@hyper.authio/express 0.0.0-stage → 0.7.0

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# @hyper.authio/express
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Protect an Express 4 or 5 API with Authio: bearer validation, guards for every form of permission and for the caller
+kind, step-up challenges, protected resource metadata (RFC 9728), a back-channel logout endpoint, and a signed webhook
+route. Built on [`@hyper.authio/server`](../server/README.md).
+
+```bash
+npm install @hyper.authio/express
+```
+
+```ts
+import express from "express";
+import {
+  anyOf,
+  authioBearer,
+  authioWebhooks,
+  requireAuthenticationLevel,
+  requireAuthio,
+  requireGroup,
+  requireOrganization,
+  requirePermission,
+  requireRole,
+  requireScope,
+} from "@hyper.authio/express";
+
+const app = express();
+
+// Before any JSON parser: the signature is checked over the raw body.
+app.post(
+  "/webhooks/authio",
+  authioWebhooks({ secret: process.env.AUTHIO_WEBHOOK_SECRET }).on("user_deleted", async (event) => {
+    await forget(event.data.id);
+  }),
+);
+
+app.use(express.json());
+app.use("/api", authioBearer({ issuer: "https://auth.example.com/realms/acme", audiences: "https://orders.example.com" }));
+
+app.get("/api/me", (req, res) => res.json(req.authio!.user));
+app.get("/api/orders", requireScope("orders:read"), requirePermission("orders", "read"), listOrders);
+app.delete("/api/orders/:id", requireRole("orders-admin", { sources: ["user"] }), deleteOrder);
+app.get("/api/finance", requireGroup("finance"), financeReport);
+app.post("/api/payouts", requireAuthio(requirePermission("payouts", "create"), anyOf(requireAuthenticationLevel(2), requireOrganization("acme"))), payout);
+```
+
+- `authioBearer(verifierOrOptions, { optional?, problemDetails?, passErrors? })` validates the token and puts
+  `{ user, token }` on `req.authio`; it answers `401` with `WWW-Authenticate`. With `optional`, a request without a
+  token goes through unauthenticated.
+- `requireScope`, `requireRole`, `requirePermission`, `requireGroup`, `requireClaim`, `requireOrganization`,
+  `requireAuthenticationLevel`, `requireAuthenticationMethod`, `requireRecentAuthentication`, `requireCallerKind` and
+  `requireClient` answer `403`, with `insufficient_scope` or `insufficient_user_authentication` (with `acr_values` and
+  `max_age`, RFC 9470) in `WWW-Authenticate` when that is the reason.
+- With `requiredScopes` on the verifier, `authioBearer` itself answers `403 insufficient_scope` when a token lacks one.
+- Every guard is also a rule: `requireAuthio(...)`, `allOf(...)` and `anyOf(...)` combine guards of this package and
+  rules of `@hyper.authio/server` alike, and are guards themselves.
+- `problemDetails: true` adds an RFC 9457 body; `passErrors: true` hands `AuthioBearerError` / `AuthioForbiddenError`
+  to `next(error)` for your own error handler. `sendAuthioError(res, error)` answers one by hand.
+- `authioWebhooks(options)` reads the raw body itself (or takes `express.raw()`'s buffer), and answers `200` handled
+  or duplicate, `400`, `401`, `413` or `500`.
+
+## Protected resource metadata (RFC 9728)
+
+```ts
+const verifier = createAuthioVerifier({ issuer, resource: "https://orders.example.com/api", resourceMetadata: true });
+
+app.use(authioProtectedResourceMetadata({ verifier, resourceName: "Orders" })); // GET /.well-known/oauth-protected-resource/api
+app.use("/api", authioBearer(verifier)); // 401: Bearer resource_metadata="https://orders.example.com/.well-known/oauth-protected-resource/api"
+```
+
+## Back-channel logout
+
+```ts
+const client = createAuthioClient({ issuer, clientId: "storefront", clientSecret });
+
+app.post(
+  "/auth/backchannel-logout",
+  authioBackchannelLogout({
+    client,
+    onLogout: async ({ subject, sessionId }) => sessions.destroyWhere({ subject, sessionId }), // your session store
+  }),
+);
+```
+
+Register the URL as the client's back-channel logout URI in Authio. The handler reads `logout_token` (with or without
+`express.urlencoded()`), validates it with `client.validateLogoutToken`, answers `200`, `400` (`invalid_request`) for
+a token that does not validate, and always sends `Cache-Control: no-store`.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,183 @@
+'use strict';
+
+var client = require('@hyper.authio/client');
+var server = require('@hyper.authio/server');
+
+// src/index.ts
+var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
+function authioBearer(verifier, options = {}) {
+  const resolved = isVerifier(verifier) ? verifier : server.createAuthioVerifier(verifier);
+  return (request, response, next) => {
+    request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
+    const header = request.headers.authorization;
+    if (options.optional && !header) {
+      next();
+      return;
+    }
+    resolved.verifyAuthorizationHeader(header).then((user) => {
+      request.authio = { user, token: user.token };
+      const failure = resolved.requiredScopes.length > 0 ? server.requireScope(resolved.requiredScopes, "all").check(user) : void 0;
+      if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure), options);
+      next();
+    }).catch((error) => refuse(request, response, next, error, options));
+  };
+}
+function requireAuthio(...rules) {
+  if (rules.length === 0) throw new TypeError("requireAuthio needs at least one rule.");
+  const rule = rules.length === 1 ? rules[0] : server.allOf(...rules);
+  const guard = (request, response, next) => {
+    const user = request.authio?.user;
+    if (!user) return refuse(request, response, next, new server.AuthioBearerError(void 0, { error: void 0 }));
+    const failure = server.authorize(user, ...rules);
+    if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure));
+    next();
+  };
+  return Object.assign(guard, { description: rule.description, check: (user) => server.authorize(user, ...rules) });
+}
+var requireScope = (scopes, match) => requireAuthio(server.requireScope(scopes, match));
+var requireRole = (roles, options) => requireAuthio(server.requireRole(roles, options));
+var requirePermission = (resource, method, options) => requireAuthio(server.requirePermission(resource, method, options));
+var requireGroup = (groups, match) => requireAuthio(server.requireGroup(groups, match));
+var requireClaim = (type, ...values) => requireAuthio(server.requireClaim(type, ...values));
+var requireOrganization = (organization) => requireAuthio(server.requireOrganization(organization));
+var requireAuthenticationLevel = (minimumLevel, options) => requireAuthio(server.requireAuthenticationLevel(minimumLevel, options));
+var requireAuthenticationMethod = (methods, match, options) => requireAuthio(server.requireAuthenticationMethod(methods, match, options));
+var requireRecentAuthentication = (maxAge, options) => requireAuthio(server.requireRecentAuthentication(maxAge, options));
+var requireCallerKind = (kinds) => requireAuthio(server.requireCallerKind(kinds));
+var requireClient = (clientIds) => requireAuthio(server.requireClient(clientIds));
+var allOf = (...rules) => requireAuthio(server.allOf(...rules));
+var anyOf = (...rules) => requireAuthio(server.anyOf(...rules));
+function authioWebhooks(options) {
+  const webhooks = server.createAuthioWebhooks(options);
+  const route = ((request, response, next) => {
+    readRawBody(request, webhooks.maxBodySize).then(async (body) => {
+      if (body === void 0) {
+        response.status(413).end();
+        return;
+      }
+      const outcome = await webhooks.handle({ body, headers: request.headers });
+      response.status(outcome.status).end();
+    }).catch(next);
+  });
+  route.on = ((type, handler) => {
+    webhooks.on(type, handler);
+    return route;
+  });
+  return route;
+}
+function authioProtectedResourceMetadata(options) {
+  const settings = "verifier" in options ? {
+    ...options,
+    resource: requireResource(options.verifier),
+    issuer: options.verifier.connection.issuer,
+    scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : void 0)
+  } : options;
+  const document = JSON.stringify(server.createProtectedResourceMetadata(settings));
+  const path = server.protectedResourceMetadataPath(settings.resource);
+  return (request, response, next) => {
+    if (request.method !== "GET" && request.method !== "HEAD" || request.path.replace(/\/+$/, "") !== path) return next();
+    response.set("Cache-Control", "public, max-age=3600").type("application/json").send(document);
+  };
+}
+function authioBackchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    readLogoutToken(request).then(async (logoutToken) => {
+      if (!logoutToken) {
+        response.status(400).json({ error: "invalid_request", error_description: "The request carries no logout_token." });
+        return;
+      }
+      let logout;
+      try {
+        logout = await options.client.validateLogoutToken(logoutToken);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof client.AuthioTokenValidationError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).end();
+    }).catch(next);
+  };
+}
+function sendAuthioError(response, error, options = {}) {
+  const challenge = error.wwwAuthenticate;
+  if (challenge) response.append("WWW-Authenticate", challenge);
+  response.status(error.status);
+  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(server.toProblemDetails(error)));
+  else response.end();
+}
+function refuse(request, response, next, error, options) {
+  const settings = options ?? request[responseSettings] ?? {};
+  if (!(error instanceof server.AuthioBearerError) && !(error instanceof server.AuthioForbiddenError)) return next(error);
+  if (settings.passErrors) return next(error);
+  sendAuthioError(response, error, settings);
+}
+function readRawBody(request, maxBodySize) {
+  const parsed = request.body;
+  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? void 0 : new Uint8Array(parsed));
+  if (typeof parsed === "string") return Promise.resolve(new TextEncoder().encode(parsed));
+  if (request.readableEnded || parsed !== void 0 && parsed !== null && typeof parsed === "object" && Object.keys(parsed).length > 0)
+    return Promise.reject(
+      new Error("The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.")
+    );
+  const declared = Number(request.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(void 0);
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    request.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > maxBodySize) {
+        done = true;
+        request.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => {
+      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));
+    });
+    request.on("error", reject);
+  });
+}
+async function readLogoutToken(request) {
+  const parsed = request.body;
+  if (parsed && typeof parsed === "object" && !Buffer.isBuffer(parsed) && typeof parsed.logout_token === "string")
+    return parsed.logout_token;
+  const raw = Buffer.isBuffer(parsed) ? new Uint8Array(parsed) : typeof parsed === "string" ? new TextEncoder().encode(parsed) : request.readableEnded ? void 0 : await readRawBody(request, 64 * 1024);
+  return raw ? new URLSearchParams(new TextDecoder().decode(raw)).get("logout_token") ?? void 0 : void 0;
+}
+function requireResource(verifier) {
+  if (!verifier.resource) throw new TypeError("authioProtectedResourceMetadata needs a verifier configured with resource.");
+  return verifier.resource;
+}
+function isVerifier(value) {
+  return typeof value.verify === "function";
+}
+
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.authioBackchannelLogout = authioBackchannelLogout;
+exports.authioBearer = authioBearer;
+exports.authioProtectedResourceMetadata = authioProtectedResourceMetadata;
+exports.authioWebhooks = authioWebhooks;
+exports.requireAuthenticationLevel = requireAuthenticationLevel;
+exports.requireAuthenticationMethod = requireAuthenticationMethod;
+exports.requireAuthio = requireAuthio;
+exports.requireCallerKind = requireCallerKind;
+exports.requireClaim = requireClaim;
+exports.requireClient = requireClient;
+exports.requireGroup = requireGroup;
+exports.requireOrganization = requireOrganization;
+exports.requirePermission = requirePermission;
+exports.requireRecentAuthentication = requireRecentAuthentication;
+exports.requireRole = requireRole;
+exports.requireScope = requireScope;
+exports.sendAuthioError = sendAuthioError;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","toProblemDetails"],"mappings":";;;;;;AAiFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBjB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/dist/index.d.cts

@@ -0,0 +1,139 @@
+import { Request, RequestHandler, Response } from 'express';
+import { AuthioClient, AuthioLogoutToken, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
+
+/**
+ * What `authioBearer` puts on the request.
+ */
+interface AuthioRequestContext {
+    /** The caller. */
+    readonly user: AuthioUser;
+    /** The access token the caller was read from. */
+    readonly token: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            /** The Authio caller, once `authioBearer` validated the token. */
+            authio?: AuthioRequestContext;
+        }
+    }
+}
+/**
+ * How refusals are answered.
+ */
+interface AuthioResponseOptions {
+    /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */
+    problemDetails?: boolean;
+    /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */
+    passErrors?: boolean;
+}
+/**
+ * Options of `authioBearer`.
+ */
+interface AuthioBearerOptions extends AuthioResponseOptions {
+    /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */
+    optional?: boolean;
+}
+/**
+ * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the
+ * `WWW-Authenticate` challenge when the token is missing or invalid.
+ *
+ * @param verifier A verifier, or its options.
+ */
+declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options?: AuthioBearerOptions): RequestHandler;
+/**
+ * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and
+ * `anyOf` like any rule of `@hyper.authio/server`.
+ */
+type AuthioGuard = RequestHandler & AuthioRule;
+/**
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
+ * `403` with the joined refusal otherwise.
+ */
+declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
+/** Requires granted scopes. */
+declare const requireScope: (scopes: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires roles, from any source or only from the given `*_resource_access` claims. */
+declare const requireRole: (roles: string | readonly string[], options?: {
+    match?: AuthioMatch;
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires a permission (`method` on `resource`). */
+declare const requirePermission: (resource: string, method: string, options?: {
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires groups. */
+declare const requireGroup: (groups: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires a claim, or one of its values. */
+declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
+/** Requires an organization context, or a given organization. */
+declare const requireOrganization: (organization?: string) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */
+declare const requireAuthenticationLevel: (minimumLevel: number, options?: Parameters<typeof requireAuthenticationLevel$1>[1]) => AuthioGuard;
+/** Requires authentication methods (`amr`). */
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch, options?: {
+    acrValues?: string;
+}) => AuthioGuard;
+/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */
+declare const requireRecentAuthentication: (maxAge: number, options?: Parameters<typeof requireRecentAuthentication$1>[1]) => AuthioGuard;
+/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */
+declare const requireCallerKind: (kinds: AuthioCallerKind | readonly AuthioCallerKind[]) => AuthioGuard;
+/** Requires the token to have been issued to one of the clients. */
+declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
+/** Requires every rule. */
+declare const allOf: (...rules: AuthioRule[]) => AuthioGuard;
+/** Requires at least one rule. */
+declare const anyOf: (...rules: AuthioRule[]) => AuthioGuard;
+/**
+ * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON
+ * body parser, or behind `express.raw()`.
+ */
+interface AuthioWebhookRoute extends RequestHandler {
+    on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;
+    on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;
+}
+/**
+ * Creates a webhook route: `app.post("/webhooks/authio", authioWebhooks({ secret }).on("user_created", …))`.
+ * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
+ */
+declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.
+ */
+type AuthioProtectedResourceMetadataRouteOptions = AuthioProtectedResourceMetadataOptions | (Omit<AuthioProtectedResourceMetadataOptions, "resource" | "issuer" | "authority" | "realm"> & {
+    verifier: AuthioVerifier;
+});
+/**
+ * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the
+ * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.
+ */
+declare function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler;
+/**
+ * Options of `authioBackchannelLogout`.
+ */
+interface AuthioBackchannelLogoutOptions {
+    /** The client the logout tokens are addressed to (its id is their audience). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is
+     * the application's.
+     */
+    onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;
+    /** Called when a token is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the
+ * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`
+ * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:
+ * no-store`. Works with or without `express.urlencoded()` in front of it.
+ */
+declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
+ */
+declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
+
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.d.ts

@@ -0,0 +1,139 @@
+import { Request, RequestHandler, Response } from 'express';
+import { AuthioClient, AuthioLogoutToken, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
+
+/**
+ * What `authioBearer` puts on the request.
+ */
+interface AuthioRequestContext {
+    /** The caller. */
+    readonly user: AuthioUser;
+    /** The access token the caller was read from. */
+    readonly token: string;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            /** The Authio caller, once `authioBearer` validated the token. */
+            authio?: AuthioRequestContext;
+        }
+    }
+}
+/**
+ * How refusals are answered.
+ */
+interface AuthioResponseOptions {
+    /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */
+    problemDetails?: boolean;
+    /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */
+    passErrors?: boolean;
+}
+/**
+ * Options of `authioBearer`.
+ */
+interface AuthioBearerOptions extends AuthioResponseOptions {
+    /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */
+    optional?: boolean;
+}
+/**
+ * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the
+ * `WWW-Authenticate` challenge when the token is missing or invalid.
+ *
+ * @param verifier A verifier, or its options.
+ */
+declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options?: AuthioBearerOptions): RequestHandler;
+/**
+ * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and
+ * `anyOf` like any rule of `@hyper.authio/server`.
+ */
+type AuthioGuard = RequestHandler & AuthioRule;
+/**
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
+ * `403` with the joined refusal otherwise.
+ */
+declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
+/** Requires granted scopes. */
+declare const requireScope: (scopes: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires roles, from any source or only from the given `*_resource_access` claims. */
+declare const requireRole: (roles: string | readonly string[], options?: {
+    match?: AuthioMatch;
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires a permission (`method` on `resource`). */
+declare const requirePermission: (resource: string, method: string, options?: {
+    sources?: readonly AuthioResourceAccessSource[];
+}) => AuthioGuard;
+/** Requires groups. */
+declare const requireGroup: (groups: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+/** Requires a claim, or one of its values. */
+declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
+/** Requires an organization context, or a given organization. */
+declare const requireOrganization: (organization?: string) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */
+declare const requireAuthenticationLevel: (minimumLevel: number, options?: Parameters<typeof requireAuthenticationLevel$1>[1]) => AuthioGuard;
+/** Requires authentication methods (`amr`). */
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch, options?: {
+    acrValues?: string;
+}) => AuthioGuard;
+/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */
+declare const requireRecentAuthentication: (maxAge: number, options?: Parameters<typeof requireRecentAuthentication$1>[1]) => AuthioGuard;
+/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */
+declare const requireCallerKind: (kinds: AuthioCallerKind | readonly AuthioCallerKind[]) => AuthioGuard;
+/** Requires the token to have been issued to one of the clients. */
+declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
+/** Requires every rule. */
+declare const allOf: (...rules: AuthioRule[]) => AuthioGuard;
+/** Requires at least one rule. */
+declare const anyOf: (...rules: AuthioRule[]) => AuthioGuard;
+/**
+ * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON
+ * body parser, or behind `express.raw()`.
+ */
+interface AuthioWebhookRoute extends RequestHandler {
+    on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;
+    on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;
+}
+/**
+ * Creates a webhook route: `app.post("/webhooks/authio", authioWebhooks({ secret }).on("user_created", …))`.
+ * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
+ */
+declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.
+ */
+type AuthioProtectedResourceMetadataRouteOptions = AuthioProtectedResourceMetadataOptions | (Omit<AuthioProtectedResourceMetadataOptions, "resource" | "issuer" | "authority" | "realm"> & {
+    verifier: AuthioVerifier;
+});
+/**
+ * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the
+ * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.
+ */
+declare function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler;
+/**
+ * Options of `authioBackchannelLogout`.
+ */
+interface AuthioBackchannelLogoutOptions {
+    /** The client the logout tokens are addressed to (its id is their audience). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is
+     * the application's.
+     */
+    onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;
+    /** Called when a token is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the
+ * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`
+ * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:
+ * no-store`. Works with or without `express.urlencoded()` in front of it.
+ */
+declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
+ */
+declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
+
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.js

@@ -0,0 +1,163 @@
+import { AuthioTokenValidationError } from '@hyper.authio/client';
+import { createAuthioVerifier, requireScope as requireScope$1, AuthioForbiddenError, allOf as allOf$1, authorize, requireRole as requireRole$1, requirePermission as requirePermission$1, requireGroup as requireGroup$1, requireClaim as requireClaim$1, requireOrganization as requireOrganization$1, requireAuthenticationLevel as requireAuthenticationLevel$1, requireAuthenticationMethod as requireAuthenticationMethod$1, requireRecentAuthentication as requireRecentAuthentication$1, requireCallerKind as requireCallerKind$1, requireClient as requireClient$1, anyOf as anyOf$1, createAuthioWebhooks, createProtectedResourceMetadata, protectedResourceMetadataPath, toProblemDetails, AuthioBearerError } from '@hyper.authio/server';
+
+// src/index.ts
+var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
+function authioBearer(verifier, options = {}) {
+  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);
+  return (request, response, next) => {
+    request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
+    const header = request.headers.authorization;
+    if (options.optional && !header) {
+      next();
+      return;
+    }
+    resolved.verifyAuthorizationHeader(header).then((user) => {
+      request.authio = { user, token: user.token };
+      const failure = resolved.requiredScopes.length > 0 ? requireScope$1(resolved.requiredScopes, "all").check(user) : void 0;
+      if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure), options);
+      next();
+    }).catch((error) => refuse(request, response, next, error, options));
+  };
+}
+function requireAuthio(...rules) {
+  if (rules.length === 0) throw new TypeError("requireAuthio needs at least one rule.");
+  const rule = rules.length === 1 ? rules[0] : allOf$1(...rules);
+  const guard = (request, response, next) => {
+    const user = request.authio?.user;
+    if (!user) return refuse(request, response, next, new AuthioBearerError(void 0, { error: void 0 }));
+    const failure = authorize(user, ...rules);
+    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));
+    next();
+  };
+  return Object.assign(guard, { description: rule.description, check: (user) => authorize(user, ...rules) });
+}
+var requireScope = (scopes, match) => requireAuthio(requireScope$1(scopes, match));
+var requireRole = (roles, options) => requireAuthio(requireRole$1(roles, options));
+var requirePermission = (resource, method, options) => requireAuthio(requirePermission$1(resource, method, options));
+var requireGroup = (groups, match) => requireAuthio(requireGroup$1(groups, match));
+var requireClaim = (type, ...values) => requireAuthio(requireClaim$1(type, ...values));
+var requireOrganization = (organization) => requireAuthio(requireOrganization$1(organization));
+var requireAuthenticationLevel = (minimumLevel, options) => requireAuthio(requireAuthenticationLevel$1(minimumLevel, options));
+var requireAuthenticationMethod = (methods, match, options) => requireAuthio(requireAuthenticationMethod$1(methods, match, options));
+var requireRecentAuthentication = (maxAge, options) => requireAuthio(requireRecentAuthentication$1(maxAge, options));
+var requireCallerKind = (kinds) => requireAuthio(requireCallerKind$1(kinds));
+var requireClient = (clientIds) => requireAuthio(requireClient$1(clientIds));
+var allOf = (...rules) => requireAuthio(allOf$1(...rules));
+var anyOf = (...rules) => requireAuthio(anyOf$1(...rules));
+function authioWebhooks(options) {
+  const webhooks = createAuthioWebhooks(options);
+  const route = ((request, response, next) => {
+    readRawBody(request, webhooks.maxBodySize).then(async (body) => {
+      if (body === void 0) {
+        response.status(413).end();
+        return;
+      }
+      const outcome = await webhooks.handle({ body, headers: request.headers });
+      response.status(outcome.status).end();
+    }).catch(next);
+  });
+  route.on = ((type, handler) => {
+    webhooks.on(type, handler);
+    return route;
+  });
+  return route;
+}
+function authioProtectedResourceMetadata(options) {
+  const settings = "verifier" in options ? {
+    ...options,
+    resource: requireResource(options.verifier),
+    issuer: options.verifier.connection.issuer,
+    scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : void 0)
+  } : options;
+  const document = JSON.stringify(createProtectedResourceMetadata(settings));
+  const path = protectedResourceMetadataPath(settings.resource);
+  return (request, response, next) => {
+    if (request.method !== "GET" && request.method !== "HEAD" || request.path.replace(/\/+$/, "") !== path) return next();
+    response.set("Cache-Control", "public, max-age=3600").type("application/json").send(document);
+  };
+}
+function authioBackchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    readLogoutToken(request).then(async (logoutToken) => {
+      if (!logoutToken) {
+        response.status(400).json({ error: "invalid_request", error_description: "The request carries no logout_token." });
+        return;
+      }
+      let logout;
+      try {
+        logout = await options.client.validateLogoutToken(logoutToken);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof AuthioTokenValidationError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).end();
+    }).catch(next);
+  };
+}
+function sendAuthioError(response, error, options = {}) {
+  const challenge = error.wwwAuthenticate;
+  if (challenge) response.append("WWW-Authenticate", challenge);
+  response.status(error.status);
+  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(toProblemDetails(error)));
+  else response.end();
+}
+function refuse(request, response, next, error, options) {
+  const settings = options ?? request[responseSettings] ?? {};
+  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);
+  if (settings.passErrors) return next(error);
+  sendAuthioError(response, error, settings);
+}
+function readRawBody(request, maxBodySize) {
+  const parsed = request.body;
+  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? void 0 : new Uint8Array(parsed));
+  if (typeof parsed === "string") return Promise.resolve(new TextEncoder().encode(parsed));
+  if (request.readableEnded || parsed !== void 0 && parsed !== null && typeof parsed === "object" && Object.keys(parsed).length > 0)
+    return Promise.reject(
+      new Error("The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.")
+    );
+  const declared = Number(request.headers["content-length"]);
+  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(void 0);
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    request.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > maxBodySize) {
+        done = true;
+        request.pause();
+        resolve(void 0);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request.on("end", () => {
+      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));
+    });
+    request.on("error", reject);
+  });
+}
+async function readLogoutToken(request) {
+  const parsed = request.body;
+  if (parsed && typeof parsed === "object" && !Buffer.isBuffer(parsed) && typeof parsed.logout_token === "string")
+    return parsed.logout_token;
+  const raw = Buffer.isBuffer(parsed) ? new Uint8Array(parsed) : typeof parsed === "string" ? new TextEncoder().encode(parsed) : request.readableEnded ? void 0 : await readRawBody(request, 64 * 1024);
+  return raw ? new URLSearchParams(new TextDecoder().decode(raw)).get("logout_token") ?? void 0 : void 0;
+}
+function requireResource(verifier) {
+  if (!verifier.resource) throw new TypeError("authioProtectedResourceMetadata needs a verifier configured with resource.");
+  return verifier.resource;
+}
+function isVerifier(value) {
+  return typeof value.verify === "function";
+}
+
+export { allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAiFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@hyper.authio/express",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.7.0",
+  "description": "Express middleware for Authio: bearer validation, scope/role/permission/group/claim/organization/acr/amr/client guards, and signed webhook routes.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "scripts": {
+    "build": "tsup"
+  },
+  "dependencies": {
+    "@hyper.authio/client": "0.7.0",
+    "@hyper.authio/server": "0.7.0"
+  },
+  "keywords": [
+    "authio",
+    "express",
+    "oauth",
+    "jwt",
+    "authorization",
+    "middleware"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/LeonardoFerreira1209/authio-node.git",
+    "directory": "packages/express"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "express": ">=4.18 <6"
+  }
+}