@grantjs/server 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alejandro Heredia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,443 @@
+# @grantjs/server
+
+Server SDK for Grant authorization platform. Provides middleware and guards for **Express**, **Fastify**, **NestJS**, and **Next.js** applications.
+
+**Documentation:** [Server SDK](https://github.com/logusgraphics/grant/blob/main/docs/integration/server-sdk.md) in the official docs.
+
+## Features
+
+- **REST-based API** – Uses native `fetch`, no GraphQL client required
+- **Framework integrations** – Express (`grant()`), Fastify (`grant()`), NestJS (`@Grant` + `GrantGuard`), Next.js (`withGrant()`)
+- **Token extraction** – Supports Authorization header and cookies
+- **Resource resolvers** – Optional resource resolution for condition evaluation
+- **JWT-based scope** – Scope is taken from token claims (API-key / client-secret flows); session-style scope from request is not used
+- **TypeScript** – Full type safety with types from `@grantjs/schema`
+- **Generic** – Works with any permission model (uses plain strings for resource/action)
+
+## Installation
+
+```bash
+npm install @grantjs/server
+# or
+pnpm add @grantjs/server
+# or
+yarn add @grantjs/server
+```
+
+## Examples
+
+Minimal runnable apps for each framework live in **`examples/`** and share the same CRUD surface (documents: GET, POST, PUT, PATCH, DELETE). From the repo root:
+
+```bash
+pnpm install
+pnpm --filter @grantjs/server build
+cd packages/@grantjs/server/examples/express   # or fastify, nextjs, nestjs
+cp .env.example .env   # set GRANT_API_URL and optionally GRANT_TOKEN
+pnpm start
+```
+
+| Example   | Framework | Usage                                                            |
+| --------- | --------- | ---------------------------------------------------------------- |
+| `express` | Express   | `grant(client, { resource, action })` middleware                 |
+| `fastify` | Fastify   | `grant(client, { resource, action })` preHandler                 |
+| `nextjs`  | Next.js   | `withGrant(client, { resource, action }, handler)` on API routes |
+| `nestjs`  | NestJS    | `@Grant(resource, action)` + `GrantGuard`, `GrantModule`         |
+
+See **[examples/README.md](./examples/README.md)** for prerequisites, routes, and curl commands.
+
+## Quick Start
+
+### 1. Create the Client
+
+```typescript
+import { GrantClient } from '@grantjs/server';
+
+// Basic configuration (uses Authorization header or cookies)
+const grantClient = new GrantClient({
+  apiUrl: 'https://api.grant.com',
+});
+
+// With cookie-based auth
+const grantClient = new GrantClient({
+  apiUrl: 'https://api.grant.com',
+  cookieName: 'grant-access-token', // Default: 'grant-access-token'
+});
+
+// With custom token extraction
+const grantClient = new GrantClient({
+  apiUrl: 'https://api.grant.com',
+  getToken: (request) => {
+    // Custom logic to extract token from request
+    const req = request as { headers?: { 'x-api-key'?: string } };
+    return req.headers?.['x-api-key'] || null;
+  },
+});
+```
+
+### 2. Express Middleware
+
+```typescript
+import express from 'express';
+import { grant } from '@grantjs/server/express';
+
+const app = express();
+const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });
+
+// Basic usage
+app.get(
+  '/organizations',
+  grant(grantClient, {
+    resource: 'Organization',
+    action: 'Query',
+  }),
+  async (req, res) => {
+    // User is authorized, proceed with handler
+    res.json({ organizations: [] });
+  }
+);
+
+// With resource resolver for condition evaluation
+app.patch(
+  '/projects/:id',
+  grant(grantClient, {
+    resource: 'Project',
+    action: 'Update',
+    resourceResolver: async ({ resourceSlug, request }) => {
+      // Resolve the project resource for condition evaluation
+      const projectId = (request as any).params.id;
+      const project = await getProjectById(projectId);
+      return project ? { id: project.id, ownerId: project.ownerId } : null;
+    },
+  }),
+  async (req, res) => {
+    // User is authorized, proceed with handler
+    res.json({ success: true });
+  }
+);
+```
+
+### 3. Fastify Plugin
+
+```typescript
+import Fastify from 'fastify';
+import { grantPlugin, grant } from '@grantjs/server/fastify';
+import { GrantClient } from '@grantjs/server';
+
+const fastify = Fastify();
+
+// Register the plugin (decorates fastify.grant)
+await fastify.register(grantPlugin, {
+  apiUrl: 'https://api.grant.com',
+  cookieName: 'grant-access-token',
+});
+
+// Use preHandler hook
+fastify.get(
+  '/organizations',
+  {
+    preHandler: grant(fastify.grant, {
+      resource: 'Organization',
+      action: 'Query',
+    }),
+  },
+  async (request, reply) => {
+    return { organizations: [] };
+  }
+);
+
+// With resource resolver
+fastify.patch(
+  '/projects/:id',
+  {
+    preHandler: grant(fastify.grant, {
+      resource: 'Project',
+      action: 'Update',
+      resourceResolver: async ({ resourceSlug, request }) => {
+        const projectId = (request.params as { id: string }).id;
+        const project = await getProjectById(projectId);
+        return project ? { id: project.id, ownerId: project.ownerId } : null;
+      },
+    }),
+  },
+  async (request, reply) => {
+    return { success: true };
+  }
+);
+```
+
+### 4. Next.js (App Router)
+
+```typescript
+// app/api/documents/route.ts
+import { NextResponse } from 'next/server';
+import { withGrant } from '@grantjs/server/next';
+import { GrantClient } from '@grantjs/server';
+
+const grantClient = new GrantClient({ apiUrl: process.env.GRANT_API_URL! });
+
+export const GET = withGrant(grantClient, { resource: 'Document', action: 'Query' }, async () =>
+  NextResponse.json({ data: [] })
+);
+
+export const POST = withGrant(
+  grantClient,
+  { resource: 'Document', action: 'Create' },
+  async (request) => {
+    const body = await request.json();
+    return NextResponse.json({ data: { title: body?.title ?? 'Untitled' } }, { status: 201 });
+  }
+);
+```
+
+### 5. NestJS
+
+```typescript
+// app.module.ts
+import { GrantModule } from '@grantjs/server/nest';
+
+@Module({
+  imports: [
+    GrantModule.forRoot({
+      apiUrl: process.env.GRANT_API_URL!,
+      getToken: (req: any) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,
+    }),
+  ],
+})
+export class AppModule {}
+
+// documents.controller.ts
+import { Grant, GrantGuard } from '@grantjs/server/nest';
+
+@Controller('documents')
+export class DocumentsController {
+  @Get()
+  @Grant('Document', 'Query')
+  @UseGuards(GrantGuard)
+  list() {
+    return { data: [] };
+  }
+
+  @Post()
+  @Grant('Document', 'Create')
+  @UseGuards(GrantGuard)
+  create(@Body() body: { title?: string }) {
+    return { data: { title: body?.title ?? 'Untitled' } };
+  }
+}
+```
+
+Register `GrantGuard` as a provider in your feature module (e.g. `providers: [GrantGuard]`) so Nest injects `GrantClient`. See `examples/nestjs` for a full app.
+
+## API Reference
+
+### GrantClient
+
+```typescript
+const grantClient = new GrantClient(config: GrantServerConfig);
+```
+
+#### Configuration
+
+```typescript
+interface GrantServerConfig {
+  // Required
+  apiUrl: string;
+
+  // Optional
+  cookieName?: string; // Default: 'grant-access-token'
+  getToken?: (request: unknown) => string | null | Promise<string | null>;
+  fetch?: typeof fetch;
+  credentials?: RequestCredentials;
+}
+```
+
+#### Methods
+
+```typescript
+// Permission checks
+grantClient.isGranted(resource, action, options?, request?): Promise<boolean>
+grantClient.isAuthorized(resource, action, options?, request?): Promise<AuthorizationResult>
+
+// Token extraction
+grantClient.getTokenFromRequest(request): Promise<string | null>
+```
+
+### Express Middleware
+
+#### `grant(client, options)`
+
+Creates Express middleware that checks authorization before proceeding.
+
+**Options:**
+
+```typescript
+interface GrantOptions {
+  resource: string; // Resource slug (e.g., "Organization", "Project", "Document")
+  action: string; // Action name (e.g., "Query", "Create", "Update", "Delete")
+  resourceResolver?: ResourceResolver; // Resource resolution for conditions
+}
+```
+
+**Behavior:**
+
+- Returns `401 Unauthorized` if no token is found
+- Returns `404 Not Found` if resource resolver returns null
+- Returns `403 Forbidden` if user lacks permission
+- Calls `next()` if authorized
+- Attaches `authorization` result to `req.authorization` for downstream use
+- Scope for authorization is taken from the JWT (e.g. API-key / client-secret tokens); it is not extracted from the request
+
+### Fastify Plugin
+
+#### `grantPlugin(fastify, options)`
+
+Registers a Fastify plugin that decorates the instance with `fastify.grant` (GrantClient).
+
+**Options:**
+
+Same as `GrantServerConfig` - see [GrantClient Configuration](#grantclient) above.
+
+**Usage:**
+
+```typescript
+await fastify.register(grantPlugin, {
+  apiUrl: 'https://api.grant.com',
+  cookieName: 'grant-access-token',
+});
+
+// Now fastify.grant is available
+const canEdit = await fastify.grant.isGranted('Document', 'Update', undefined, request);
+```
+
+#### `grant(client, options)`
+
+Creates a Fastify `preHandler` hook that checks authorization before proceeding.
+
+**Options:**
+
+Same as Express `GrantOptions` - see above.
+
+**Behavior:**
+
+- Returns `401 Unauthorized` if no token is found
+- Returns `404 Not Found` if resource resolver returns null
+- Returns `403 Forbidden` if user lacks permission
+- Attaches `authorization` result to `request.authorization` for downstream use
+- Scope for authorization is taken from the JWT; it is not extracted from the request
+
+### Next.js (App Router)
+
+#### `withGrant(client, options, handler)`
+
+Wraps an App Router route handler with Grant authorization. Use for `GET`, `POST`, `PUT`, `PATCH`, `DELETE` in `app/api/.../route.ts`.
+
+**Options:** Same as Express `GrantOptions` (resource, action, optional resourceResolver).
+
+**Behavior:** Returns `401` / `404` / `403` responses on failure; calls your handler with `(request, { authorization })` on success. Compatible with Next.js 13–16.
+
+### NestJS
+
+#### `GrantModule.forRoot(config)`
+
+Global module that provides `GrantClient` for injection. Import in `AppModule`.
+
+#### `@Grant(resource, action)` / `Grant(resource, action)`
+
+Decorator that sets resource/action metadata for `GrantGuard`. Use with `@UseGuards(GrantGuard)` on controller methods.
+
+#### `GrantGuard`
+
+Guard that reads options from `@Grant()` metadata (or explicit constructor options with optional `resourceResolver`). Register as a provider (e.g. `providers: [GrantGuard]`) so Nest injects `GrantClient` and `Reflector`. Exports `GRANT_CLIENT` and `GRANT_OPTIONS_KEY` for advanced use.
+
+## Token Extraction
+
+The client supports multiple token extraction methods (in order of precedence):
+
+1. **Custom `getToken` function** (if provided)
+2. **Authorization header**: `Authorization: Bearer <token>`
+3. **Cookies**: Cookie named by `cookieName` config (default: `grant-access-token`)
+
+## Resource Resolvers
+
+Resource resolvers are optional functions that resolve resource data for condition evaluation. Scope is not passed from the middleware (it is taken from the JWT on the API side).
+
+```typescript
+const resourceResolver: ResourceResolver = async ({ resourceSlug, request }) => {
+  // Fetch resource from database
+  const resource = await getResource(resourceSlug, request);
+
+  // Return resource data for condition evaluation
+  // e.g., { id: '...', ownerId: '...', status: 'active' }
+  return resource ? { id: resource.id, ownerId: resource.ownerId } : null;
+};
+```
+
+If the resolver returns `null`, the middleware returns `404 Not Found`.
+
+## Development / Debug
+
+Set **`DEBUG_GRANT=1`** in your environment (e.g. in `.env`) to enable request/outcome logs for all integrations (Express, Fastify, Next, Nest). Logs include resource, action, and authorized/denied with reason.
+
+## Error Handling
+
+The package exports error classes for graceful error handling:
+
+```typescript
+import {
+  AuthenticationError, // 401
+  AuthorizationError, // 403
+  BadRequestError, // 400
+  NotFoundError, // 404
+} from '@grantjs/server';
+
+try {
+  await grantClient.isAuthorized('resource', 'action', undefined, request);
+} catch (error) {
+  if (error instanceof AuthenticationError) {
+    // Handle 401
+  } else if (error instanceof AuthorizationError) {
+    // Handle 403
+  }
+}
+```
+
+## TypeScript
+
+Full type definitions are included:
+
+```typescript
+import type {
+  GrantServerConfig,
+  AuthorizationResult,
+  PermissionCheckOptions,
+  Scope,
+  ResourceResolver,
+} from '@grantjs/server';
+
+import { Tenant } from '@grantjs/schema';
+```
+
+## Comparison with @grantjs/client
+
+The server package (`@grantjs/server`) is designed for **server-side** Node.js applications, while the client package (`@grantjs/client`) is for **browser** applications.
+
+**Key Differences:**
+
+| Feature               | @grantjs/server                                                    | @grantjs/client             |
+| --------------------- | ------------------------------------------------------------------ | --------------------------- |
+| **Target**            | Node.js servers                                                    | Browser apps                |
+| **Caching**           | No (handled by API)                                                | Yes (5min TTL)              |
+| **Token Source**      | Request object                                                     | Callback functions          |
+| **Framework Support** | Express, Fastify, NestJS, Next.js                                  | React, Vue, Svelte, Angular |
+| **API**               | `grant()` (Express/Fastify), `withGrant()` (Next), `@Grant` (Nest) | `useGrant()` hook           |
+| **Error Handling**    | HTTP status codes                                                  | Boolean returns             |
+| **Resource/Action**   | Plain strings (generic)                                            | Plain strings (generic)     |
+
+**When to Use:**
+
+- **@grantjs/server**: Protecting API routes, GraphQL resolvers, server-side middleware
+- **@grantjs/client**: Conditional UI rendering, client-side permission checks
+
+## License
+
+MIT

package/dist/debug-C8ibbrE5.js

@@ -0,0 +1,9 @@
+const DEBUG_GRANT_ENV = "DEBUG_GRANT";
+function debugGrant(integration, data) {
+  if (process.env[DEBUG_GRANT_ENV] !== "1") return;
+  console.debug(`[Grant ${integration}]`, data);
+}
+export {
+  debugGrant as d
+};
+//# sourceMappingURL=debug-C8ibbrE5.js.map

package/dist/debug-C8ibbrE5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-C8ibbrE5.js","sources":["../src/utils/debug.ts"],"sourcesContent":["const DEBUG_GRANT_ENV = 'DEBUG_GRANT';\n\n/** Whether Grant debug logging is enabled (set DEBUG_GRANT=1 in development). */\nexport function isDebugGrant(): boolean {\n  return process.env[DEBUG_GRANT_ENV] === '1';\n}\n\n/**\n * Log Grant integration debug info when DEBUG_GRANT=1.\n * Used by Express middleware, Fastify grant hook, Next withGrant, and Nest GrantGuard.\n * Set DEBUG_GRANT=1 in .env or the environment to see resource, action, and outcome in development.\n */\nexport function debugGrant(integration: string, data: Record<string, unknown>): void {\n  if (process.env[DEBUG_GRANT_ENV] !== '1') return;\n  console.debug(`[Grant ${integration}]`, data);\n}\n"],"names":[],"mappings":"AAAA,MAAM,kBAAkB;AAYjB,SAAS,WAAW,aAAqB,MAAqC;AACnF,MAAI,QAAQ,IAAI,eAAe,MAAM,IAAK;AAC1C,UAAQ,MAAM,UAAU,WAAW,KAAK,IAAI;AAC9C;"}

package/dist/debug-Crb5gNDM.cjs

@@ -0,0 +1,8 @@
+"use strict";
+const DEBUG_GRANT_ENV = "DEBUG_GRANT";
+function debugGrant(integration, data) {
+  if (process.env[DEBUG_GRANT_ENV] !== "1") return;
+  console.debug(`[Grant ${integration}]`, data);
+}
+exports.debugGrant = debugGrant;
+//# sourceMappingURL=debug-Crb5gNDM.cjs.map

package/dist/debug-Crb5gNDM.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-Crb5gNDM.cjs","sources":["../src/utils/debug.ts"],"sourcesContent":["const DEBUG_GRANT_ENV = 'DEBUG_GRANT';\n\n/** Whether Grant debug logging is enabled (set DEBUG_GRANT=1 in development). */\nexport function isDebugGrant(): boolean {\n  return process.env[DEBUG_GRANT_ENV] === '1';\n}\n\n/**\n * Log Grant integration debug info when DEBUG_GRANT=1.\n * Used by Express middleware, Fastify grant hook, Next withGrant, and Nest GrantGuard.\n * Set DEBUG_GRANT=1 in .env or the environment to see resource, action, and outcome in development.\n */\nexport function debugGrant(integration: string, data: Record<string, unknown>): void {\n  if (process.env[DEBUG_GRANT_ENV] !== '1') return;\n  console.debug(`[Grant ${integration}]`, data);\n}\n"],"names":[],"mappings":";AAAA,MAAM,kBAAkB;AAYjB,SAAS,WAAW,aAAqB,MAAqC;AACnF,MAAI,QAAQ,IAAI,eAAe,MAAM,IAAK;AAC1C,UAAQ,MAAM,UAAU,WAAW,KAAK,IAAI;AAC9C;;"}

package/dist/errors.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Base error class for Grant server errors
+ */
+export declare class GrantServerError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    constructor(message: string, code: string, statusCode?: number);
+}
+/**
+ * Authentication error (401)
+ * Thrown when user is not authenticated
+ */
+export declare class AuthenticationError extends GrantServerError {
+    constructor(message?: string, code?: string);
+}
+/**
+ * Authorization error (403)
+ * Thrown when user is authenticated but lacks required permission
+ */
+export declare class AuthorizationError extends GrantServerError {
+    readonly reason?: string | undefined;
+    constructor(message?: string, code?: string, reason?: string | undefined);
+}
+/**
+ * Bad request error (400)
+ * Thrown when request is malformed or missing required data
+ */
+export declare class BadRequestError extends GrantServerError {
+    constructor(message?: string, code?: string);
+}
+/**
+ * Not found error (404)
+ * Thrown when resource is not found
+ */
+export declare class NotFoundError extends GrantServerError {
+    constructor(message?: string, code?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAGvB,IAAI,EAAE,MAAM;aACZ,UAAU,EAAE,MAAM;gBAFlC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAY;CAM3C;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,gBAAgB;gBAC3C,OAAO,GAAE,MAAuB,EAAE,IAAI,GAAE,MAA0B;CAK/E;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,gBAAgB;aAIpC,MAAM,CAAC,EAAE,MAAM;gBAF/B,OAAO,GAAE,MAAoB,EAC7B,IAAI,GAAE,MAAoB,EACV,MAAM,CAAC,EAAE,MAAM,YAAA;CAMlC;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,gBAAgB;gBACvC,OAAO,GAAE,MAAsB,EAAE,IAAI,GAAE,MAAsB;CAK1E;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,gBAAgB;gBACrC,OAAO,GAAE,MAAoB,EAAE,IAAI,GAAE,MAAoB;CAKtE"}

package/dist/express/index.d.ts

@@ -0,0 +1,6 @@
+export { grant } from './middleware';
+export type { GrantOptions, AuthorizedRequest } from './middleware';
+export type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions, Scope, ResourceResolver, } from '../types';
+export { GrantServerError, AuthenticationError, AuthorizationError, BadRequestError, NotFoundError, } from '../errors';
+export { GrantClient } from '../grant-client';
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGpE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,EACL,gBAAgB,GACjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,aAAa,GACd,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/express/middleware.d.ts

@@ -0,0 +1,38 @@
+import { GrantClient } from '../grant-client';
+import { ResourceResolver, AuthorizationResult } from '../types';
+import { Request, Response, NextFunction } from 'express';
+/**
+ * Extended Express Request with authorization result
+ */
+export interface AuthorizedRequest extends Request {
+    authorization?: AuthorizationResult;
+}
+/**
+ * Options for Express middleware
+ */
+export interface GrantOptions {
+    /** The resource slug to check (e.g., "Organization", "Project", "Document") */
+    resource: string;
+    /** The action to check (e.g., "Query", "Create", "Update", "Delete") */
+    action: string;
+    /** Custom resource resolver for condition evaluation */
+    resourceResolver?: ResourceResolver;
+}
+/**
+ * Create Express middleware to check if user is granted permission
+ *
+ * @example
+ * ```ts
+ * import { grant } from '@grantjs/server/express';
+ * import { GrantClient } from '@grantjs/server';
+ *
+ * const grantClient = new GrantClient({ apiUrl: 'https://api.grant.com' });
+ *
+ * router.get('/organizations', grant(grantClient, {
+ *   resource: 'Organization',
+ *   action: 'Query',
+ * }), handler);
+ * ```
+ */
+export declare function grant(client: GrantClient, options: GrantOptions): (req: AuthorizedRequest, res: Response, next: NextFunction) => Promise<void>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/express/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/express/middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAI9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,OAAO;IAChD,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CACnB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,YAAY,GACpB,CAAC,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAyG9E"}

package/dist/express.cjs

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const index = require("./index.cjs");
+const debug = require("./debug-Crb5gNDM.cjs");
+const grantClient = require("./grant-client-DywfJN5P.cjs");
+function grant(client, options) {
+  return async (req, res, next) => {
+    try {
+      debug.debugGrant("Express", { resource: options.resource, action: options.action });
+      const token = await grantClient.extractTokenFromRequest(req, client.config);
+      if (!token) {
+        res.status(401).json({
+          error: "Unauthorized",
+          code: "UNAUTHENTICATED"
+        });
+        return;
+      }
+      let resolvedResource = null;
+      if (options.resourceResolver) {
+        resolvedResource = await options.resourceResolver({
+          resourceSlug: options.resource,
+          request: req
+        });
+        if (!resolvedResource) {
+          res.status(404).json({
+            error: "Resource not found",
+            code: "NOT_FOUND"
+          });
+          return;
+        }
+      }
+      const result = await client.isAuthorized(
+        options.resource,
+        options.action,
+        {
+          context: {
+            resource: resolvedResource || void 0
+          }
+        },
+        req
+      );
+      debug.debugGrant("Express", {
+        resource: options.resource,
+        action: options.action,
+        authorized: result.authorized,
+        ...result.authorized ? {} : { reason: result.reason }
+      });
+      if (!result.authorized) {
+        res.status(403).json({
+          error: "Forbidden",
+          code: "FORBIDDEN",
+          reason: result.reason
+        });
+        return;
+      }
+      req.authorization = result;
+      next();
+    } catch (error) {
+      if (error instanceof index.AuthenticationError) {
+        res.status(401).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof index.AuthorizationError) {
+        res.status(403).json({
+          error: error.message,
+          code: error.code,
+          reason: error.reason
+        });
+        return;
+      }
+      if (error instanceof index.BadRequestError) {
+        res.status(400).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      if (error instanceof index.NotFoundError) {
+        res.status(404).json({
+          error: error.message,
+          code: error.code
+        });
+        return;
+      }
+      next(error);
+    }
+  };
+}
+exports.AuthenticationError = index.AuthenticationError;
+exports.AuthorizationError = index.AuthorizationError;
+exports.BadRequestError = index.BadRequestError;
+exports.GrantServerError = index.GrantServerError;
+exports.NotFoundError = index.NotFoundError;
+exports.GrantClient = grantClient.GrantClient;
+exports.grant = grant;
+//# sourceMappingURL=express.cjs.map