcConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface OidcAuthorizerOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * OIDC Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new OidcAuthorizer({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-api',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * export const tokenHandler = authorizer.tokenHandler();\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class OidcAuthorizer<TClaims extends OidcClaims = OidcClaims> {\n\tprivate readonly verifier: OidcVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: OidcAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;AAgCA,IAAa,iBAAb,MAAqE;CACpE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAyC;EACpD,KAAK,WAAW,IAAI,aAAa,QAAQ,MAAM;EAC/C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;CAEA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;CAEA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAAS,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}