@hyper.authio/express 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,60 @@
-# Temporary Holding Version
+# @hyper.authio/express
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Protect an Express 4 or 5 API with Authio: bearer validation, guards for every form of permission, and a signed
+webhook route. Built on [`@hyper.authio/server`](../server/README.md).
+
+```bash
+npm install @hyper.authio/express
+```
+
+```ts
+import express from "express";
+import {
+  anyOf,
+  authioBearer,
+  authioWebhooks,
+  requireAuthenticationLevel,
+  requireAuthio,
+  requireGroup,
+  requireOrganization,
+  requirePermission,
+  requireRole,
+  requireScope,
+} from "@hyper.authio/express";
+
+const app = express();
+
+// Before any JSON parser: the signature is checked over the raw body.
+app.post(
+  "/webhooks/authio",
+  authioWebhooks({ secret: process.env.AUTHIO_WEBHOOK_SECRET }).on("user_deleted", async (event) => {
+    await forget(event.data.id);
+  }),
+);
+
+app.use(express.json());
+app.use("/api", authioBearer({ issuer: "https://auth.example.com/realms/acme", audiences: "https://orders.example.com" }));
+
+app.get("/api/me", (req, res) => res.json(req.authio!.user));
+app.get("/api/orders", requireScope("orders:read"), requirePermission("orders", "read"), listOrders);
+app.delete("/api/orders/:id", requireRole("orders-admin", { sources: ["user"] }), deleteOrder);
+app.get("/api/finance", requireGroup("finance"), financeReport);
+app.post("/api/payouts", requireAuthio(requirePermission("payouts", "create"), anyOf(requireAuthenticationLevel(2), requireOrganization("acme"))), payout);
+```
+
+- `authioBearer(verifierOrOptions, { optional?, problemDetails?, passErrors? })` validates the token and puts
+  `{ user, token }` on `req.authio`; it answers `401` with `WWW-Authenticate`. With `optional`, a request without a
+  token goes through unauthenticated.
+- `requireScope`, `requireRole`, `requirePermission`, `requireGroup`, `requireClaim`, `requireOrganization`,
+  `requireAuthenticationLevel`, `requireAuthenticationMethod` and `requireClient` answer `403`, with
+  `insufficient_scope` or `insufficient_user_authentication` in `WWW-Authenticate` when that is the reason.
+- Every guard is also a rule: `requireAuthio(...)`, `allOf(...)` and `anyOf(...)` combine guards of this package and
+  rules of `@hyper.authio/server` alike, and are guards themselves.
+- `problemDetails: true` adds an RFC 9457 body; `passErrors: true` hands `AuthioBearerError` / `AuthioForbiddenError`
+  to `next(error)` for your own error handler. `sendAuthioError(res, error)` answers one by hand.
+- `authioWebhooks(options)` reads the raw body itself (or takes `express.raw()`'s buffer), and answers `200` handled
+  or duplicate, `400`, `401`, `413` or `500`.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,127 @@
+'use strict';
+
+var server = require('@hyper.authio/server');
+
+// src/index.ts
+var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
+function authioBearer(verifier, options = {}) {
+  const resolved = isVerifier(verifier) ? verifier : server.createAuthioVerifier(verifier);
+  return (request, response, next) => {
+    request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
+    const header = request.headers.authorization;
+    if (options.optional && !header) {
+      next();
+      return;
+    }
+    resolved.verifyAuthorizationHeader(header).then((user) => {
+      request.authio = { user, token: user.token };
+      next();
+    }).catch((error) => refuse(request, response, next, error, options));
+  };
+}
+function requireAuthio(...rules) {
+  if (rules.length === 0) throw new TypeError("requireAuthio needs at least one rule.");
+  const rule = rules.length === 1 ? rules[0] : server.allOf(...rules);
+  const guard = (request, response, next) => {
+    const user = request.authio?.user;
+    if (!user) return refuse(request, response, next, new server.AuthioBearerError(void 0, { error: void 0 }));
+    const failure = server.authorize(user, ...rules);
+    if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure));
+    next();
+  };
+  return Object.assign(guard, { description: rule.description, check: (user) => server.authorize(user, ...rules) });
+}
+var requireScope = (scopes, match) => requireAuthio(server.requireScope(scopes, match));
+var requireRole = (roles, options) => requireAuthio(server.requireRole(roles, options));
+var requirePermission = (resource, method, options) => requireAuthio(server.requirePermission(resource, method, options));
+var requireGroup = (groups, match) => requireAuthio(server.requireGroup(groups, match));
+var requireClaim = (type, ...values) => requireAuthio(server.requireClaim(type, ...values));
+var requireOrganization = (organization) => requireAuthio(server.requireOrganization(organization));
+var requireAuthenticationLevel = (minimumLevel) => requireAuthio(server.requireAuthenticationLevel(minimumLevel));
+var requireAuthenticationMethod = (methods, match) => requireAuthio(server.requireAuthenticationMethod(methods, match));
+var requireClient = (clientIds) => requireAuthio(server.requireClient(clientIds));
+var allOf = (...rules) => requireAuthio(server.allOf(...rules));
+var anyOf = (...rules) => requireAuthio(server.anyOf(...rules));
+function authioWebhooks(options) {
+  const webhooks = server.createAuthioWebhooks(options);
+  const route = ((request, response, next) => {
+    readRawBody(request, webhooks.maxBodySize).then(async (body) => {
+      if (body === void 0) {
+        response.status(413).end();
+        return;
+      }
+      const outcome = await webhooks.handle({ body, headers: request.headers });
+      response.status(outcome.status).end();
+    }).catch(next);
+  });
+  route.on = ((type, handler) => {
+    webhooks.on(type, handler);
+    return route;
+  });
+  return route;
+}
+function sendAuthioError(response, error, options = {}) {
+  const challenge = error.wwwAuthenticate;
+  if (challenge) response.append("WWW-Authenticate", challenge);
+  response.status(error.status);
+  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(server.toProblemDetails(error)));
+  else response.end();
+}
+function refuse(request, response, next, error, options) {
+  const settings = options ?? request[responseSettings] ?? {};
+  if (!(error instanceof server.AuthioBearerError) && !(error instanceof server.AuthioForbiddenError)) return next(error);
+  if (settings.passErrors) return next(error);
+  sendAuthioError(response, error, settings);
+}
+function readRawBody(request, maxBodySize) {
+  const parsed = request.body;
+  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? void 0 : new Uint8Array(parsed));
+  if (typeof parsed === "string") return Promise.resolve(new TextEncoder().encode(parsed));
+  if (request.readableEnded || parsed !== void 0 && parsed !== null && typeof parsed === "object" && Object.keys(parsed).length > 0)
+    return Promise.reject(
+      new Error("The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.")
+    );
+  const declared = Number(request.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(void 0);
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    request.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > maxBodySize) {
+        done = true;
+        request.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => {
+      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));
+    });
+    request.on("error", reject);
+  });
+}
+function isVerifier(value) {
+  return typeof value.verify === "function";
+}
+
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.authioBearer = authioBearer;
+exports.authioWebhooks = authioWebhooks;
+exports.requireAuthenticationLevel = requireAuthenticationLevel;
+exports.requireAuthenticationMethod = requireAuthenticationMethod;
+exports.requireAuthio = requireAuthio;
+exports.requireClaim = requireClaim;
+exports.requireClient = requireClient;
+exports.requireGroup = requireGroup;
+exports.requireOrganization = requireOrganization;
+exports.requirePermission = requirePermission;
+exports.requireRole = requireRole;
+exports.requireScope = requireScope;
+exports.sendAuthioError = sendAuthioError;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","allOfRule","AuthioBearerError","authorize","AuthioForbiddenError","scopeRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","clientRule","anyOfRule","createAuthioWebhooks","toProblemDetails"],"mappings":";;;;;AAmEA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAC5C,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIC,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBD,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcE,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcC,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,6BAA6B,CAAC,YAAA,KAAsC,aAAA,CAAcC,iCAAA,CAAwB,YAAY,CAAC;AAE7H,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,KAC/E,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAK,CAAC;AAEjD,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBd,wBAAA,CAAA,IAAsB,EAAE,iBAAiBE,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport type { AuthioResourceAccessSource, AuthioTypedWebhookEvent, AuthioWebhookDataByType } from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`). */\nexport const requireAuthenticationLevel = (minimumLevel: number): AuthioGuard => requireAuthio(authenticationLevelRule(minimumLevel));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/dist/index.d.cts

@@ -0,0 +1,101 @@
+import { RequestHandler, Response } from 'express';
+import { AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioWebhookHandler, AuthioVerifier, AuthioVerifierOptions, AuthioWebhookOptions, AuthioMatch, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
+
+/**
+ * What `authioBearer` puts on the request.
+ */
+interface AuthioRequestContext {
+    /** The caller. */
+    readonly user: AuthioUser;
+    /** The access token the caller was read from. */
+    readonly token: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            /** The Authio caller, once `authioBearer` validated the token. */
+            authio?: AuthioRequestContext;
+        }
+    }
+}
+/**
+ * How refusals are answered.
+ */
+interface AuthioResponseOptions {
+    /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */
+    problemDetails?: boolean;
+    /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */
+    passErrors?: boolean;
+}
+/**
+ * Options of `authioBearer`.
+ */
+interface AuthioBearerOptions extends AuthioResponseOptions {
+    /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */
+    optional?: boolean;
+}
+/**
+ * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the
+ * `WWW-Authenticate` challenge when the token is missing or invalid.
+ *
+ * @param verifier A verifier, or its options.
+ */
+declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options?: AuthioBearerOptions): RequestHandler;
+/**
+ * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and
+ * `anyOf` like any rule of `@hyper.authio/server`.
+ */
+type AuthioGuard = RequestHandler & AuthioRule;
+/**
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
+ * `403` with the joined refusal otherwise.
+ */
+declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
+/** Requires granted scopes. */
+declare const requireScope: (scopes: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires roles, from any source or only from the given `*_resource_access` claims. */
+declare const requireRole: (roles: string | readonly string[], options?: {
+    match?: AuthioMatch;
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires a permission (`method` on `resource`). */
+declare const requirePermission: (resource: string, method: string, options?: {
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires groups. */
+declare const requireGroup: (groups: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires a claim, or one of its values. */
+declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
+/** Requires an organization context, or a given organization. */
+declare const requireOrganization: (organization?: string) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`). */
+declare const requireAuthenticationLevel: (minimumLevel: number) => AuthioGuard;
+/** Requires authentication methods (`amr`). */
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires the token to have been issued to one of the clients. */
+declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
+/** Requires every rule. */
+declare const allOf: (...rules: AuthioRule[]) => AuthioGuard;
+/** Requires at least one rule. */
+declare const anyOf: (...rules: AuthioRule[]) => AuthioGuard;
+/**
+ * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON
+ * body parser, or behind `express.raw()`.
+ */
+interface AuthioWebhookRoute extends RequestHandler {
+    on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;
+    on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;
+}
+/**
+ * Creates a webhook route: `app.post("/webhooks/authio", authioWebhooks({ secret }).on("user_created", …))`.
+ * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
+ */
+declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
+ */
+declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
+
+export { type AuthioBearerOptions, type AuthioGuard, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };

package/dist/index.d.ts

@@ -0,0 +1,101 @@
+import { RequestHandler, Response } from 'express';
+import { AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioWebhookHandler, AuthioVerifier, AuthioVerifierOptions, AuthioWebhookOptions, AuthioMatch, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
+
+/**
+ * What `authioBearer` puts on the request.
+ */
+interface AuthioRequestContext {
+    /** The caller. */
+    readonly user: AuthioUser;
+    /** The access token the caller was read from. */
+    readonly token: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            /** The Authio caller, once `authioBearer` validated the token. */
+            authio?: AuthioRequestContext;
+        }
+    }
+}
+/**
+ * How refusals are answered.
+ */
+interface AuthioResponseOptions {
+    /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */
+    problemDetails?: boolean;
+    /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */
+    passErrors?: boolean;
+}
+/**
+ * Options of `authioBearer`.
+ */
+interface AuthioBearerOptions extends AuthioResponseOptions {
+    /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */
+    optional?: boolean;
+}
+/**
+ * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the
+ * `WWW-Authenticate` challenge when the token is missing or invalid.
+ *
+ * @param verifier A verifier, or its options.
+ */
+declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options?: AuthioBearerOptions): RequestHandler;
+/**
+ * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and
+ * `anyOf` like any rule of `@hyper.authio/server`.
+ */
+type AuthioGuard = RequestHandler & AuthioRule;
+/**
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
+ * `403` with the joined refusal otherwise.
+ */
+declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
+/** Requires granted scopes. */
+declare const requireScope: (scopes: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires roles, from any source or only from the given `*_resource_access` claims. */
+declare const requireRole: (roles: string | readonly string[], options?: {
+    match?: AuthioMatch;
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires a permission (`method` on `resource`). */
+declare const requirePermission: (resource: string, method: string, options?: {
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires groups. */
+declare const requireGroup: (groups: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires a claim, or one of its values. */
+declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
+/** Requires an organization context, or a given organization. */
+declare const requireOrganization: (organization?: string) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`). */
+declare const requireAuthenticationLevel: (minimumLevel: number) => AuthioGuard;
+/** Requires authentication methods (`amr`). */
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires the token to have been issued to one of the clients. */
+declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
+/** Requires every rule. */
+declare const allOf: (...rules: AuthioRule[]) => AuthioGuard;
+/** Requires at least one rule. */
+declare const anyOf: (...rules: AuthioRule[]) => AuthioGuard;
+/**
+ * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON
+ * body parser, or behind `express.raw()`.
+ */
+interface AuthioWebhookRoute extends RequestHandler {
+    on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;
+    on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;
+}
+/**
+ * Creates a webhook route: `app.post("/webhooks/authio", authioWebhooks({ secret }).on("user_created", …))`.
+ * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
+ */
+declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
+ */
+declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
+
+export { type AuthioBearerOptions, type AuthioGuard, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };

package/dist/index.js

@@ -0,0 +1,111 @@
+import { createAuthioVerifier, allOf as allOf$1, authorize, requireScope as requireScope$1, requireRole as requireRole$1, requirePermission as requirePermission$1, requireGroup as requireGroup$1, requireClaim as requireClaim$1, requireOrganization as requireOrganization$1, requireAuthenticationLevel as requireAuthenticationLevel$1, requireAuthenticationMethod as requireAuthenticationMethod$1, requireClient as requireClient$1, anyOf as anyOf$1, createAuthioWebhooks, toProblemDetails, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+
+// src/index.ts
+var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
+function authioBearer(verifier, options = {}) {
+  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);
+  return (request, response, next) => {
+    request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
+    const header = request.headers.authorization;
+    if (options.optional && !header) {
+      next();
+      return;
+    }
+    resolved.verifyAuthorizationHeader(header).then((user) => {
+      request.authio = { user, token: user.token };
+      next();
+    }).catch((error) => refuse(request, response, next, error, options));
+  };
+}
+function requireAuthio(...rules) {
+  if (rules.length === 0) throw new TypeError("requireAuthio needs at least one rule.");
+  const rule = rules.length === 1 ? rules[0] : allOf$1(...rules);
+  const guard = (request, response, next) => {
+    const user = request.authio?.user;
+    if (!user) return refuse(request, response, next, new AuthioBearerError(void 0, { error: void 0 }));
+    const failure = authorize(user, ...rules);
+    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));
+    next();
+  };
+  return Object.assign(guard, { description: rule.description, check: (user) => authorize(user, ...rules) });
+}
+var requireScope = (scopes, match) => requireAuthio(requireScope$1(scopes, match));
+var requireRole = (roles, options) => requireAuthio(requireRole$1(roles, options));
+var requirePermission = (resource, method, options) => requireAuthio(requirePermission$1(resource, method, options));
+var requireGroup = (groups, match) => requireAuthio(requireGroup$1(groups, match));
+var requireClaim = (type, ...values) => requireAuthio(requireClaim$1(type, ...values));
+var requireOrganization = (organization) => requireAuthio(requireOrganization$1(organization));
+var requireAuthenticationLevel = (minimumLevel) => requireAuthio(requireAuthenticationLevel$1(minimumLevel));
+var requireAuthenticationMethod = (methods, match) => requireAuthio(requireAuthenticationMethod$1(methods, match));
+var requireClient = (clientIds) => requireAuthio(requireClient$1(clientIds));
+var allOf = (...rules) => requireAuthio(allOf$1(...rules));
+var anyOf = (...rules) => requireAuthio(anyOf$1(...rules));
+function authioWebhooks(options) {
+  const webhooks = createAuthioWebhooks(options);
+  const route = ((request, response, next) => {
+    readRawBody(request, webhooks.maxBodySize).then(async (body) => {
+      if (body === void 0) {
+        response.status(413).end();
+        return;
+      }
+      const outcome = await webhooks.handle({ body, headers: request.headers });
+      response.status(outcome.status).end();
+    }).catch(next);
+  });
+  route.on = ((type, handler) => {
+    webhooks.on(type, handler);
+    return route;
+  });
+  return route;
+}
+function sendAuthioError(response, error, options = {}) {
+  const challenge = error.wwwAuthenticate;
+  if (challenge) response.append("WWW-Authenticate", challenge);
+  response.status(error.status);
+  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(toProblemDetails(error)));
+  else response.end();
+}
+function refuse(request, response, next, error, options) {
+  const settings = options ?? request[responseSettings] ?? {};
+  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);
+  if (settings.passErrors) return next(error);
+  sendAuthioError(response, error, settings);
+}
+function readRawBody(request, maxBodySize) {
+  const parsed = request.body;
+  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? void 0 : new Uint8Array(parsed));
+  if (typeof parsed === "string") return Promise.resolve(new TextEncoder().encode(parsed));
+  if (request.readableEnded || parsed !== void 0 && parsed !== null && typeof parsed === "object" && Object.keys(parsed).length > 0)
+    return Promise.reject(
+      new Error("The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.")
+    );
+  const declared = Number(request.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(void 0);
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    request.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > maxBodySize) {
+        done = true;
+        request.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => {
+      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));
+    });
+    request.on("error", reject);
+  });
+}
+function isVerifier(value) {
+  return typeof value.verify === "function";
+}
+
+export { allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["allOfRule","scopeRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","clientRule","anyOfRule"],"mappings":";;;AAmEA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAC5C,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKA,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcC,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,6BAA6B,CAAC,YAAA,KAAsC,aAAA,CAAcC,4BAAA,CAAwB,YAAY,CAAC;AAE7H,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,KAC/E,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAK,CAAC;AAEjD,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcT,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcU,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport type { AuthioResourceAccessSource, AuthioTypedWebhookEvent, AuthioWebhookDataByType } from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`). */\nexport const requireAuthenticationLevel = (minimumLevel: number): AuthioGuard => requireAuthio(authenticationLevelRule(minimumLevel));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@hyper.authio/express",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Express middleware for Authio: bearer validation, scope/role/permission/group/claim/organization/acr/amr/client guards, and signed webhook routes.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "@hyper.authio/client": "0.1.1",
+    "@hyper.authio/server": "0.1.1"
+  },
+  "keywords": [
+    "authio",
+    "express",
+    "oauth",
+    "jwt",
+    "authorization",
+    "middleware"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/LeonardoFerreira1209/authio-node.git",
+    "directory": "packages/express"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "express": ">=4.18 <6"
+  }
+}