@grantjs/server 1.0.0 → 1.1.0

package/dist/grant-client-DywfJN5P.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-client-DywfJN5P.cjs","sources":["../src/utils/token-extractor.ts","../src/grant-client.ts"],"sourcesContent":["import type { GrantServerConfig } from '../types';\n\n/**\n * Extract Bearer token from Authorization header\n */\nexport function extractBearerToken(authHeader: string | undefined): string | null {\n  if (!authHeader) return null;\n\n  const parts = authHeader.trim().split(/\\s+/);\n  if (parts.length !== 2 || parts[0].toLowerCase() !== 'bearer') {\n    return null;\n  }\n\n  return parts[1];\n}\n\n/**\n * Parse cookie header string into key-value pairs\n */\nfunction parseCookieHeader(cookieHeader: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n\n  cookieHeader.split(';').forEach((cookie) => {\n    const [name, ...rest] = cookie.trim().split('=');\n    if (name && rest.length > 0) {\n      cookies[name.trim()] = rest.join('=').trim();\n    }\n  });\n\n  return cookies;\n}\n\n/**\n * Extract token from cookies\n */\nexport function extractTokenFromCookies(\n  cookieHeader: string | undefined,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const cookies = parseCookieHeader(cookieHeader);\n  return cookies[cookieName] || null;\n}\n\n/**\n * Extract token from Express request\n */\nexport async function extractTokenFromRequest(\n  request: unknown,\n  config: GrantServerConfig\n): Promise<string | null> {\n  // Use custom token resolver if provided\n  if (config.getToken) {\n    const token = await config.getToken(request);\n    if (token) return token;\n  }\n\n  // Try to extract from request (Express-style or Web API / NextRequest)\n  const req = request as {\n    headers?:\n      | { authorization?: string; cookie?: string }\n      | { get: (name: string) => string | null };\n    cookies?: Record<string, string>;\n  };\n\n  if (!req?.headers) return null;\n\n  // Web API Headers (NextRequest, Request): headers.get(name)\n  const headersGet = (req.headers as { get?: (name: string) => string | null }).get;\n  if (typeof headersGet === 'function') {\n    const authHeader = headersGet.call(req.headers, 'authorization');\n    const bearerToken = extractBearerToken(authHeader ?? undefined);\n    if (bearerToken) return bearerToken;\n    const cookieName = config.cookieName || 'grant-access-token';\n    const cookieHeader = headersGet.call(req.headers, 'cookie');\n    if (cookieHeader) {\n      const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n      if (cookieToken) return cookieToken;\n    }\n    return null;\n  }\n\n  // Express-style: headers.authorization, headers.cookie\n  const plainHeaders = req.headers as { authorization?: string; cookie?: string };\n  const authHeader = plainHeaders.authorization;\n  const bearerToken = extractBearerToken(authHeader);\n  if (bearerToken) return bearerToken;\n\n  const cookieName = config.cookieName || 'grant-access-token';\n\n  if (req.cookies?.[cookieName]) {\n    return req.cookies[cookieName];\n  }\n\n  const cookieHeader = plainHeaders.cookie;\n  if (cookieHeader) {\n    const cookieToken = extractTokenFromCookies(cookieHeader, cookieName);\n    if (cookieToken) return cookieToken;\n  }\n\n  return null;\n}\n","import { extractTokenFromRequest } from './utils/token-extractor';\n\nimport type { GrantServerConfig, AuthorizationResult, PermissionCheckOptions } from './types';\n\n/**\n * Grant Client for server-side applications\n *\n * Makes HTTP requests to the Grant API to check permissions.\n * Uses API-key exchanged tokens (scope in JWT claims); token-based and cookie-based extraction supported.\n * No caching - server-side caching is handled by grant-api.\n */\nexport class GrantClient {\n  public readonly config: Required<Pick<GrantServerConfig, 'apiUrl'>> & GrantServerConfig;\n\n  constructor(config: GrantServerConfig) {\n    this.config = config;\n  }\n\n  // ============================================================================\n  // Public API - Permission Checks\n  // ============================================================================\n\n  /**\n   * Check if the current user has a specific permission\n   *\n   * @example\n   * ```ts\n   * const canEdit = await grant.isGranted('document', 'update', { scope });\n   * if (canEdit) {\n   *   // Proceed with operation\n   * }\n   * ```\n   */\n  async isGranted(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<boolean> {\n    const result = await this.isAuthorized(resource, action, options, request);\n    return result.authorized;\n  }\n\n  /**\n   * Check authorization with full result details\n   *\n   * @example\n   * ```ts\n   * const result = await grant.isAuthorized('document', 'update', { scope }, request);\n   * if (!result.authorized) {\n   *   console.log('Denied:', result.reason);\n   * }\n   * ```\n   */\n  async isAuthorized(\n    resource: string,\n    action: string,\n    options?: PermissionCheckOptions,\n    request?: unknown\n  ): Promise<AuthorizationResult> {\n    try {\n      // API expects: { permission: { resource, action }, context: { resource?: any }, scope?: { tenant, id } }\n      const response = await this.fetchWithAuth(\n        '/api/auth/is-authorized',\n        {\n          method: 'POST',\n          body: JSON.stringify({\n            permission: {\n              resource,\n              action,\n            },\n            context: {\n              resource: options?.context?.resource || null,\n            },\n          }),\n        },\n        request\n      );\n\n      if (!response.ok) {\n        const error = await response.json().catch(() => ({}));\n        return {\n          authorized: false,\n          reason: error.message || `API error: ${response.status}`,\n        };\n      }\n\n      const json = await response.json();\n      // API returns { success: true, data: { authorized, ... } }\n      const result: AuthorizationResult = json.data ?? json;\n      return result;\n    } catch (error) {\n      return {\n        authorized: false,\n        reason: error instanceof Error ? error.message : 'Unknown error',\n      };\n    }\n  }\n\n  /**\n   * Extract token from a request object\n   * Useful for middleware that needs to extract token before making authorization calls\n   */\n  async getTokenFromRequest(request: unknown): Promise<string | null> {\n    return extractTokenFromRequest(request, this.config);\n  }\n\n  // ============================================================================\n  // Private - HTTP & Authentication\n  // ============================================================================\n\n  /**\n   * Make an authenticated fetch request (token from request; no refresh).\n   */\n  private async fetchWithAuth(\n    url: string,\n    init?: RequestInit,\n    request?: unknown\n  ): Promise<Response> {\n    return this.doFetch(url, init, request);\n  }\n\n  /**\n   * Perform the actual fetch request\n   */\n  private async doFetch(url: string, init?: RequestInit, request?: unknown): Promise<Response> {\n    const fetchFn = this.config.fetch ?? globalThis.fetch;\n    const fullUrl = url.startsWith('http') ? url : `${this.config.apiUrl}${url}`;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      ...(init?.headers as Record<string, string>),\n    };\n\n    // Add authorization header if token is available\n    if (request) {\n      const token = await extractTokenFromRequest(request, this.config);\n      if (token) {\n        headers['Authorization'] = `Bearer ${token}`;\n      }\n\n      // Forward cookies if using cookie-based auth\n      const req = request as { headers?: { cookie?: string } };\n      if (req.headers?.cookie) {\n        headers['Cookie'] = req.headers.cookie;\n      }\n    }\n\n    return fetchFn(fullUrl, {\n      ...init,\n      headers,\n      // Include cookies for same-origin requests (supports cookie-based auth)\n      credentials: this.config.credentials ?? 'include',\n    });\n  }\n}\n"],"names":["authHeader","bearerToken","cookieName","cookieHeader"],"mappings":";;;;AAKO,SAAS,mBAAmB,YAA+C;AAChF,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,QAAQ,WAAW,KAAA,EAAO,MAAM,KAAK;AAC3C,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,EAAE,YAAA,MAAkB,UAAU;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,CAAC;AAChB;AAKA,SAAS,kBAAkB,cAA8C;AACvE,QAAM,UAAkC,CAAA;AAExC,eAAa,MAAM,GAAG,EAAE,QAAQ,CAAC,WAAW;AAC1C,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,OAAO,KAAA,EAAO,MAAM,GAAG;AAC/C,QAAI,QAAQ,KAAK,SAAS,GAAG;AAC3B,cAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,KAAA;AAAA,IACxC;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,wBACd,cACA,YACe;AACf,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,UAAU,kBAAkB,YAAY;AAC9C,SAAO,QAAQ,UAAU,KAAK;AAChC;AAKA,eAAsB,wBACpB,SACA,QACwB;AAExB,MAAI,OAAO,UAAU;AACnB,UAAM,QAAQ,MAAM,OAAO,SAAS,OAAO;AAC3C,QAAI,MAAO,QAAO;AAAA,EACpB;AAGA,QAAM,MAAM;AAOZ,MAAI,CAAC,KAAK,QAAS,QAAO;AAG1B,QAAM,aAAc,IAAI,QAAsD;AAC9E,MAAI,OAAO,eAAe,YAAY;AACpC,UAAMA,cAAa,WAAW,KAAK,IAAI,SAAS,eAAe;AAC/D,UAAMC,eAAc,mBAAmBD,eAAc,MAAS;AAC9D,QAAIC,aAAa,QAAOA;AACxB,UAAMC,cAAa,OAAO,cAAc;AACxC,UAAMC,gBAAe,WAAW,KAAK,IAAI,SAAS,QAAQ;AAC1D,QAAIA,eAAc;AAChB,YAAM,cAAc,wBAAwBA,eAAcD,WAAU;AACpE,UAAI,YAAa,QAAO;AAAA,IAC1B;AACA,WAAO;AAAA,EACT;AAGA,QAAM,eAAe,IAAI;AACzB,QAAM,aAAa,aAAa;AAChC,QAAM,cAAc,mBAAmB,UAAU;AACjD,MAAI,YAAa,QAAO;AAExB,QAAM,aAAa,OAAO,cAAc;AAExC,MAAI,IAAI,UAAU,UAAU,GAAG;AAC7B,WAAO,IAAI,QAAQ,UAAU;AAAA,EAC/B;AAEA,QAAM,eAAe,aAAa;AAClC,MAAI,cAAc;AAChB,UAAM,cAAc,wBAAwB,cAAc,UAAU;AACpE,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,SAAO;AACT;AC3FO,MAAM,YAAY;AAAA,EAGvB,YAAY,QAA2B;AAFvB;AAGd,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,UACJ,UACA,QACA,SACA,SACkB;AAClB,UAAM,SAAS,MAAM,KAAK,aAAa,UAAU,QAAQ,SAAS,OAAO;AACzE,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,aACJ,UACA,QACA,SACA,SAC8B;AAC9B,QAAI;AAEF,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,MAAM,KAAK,UAAU;AAAA,YACnB,YAAY;AAAA,cACV;AAAA,cACA;AAAA,YAAA;AAAA,YAEF,SAAS;AAAA,cACP,UAAU,SAAS,SAAS,YAAY;AAAA,YAAA;AAAA,UAC1C,CACD;AAAA,QAAA;AAAA,QAEH;AAAA,MAAA;AAGF,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,QAAQ,MAAM,SAAS,KAAA,EAAO,MAAM,OAAO,CAAA,EAAG;AACpD,eAAO;AAAA,UACL,YAAY;AAAA,UACZ,QAAQ,MAAM,WAAW,cAAc,SAAS,MAAM;AAAA,QAAA;AAAA,MAE1D;AAEA,YAAM,OAAO,MAAM,SAAS,KAAA;AAE5B,YAAM,SAA8B,KAAK,QAAQ;AACjD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAAA;AAAA,IAErD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,SAA0C;AAClE,WAAO,wBAAwB,SAAS,KAAK,MAAM;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,cACZ,KACA,MACA,SACmB;AACnB,WAAO,KAAK,QAAQ,KAAK,MAAM,OAAO;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,QAAQ,KAAa,MAAoB,SAAsC;AAC3F,UAAM,UAAU,KAAK,OAAO,SAAS,WAAW;AAChD,UAAM,UAAU,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,KAAK,OAAO,MAAM,GAAG,GAAG;AAE1E,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,GAAI,MAAM;AAAA,IAAA;AAIZ,QAAI,SAAS;AACX,YAAM,QAAQ,MAAM,wBAAwB,SAAS,KAAK,MAAM;AAChE,UAAI,OAAO;AACT,gBAAQ,eAAe,IAAI,UAAU,KAAK;AAAA,MAC5C;AAGA,YAAM,MAAM;AACZ,UAAI,IAAI,SAAS,QAAQ;AACvB,gBAAQ,QAAQ,IAAI,IAAI,QAAQ;AAAA,MAClC;AAAA,IACF;AAEA,WAAO,QAAQ,SAAS;AAAA,MACtB,GAAG;AAAA,MACH;AAAA;AAAA,MAEA,aAAa,KAAK,OAAO,eAAe;AAAA,IAAA,CACzC;AAAA,EACH;AACF;;;;"}

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.cjs","sources":["../src/errors.ts"],"sourcesContent":["/**\n * Base error class for Grant server errors\n */\nexport class GrantServerError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode: number = 500\n  ) {\n    super(message);\n    this.name = 'GrantServerError';\n    Object.setPrototypeOf(this, GrantServerError.prototype);\n  }\n}\n\n/**\n * Authentication error (401)\n * Thrown when user is not authenticated\n */\nexport class AuthenticationError extends GrantServerError {\n  constructor(message: string = 'Unauthorized', code: string = 'UNAUTHENTICATED') {\n    super(message, code, 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\n/**\n * Authorization error (403)\n * Thrown when user is authenticated but lacks required permission\n */\nexport class AuthorizationError extends GrantServerError {\n  constructor(\n    message: string = 'Forbidden',\n    code: string = 'FORBIDDEN',\n    public readonly reason?: string\n  ) {\n    super(message, code, 403);\n    this.name = 'AuthorizationError';\n    Object.setPrototypeOf(this, AuthorizationError.prototype);\n  }\n}\n\n/**\n * Bad request error (400)\n * Thrown when request is malformed or missing required data\n */\nexport class BadRequestError extends GrantServerError {\n  constructor(message: string = 'Bad Request', code: string = 'BAD_REQUEST') {\n    super(message, code, 400);\n    this.name = 'BadRequestError';\n    Object.setPrototypeOf(this, BadRequestError.prototype);\n  }\n}\n\n/**\n * Not found error (404)\n * Thrown when resource is not found\n */\nexport class NotFoundError extends GrantServerError {\n  constructor(message: string = 'Not Found', code: string = 'NOT_FOUND') {\n    super(message, code, 404);\n    this.name = 'NotFoundError';\n    Object.setPrototypeOf(this, NotFoundError.prototype);\n  }\n}\n"],"names":[],"mappings":";;;AAGO,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YACE,SACgB,MACA,aAAqB,KACrC;AACA,UAAM,OAAO;AAHG,SAAA,OAAA;AACA,SAAA,aAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,iBAAiB,SAAS;AAAA,EACxD;AACF;AAMO,MAAM,4BAA4B,iBAAiB;AAAA,EACxD,YAAY,UAAkB,gBAAgB,OAAe,mBAAmB;AAC9E,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,oBAAoB,SAAS;AAAA,EAC3D;AACF;AAMO,MAAM,2BAA2B,iBAAiB;AAAA,EACvD,YACE,UAAkB,aAClB,OAAe,aACC,QAChB;AACA,UAAM,SAAS,MAAM,GAAG;AAFR,SAAA,SAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,mBAAmB,SAAS;AAAA,EAC1D;AACF;AAMO,MAAM,wBAAwB,iBAAiB;AAAA,EACpD,YAAY,UAAkB,eAAe,OAAe,eAAe;AACzE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,gBAAgB,SAAS;AAAA,EACvD;AACF;AAMO,MAAM,sBAAsB,iBAAiB;AAAA,EAClD,YAAY,UAAkB,aAAa,OAAe,aAAa;AACrE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,cAAc,SAAS;AAAA,EACrD;AACF;;;;;;;;;"}

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.mjs","sources":["../src/errors.ts"],"sourcesContent":["/**\n * Base error class for Grant server errors\n */\nexport class GrantServerError extends Error {\n  constructor(\n    message: string,\n    public readonly code: string,\n    public readonly statusCode: number = 500\n  ) {\n    super(message);\n    this.name = 'GrantServerError';\n    Object.setPrototypeOf(this, GrantServerError.prototype);\n  }\n}\n\n/**\n * Authentication error (401)\n * Thrown when user is not authenticated\n */\nexport class AuthenticationError extends GrantServerError {\n  constructor(message: string = 'Unauthorized', code: string = 'UNAUTHENTICATED') {\n    super(message, code, 401);\n    this.name = 'AuthenticationError';\n    Object.setPrototypeOf(this, AuthenticationError.prototype);\n  }\n}\n\n/**\n * Authorization error (403)\n * Thrown when user is authenticated but lacks required permission\n */\nexport class AuthorizationError extends GrantServerError {\n  constructor(\n    message: string = 'Forbidden',\n    code: string = 'FORBIDDEN',\n    public readonly reason?: string\n  ) {\n    super(message, code, 403);\n    this.name = 'AuthorizationError';\n    Object.setPrototypeOf(this, AuthorizationError.prototype);\n  }\n}\n\n/**\n * Bad request error (400)\n * Thrown when request is malformed or missing required data\n */\nexport class BadRequestError extends GrantServerError {\n  constructor(message: string = 'Bad Request', code: string = 'BAD_REQUEST') {\n    super(message, code, 400);\n    this.name = 'BadRequestError';\n    Object.setPrototypeOf(this, BadRequestError.prototype);\n  }\n}\n\n/**\n * Not found error (404)\n * Thrown when resource is not found\n */\nexport class NotFoundError extends GrantServerError {\n  constructor(message: string = 'Not Found', code: string = 'NOT_FOUND') {\n    super(message, code, 404);\n    this.name = 'NotFoundError';\n    Object.setPrototypeOf(this, NotFoundError.prototype);\n  }\n}\n"],"names":[],"mappings":";AAGO,MAAM,yBAAyB,MAAM;AAAA,EAC1C,YACE,SACgB,MACA,aAAqB,KACrC;AACA,UAAM,OAAO;AAHG,SAAA,OAAA;AACA,SAAA,aAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,iBAAiB,SAAS;AAAA,EACxD;AACF;AAMO,MAAM,4BAA4B,iBAAiB;AAAA,EACxD,YAAY,UAAkB,gBAAgB,OAAe,mBAAmB;AAC9E,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,oBAAoB,SAAS;AAAA,EAC3D;AACF;AAMO,MAAM,2BAA2B,iBAAiB;AAAA,EACvD,YACE,UAAkB,aAClB,OAAe,aACC,QAChB;AACA,UAAM,SAAS,MAAM,GAAG;AAFR,SAAA,SAAA;AAGhB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,mBAAmB,SAAS;AAAA,EAC1D;AACF;AAMO,MAAM,wBAAwB,iBAAiB;AAAA,EACpD,YAAY,UAAkB,eAAe,OAAe,eAAe;AACzE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,gBAAgB,SAAS;AAAA,EACvD;AACF;AAMO,MAAM,sBAAsB,iBAAiB;AAAA,EAClD,YAAY,UAAkB,aAAa,OAAe,aAAa;AACrE,UAAM,SAAS,MAAM,GAAG;AACxB,SAAK,OAAO;AACZ,WAAO,eAAe,MAAM,cAAc,SAAS;AAAA,EACrD;AACF;"}