@hyper.authio/express 0.1.1 → 0.8.0

package/README.md

@@ -1,7 +1,8 @@
 # @hyper.authio/express
 
-Protect an Express 4 or 5 API with Authio: bearer validation, guards for every form of permission, and a signed
-webhook route. Built on [`@hyper.authio/server`](../server/README.md).
+Protect an Express 4 or 5 API with Authio: bearer validation, guards for every form of permission and for the caller
+kind, step-up challenges, protected resource metadata (RFC 9728), a back-channel logout endpoint, and a signed webhook
+route. Built on [`@hyper.authio/server`](../server/README.md).
 
 ```bash
 npm install @hyper.authio/express
@@ -46,8 +47,10 @@ app.post("/api/payouts", requireAuthio(requirePermission("payouts", "create"), a
   `{ user, token }` on `req.authio`; it answers `401` with `WWW-Authenticate`. With `optional`, a request without a
   token goes through unauthenticated.
 - `requireScope`, `requireRole`, `requirePermission`, `requireGroup`, `requireClaim`, `requireOrganization`,
-  `requireAuthenticationLevel`, `requireAuthenticationMethod` and `requireClient` answer `403`, with
-  `insufficient_scope` or `insufficient_user_authentication` in `WWW-Authenticate` when that is the reason.
+  `requireAuthenticationLevel`, `requireAuthenticationMethod`, `requireRecentAuthentication`, `requireCallerKind` and
+  `requireClient` answer `403`, with `insufficient_scope` or `insufficient_user_authentication` (with `acr_values` and
+  `max_age`, RFC 9470) in `WWW-Authenticate` when that is the reason.
+- With `requiredScopes` on the verifier, `authioBearer` itself answers `403 insufficient_scope` when a token lacks one.
 - Every guard is also a rule: `requireAuthio(...)`, `allOf(...)` and `anyOf(...)` combine guards of this package and
   rules of `@hyper.authio/server` alike, and are guards themselves.
 - `problemDetails: true` adds an RFC 9457 body; `passErrors: true` hands `AuthioBearerError` / `AuthioForbiddenError`
@@ -55,6 +58,50 @@ app.post("/api/payouts", requireAuthio(requirePermission("payouts", "create"), a
 - `authioWebhooks(options)` reads the raw body itself (or takes `express.raw()`'s buffer), and answers `200` handled
   or duplicate, `400`, `401`, `413` or `500`.
 
+## Protected resource metadata (RFC 9728)
+
+```ts
+const verifier = createAuthioVerifier({ issuer, resource: "https://orders.example.com/api", resourceMetadata: true });
+
+app.use(authioProtectedResourceMetadata({ verifier, resourceName: "Orders" })); // GET /.well-known/oauth-protected-resource/api
+app.use("/api", authioBearer(verifier)); // 401: Bearer resource_metadata="https://orders.example.com/.well-known/oauth-protected-resource/api"
+```
+
+## Back-channel logout
+
+```ts
+const client = createAuthioClient({ issuer, clientId: "storefront", clientSecret });
+
+app.post(
+  "/auth/backchannel-logout",
+  authioBackchannelLogout({
+    client,
+    onLogout: async ({ subject, sessionId }) => sessions.destroyWhere({ subject, sessionId }), // your session store
+  }),
+);
+```
+
+Register the URL as the client's back-channel logout URI in Authio. The handler reads `logout_token` (with or without
+`express.urlencoded()`), validates it with `client.validateLogoutToken`, answers `200`, `400` (`invalid_request`) for
+a token that does not validate, and always sends `Cache-Control: no-store`.
+
+## Front-channel logout
+
+```ts
+app.get(
+  "/auth/frontchannel-logout",
+  authioFrontchannelLogout({
+    client,
+    onLogout: async ({ sessionId }, request) => (sessionId ? sessions.destroyWhere({ sessionId }) : sessions.destroy(request)),
+  }),
+);
+```
+
+Register the URL as the client's front-channel logout URI in Authio, with the session required so Authio sends `iss`
+and `sid`. Authio loads it in an iframe when a session ends; the handler checks `iss` with
+`client.validateFrontChannelLogout`, answers `200` with an empty page, `400` (`invalid_request`) for another issuer or a
+`sid` without `iss`, and always sends `Cache-Control: no-store`.
+
 ## License
 
 MIT

package/dist/index.cjs

@@ -1,5 +1,6 @@
 'use strict';
 
+var client = require('@hyper.authio/client');
 var server = require('@hyper.authio/server');
 
 // src/index.ts
@@ -15,6 +16,8 @@ function authioBearer(verifier, options = {}) {
     }
     resolved.verifyAuthorizationHeader(header).then((user) => {
       request.authio = { user, token: user.token };
+      const failure = resolved.requiredScopes.length > 0 ? server.requireScope(resolved.requiredScopes, "all").check(user) : void 0;
+      if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure), options);
       next();
     }).catch((error) => refuse(request, response, next, error, options));
   };
@@ -37,8 +40,10 @@ var requirePermission = (resource, method, options) => requireAuthio(server.requ
 var requireGroup = (groups, match) => requireAuthio(server.requireGroup(groups, match));
 var requireClaim = (type, ...values) => requireAuthio(server.requireClaim(type, ...values));
 var requireOrganization = (organization) => requireAuthio(server.requireOrganization(organization));
-var requireAuthenticationLevel = (minimumLevel) => requireAuthio(server.requireAuthenticationLevel(minimumLevel));
-var requireAuthenticationMethod = (methods, match) => requireAuthio(server.requireAuthenticationMethod(methods, match));
+var requireAuthenticationLevel = (minimumLevel, options) => requireAuthio(server.requireAuthenticationLevel(minimumLevel, options));
+var requireAuthenticationMethod = (methods, match, options) => requireAuthio(server.requireAuthenticationMethod(methods, match, options));
+var requireRecentAuthentication = (maxAge, options) => requireAuthio(server.requireRecentAuthentication(maxAge, options));
+var requireCallerKind = (kinds) => requireAuthio(server.requireCallerKind(kinds));
 var requireClient = (clientIds) => requireAuthio(server.requireClient(clientIds));
 var allOf = (...rules) => requireAuthio(server.allOf(...rules));
 var anyOf = (...rules) => requireAuthio(server.anyOf(...rules));
@@ -60,6 +65,60 @@ function authioWebhooks(options) {
   });
   return route;
 }
+function authioProtectedResourceMetadata(options) {
+  const settings = "verifier" in options ? {
+    ...options,
+    resource: requireResource(options.verifier),
+    issuer: options.verifier.connection.issuer,
+    scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : void 0)
+  } : options;
+  const document = JSON.stringify(server.createProtectedResourceMetadata(settings));
+  const path = server.protectedResourceMetadataPath(settings.resource);
+  return (request, response, next) => {
+    if (request.method !== "GET" && request.method !== "HEAD" || request.path.replace(/\/+$/, "") !== path) return next();
+    response.set("Cache-Control", "public, max-age=3600").type("application/json").send(document);
+  };
+}
+function authioBackchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    readLogoutToken(request).then(async (logoutToken) => {
+      if (!logoutToken) {
+        response.status(400).json({ error: "invalid_request", error_description: "The request carries no logout_token." });
+        return;
+      }
+      let logout;
+      try {
+        logout = await options.client.validateLogoutToken(logoutToken);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof client.AuthioTokenValidationError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).end();
+    }).catch(next);
+  };
+}
+function authioFrontchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    Promise.resolve().then(async () => {
+      let logout;
+      try {
+        logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, "http://localhost").searchParams);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof client.AuthioCallbackError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).type("text/html; charset=utf-8").send('<!doctype html><html><head><meta charset="utf-8"><title>Authio</title></head><body></body></html>');
+    }).catch(next);
+  };
+}
 function sendAuthioError(response, error, options = {}) {
   const challenge = error.wwwAuthenticate;
   if (challenge) response.append("WWW-Authenticate", challenge);
@@ -104,22 +163,38 @@ function readRawBody(request, maxBodySize) {
     request.on("error", reject);
   });
 }
+async function readLogoutToken(request) {
+  const parsed = request.body;
+  if (parsed && typeof parsed === "object" && !Buffer.isBuffer(parsed) && typeof parsed.logout_token === "string")
+    return parsed.logout_token;
+  const raw = Buffer.isBuffer(parsed) ? new Uint8Array(parsed) : typeof parsed === "string" ? new TextEncoder().encode(parsed) : request.readableEnded ? void 0 : await readRawBody(request, 64 * 1024);
+  return raw ? new URLSearchParams(new TextDecoder().decode(raw)).get("logout_token") ?? void 0 : void 0;
+}
+function requireResource(verifier) {
+  if (!verifier.resource) throw new TypeError("authioProtectedResourceMetadata needs a verifier configured with resource.");
+  return verifier.resource;
+}
 function isVerifier(value) {
   return typeof value.verify === "function";
 }
 
 exports.allOf = allOf;
 exports.anyOf = anyOf;
+exports.authioBackchannelLogout = authioBackchannelLogout;
 exports.authioBearer = authioBearer;
+exports.authioFrontchannelLogout = authioFrontchannelLogout;
+exports.authioProtectedResourceMetadata = authioProtectedResourceMetadata;
 exports.authioWebhooks = authioWebhooks;
 exports.requireAuthenticationLevel = requireAuthenticationLevel;
 exports.requireAuthenticationMethod = requireAuthenticationMethod;
 exports.requireAuthio = requireAuthio;
+exports.requireCallerKind = requireCallerKind;
 exports.requireClaim = requireClaim;
 exports.requireClient = requireClient;
 exports.requireGroup = requireGroup;
 exports.requireOrganization = requireOrganization;
 exports.requirePermission = requirePermission;
+exports.requireRecentAuthentication = requireRecentAuthentication;
 exports.requireRole = requireRole;
 exports.requireScope = requireScope;
 exports.sendAuthioError = sendAuthioError;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","allOfRule","AuthioBearerError","authorize","AuthioForbiddenError","scopeRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","clientRule","anyOfRule","createAuthioWebhooks","toProblemDetails"],"mappings":";;;;;AAmEA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAC5C,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIC,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBD,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcE,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcC,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,6BAA6B,CAAC,YAAA,KAAsC,aAAA,CAAcC,iCAAA,CAAwB,YAAY,CAAC;AAE7H,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,KAC/E,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAK,CAAC;AAEjD,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBd,wBAAA,CAAA,IAAsB,EAAE,iBAAiBE,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport type { AuthioResourceAccessSource, AuthioTypedWebhookEvent, AuthioWebhookDataByType } from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`). */\nexport const requireAuthenticationLevel = (minimumLevel: number): AuthioGuard => requireAuthio(authenticationLevelRule(minimumLevel));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","AuthioCallbackError","toProblemDetails"],"mappings":";;;;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,0BAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBlB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioCallbackError,\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioFrontChannelLogout,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n  /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n   * request's cookies) when Authio sent none. Session storage is the application's.\n   */\n  onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n  /** Called when a request is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    Promise.resolve()\n      .then(async () => {\n        let logout: AuthioFrontChannelLogout;\n\n        try {\n          logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioCallbackError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { RequestHandler, Response } from 'express';
-import { AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioResourceAccessSource } from '@hyper.authio/client';
-import { AuthioUser, AuthioRule, AuthioWebhookHandler, AuthioVerifier, AuthioVerifierOptions, AuthioWebhookOptions, AuthioMatch, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+import { Request, RequestHandler, Response } from 'express';
+import { AuthioClient, AuthioLogoutToken, AuthioFrontChannelLogout, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
 export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
 
 /**
@@ -70,10 +70,16 @@ declare const requireGroup: (groups: string | readonly string[], match?: AuthioM
 declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
 /** Requires an organization context, or a given organization. */
 declare const requireOrganization: (organization?: string) => AuthioGuard;
-/** Requires a minimum authentication level (`acr`). */
-declare const requireAuthenticationLevel: (minimumLevel: number) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */
+declare const requireAuthenticationLevel: (minimumLevel: number, options?: Parameters<typeof requireAuthenticationLevel$1>[1]) => AuthioGuard;
 /** Requires authentication methods (`amr`). */
-declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch, options?: {
+    acrValues?: string;
+}) => AuthioGuard;
+/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */
+declare const requireRecentAuthentication: (maxAge: number, options?: Parameters<typeof requireRecentAuthentication$1>[1]) => AuthioGuard;
+/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */
+declare const requireCallerKind: (kinds: AuthioCallerKind | readonly AuthioCallerKind[]) => AuthioGuard;
 /** Requires the token to have been issued to one of the clients. */
 declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
 /** Requires every rule. */
@@ -93,9 +99,62 @@ interface AuthioWebhookRoute extends RequestHandler {
  * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
  */
 declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.
+ */
+type AuthioProtectedResourceMetadataRouteOptions = AuthioProtectedResourceMetadataOptions | (Omit<AuthioProtectedResourceMetadataOptions, "resource" | "issuer" | "authority" | "realm"> & {
+    verifier: AuthioVerifier;
+});
+/**
+ * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the
+ * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.
+ */
+declare function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler;
+/**
+ * Options of `authioBackchannelLogout`.
+ */
+interface AuthioBackchannelLogoutOptions {
+    /** The client the logout tokens are addressed to (its id is their audience). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is
+     * the application's.
+     */
+    onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;
+    /** Called when a token is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the
+ * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`
+ * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:
+ * no-store`. Works with or without `express.urlencoded()` in front of it.
+ */
+declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Options of `authioFrontchannelLogout`.
+ */
+interface AuthioFrontchannelLogoutOptions {
+    /** The client Authio ends the sessions of (its issuer is checked against `iss`). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the
+     * request's cookies) when Authio sent none. Session storage is the application's.
+     */
+    onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;
+    /** Called when a request is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when
+ * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`
+ * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always
+ * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.
+ */
+declare function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler;
 /**
  * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
  */
 declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
 
-export { type AuthioBearerOptions, type AuthioGuard, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioFrontchannelLogoutOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { RequestHandler, Response } from 'express';
-import { AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioResourceAccessSource } from '@hyper.authio/client';
-import { AuthioUser, AuthioRule, AuthioWebhookHandler, AuthioVerifier, AuthioVerifierOptions, AuthioWebhookOptions, AuthioMatch, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+import { Request, RequestHandler, Response } from 'express';
+import { AuthioClient, AuthioLogoutToken, AuthioFrontChannelLogout, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
 export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
 
 /**
@@ -70,10 +70,16 @@ declare const requireGroup: (groups: string | readonly string[], match?: AuthioM
 declare const requireClaim: (type: string, ...values: string[]) => AuthioGuard;
 /** Requires an organization context, or a given organization. */
 declare const requireOrganization: (organization?: string) => AuthioGuard;
-/** Requires a minimum authentication level (`acr`). */
-declare const requireAuthenticationLevel: (minimumLevel: number) => AuthioGuard;
+/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */
+declare const requireAuthenticationLevel: (minimumLevel: number, options?: Parameters<typeof requireAuthenticationLevel$1>[1]) => AuthioGuard;
 /** Requires authentication methods (`amr`). */
-declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch) => AuthioGuard;
+declare const requireAuthenticationMethod: (methods: string | readonly string[], match?: AuthioMatch, options?: {
+    acrValues?: string;
+}) => AuthioGuard;
+/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */
+declare const requireRecentAuthentication: (maxAge: number, options?: Parameters<typeof requireRecentAuthentication$1>[1]) => AuthioGuard;
+/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */
+declare const requireCallerKind: (kinds: AuthioCallerKind | readonly AuthioCallerKind[]) => AuthioGuard;
 /** Requires the token to have been issued to one of the clients. */
 declare const requireClient: (clientIds: string | readonly string[]) => AuthioGuard;
 /** Requires every rule. */
@@ -93,9 +99,62 @@ interface AuthioWebhookRoute extends RequestHandler {
  * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.
  */
 declare function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute;
+/**
+ * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.
+ */
+type AuthioProtectedResourceMetadataRouteOptions = AuthioProtectedResourceMetadataOptions | (Omit<AuthioProtectedResourceMetadataOptions, "resource" | "issuer" | "authority" | "realm"> & {
+    verifier: AuthioVerifier;
+});
+/**
+ * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the
+ * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.
+ */
+declare function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler;
+/**
+ * Options of `authioBackchannelLogout`.
+ */
+interface AuthioBackchannelLogoutOptions {
+    /** The client the logout tokens are addressed to (its id is their audience). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is
+     * the application's.
+     */
+    onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;
+    /** Called when a token is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the
+ * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`
+ * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:
+ * no-store`. Works with or without `express.urlencoded()` in front of it.
+ */
+declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Options of `authioFrontchannelLogout`.
+ */
+interface AuthioFrontchannelLogoutOptions {
+    /** The client Authio ends the sessions of (its issuer is checked against `iss`). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the
+     * request's cookies) when Authio sent none. Session storage is the application's.
+     */
+    onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;
+    /** Called when a request is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when
+ * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`
+ * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always
+ * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.
+ */
+declare function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler;
 /**
  * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
  */
 declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
 
-export { type AuthioBearerOptions, type AuthioGuard, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioFrontchannelLogoutOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.js

@@ -1,4 +1,5 @@
-import { createAuthioVerifier, allOf as allOf$1, authorize, requireScope as requireScope$1, requireRole as requireRole$1, requirePermission as requirePermission$1, requireGroup as requireGroup$1, requireClaim as requireClaim$1, requireOrganization as requireOrganization$1, requireAuthenticationLevel as requireAuthenticationLevel$1, requireAuthenticationMethod as requireAuthenticationMethod$1, requireClient as requireClient$1, anyOf as anyOf$1, createAuthioWebhooks, toProblemDetails, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
+import { AuthioTokenValidationError, AuthioCallbackError } from '@hyper.authio/client';
+import { createAuthioVerifier, requireScope as requireScope$1, AuthioForbiddenError, allOf as allOf$1, authorize, requireRole as requireRole$1, requirePermission as requirePermission$1, requireGroup as requireGroup$1, requireClaim as requireClaim$1, requireOrganization as requireOrganization$1, requireAuthenticationLevel as requireAuthenticationLevel$1, requireAuthenticationMethod as requireAuthenticationMethod$1, requireRecentAuthentication as requireRecentAuthentication$1, requireCallerKind as requireCallerKind$1, requireClient as requireClient$1, anyOf as anyOf$1, createAuthioWebhooks, createProtectedResourceMetadata, protectedResourceMetadataPath, toProblemDetails, AuthioBearerError } from '@hyper.authio/server';
 
 // src/index.ts
 var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
@@ -13,6 +14,8 @@ function authioBearer(verifier, options = {}) {
     }
     resolved.verifyAuthorizationHeader(header).then((user) => {
       request.authio = { user, token: user.token };
+      const failure = resolved.requiredScopes.length > 0 ? requireScope$1(resolved.requiredScopes, "all").check(user) : void 0;
+      if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure), options);
       next();
     }).catch((error) => refuse(request, response, next, error, options));
   };
@@ -35,8 +38,10 @@ var requirePermission = (resource, method, options) => requireAuthio(requirePerm
 var requireGroup = (groups, match) => requireAuthio(requireGroup$1(groups, match));
 var requireClaim = (type, ...values) => requireAuthio(requireClaim$1(type, ...values));
 var requireOrganization = (organization) => requireAuthio(requireOrganization$1(organization));
-var requireAuthenticationLevel = (minimumLevel) => requireAuthio(requireAuthenticationLevel$1(minimumLevel));
-var requireAuthenticationMethod = (methods, match) => requireAuthio(requireAuthenticationMethod$1(methods, match));
+var requireAuthenticationLevel = (minimumLevel, options) => requireAuthio(requireAuthenticationLevel$1(minimumLevel, options));
+var requireAuthenticationMethod = (methods, match, options) => requireAuthio(requireAuthenticationMethod$1(methods, match, options));
+var requireRecentAuthentication = (maxAge, options) => requireAuthio(requireRecentAuthentication$1(maxAge, options));
+var requireCallerKind = (kinds) => requireAuthio(requireCallerKind$1(kinds));
 var requireClient = (clientIds) => requireAuthio(requireClient$1(clientIds));
 var allOf = (...rules) => requireAuthio(allOf$1(...rules));
 var anyOf = (...rules) => requireAuthio(anyOf$1(...rules));
@@ -58,6 +63,60 @@ function authioWebhooks(options) {
   });
   return route;
 }
+function authioProtectedResourceMetadata(options) {
+  const settings = "verifier" in options ? {
+    ...options,
+    resource: requireResource(options.verifier),
+    issuer: options.verifier.connection.issuer,
+    scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : void 0)
+  } : options;
+  const document = JSON.stringify(createProtectedResourceMetadata(settings));
+  const path = protectedResourceMetadataPath(settings.resource);
+  return (request, response, next) => {
+    if (request.method !== "GET" && request.method !== "HEAD" || request.path.replace(/\/+$/, "") !== path) return next();
+    response.set("Cache-Control", "public, max-age=3600").type("application/json").send(document);
+  };
+}
+function authioBackchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    readLogoutToken(request).then(async (logoutToken) => {
+      if (!logoutToken) {
+        response.status(400).json({ error: "invalid_request", error_description: "The request carries no logout_token." });
+        return;
+      }
+      let logout;
+      try {
+        logout = await options.client.validateLogoutToken(logoutToken);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof AuthioTokenValidationError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).end();
+    }).catch(next);
+  };
+}
+function authioFrontchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    Promise.resolve().then(async () => {
+      let logout;
+      try {
+        logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, "http://localhost").searchParams);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof AuthioCallbackError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).type("text/html; charset=utf-8").send('<!doctype html><html><head><meta charset="utf-8"><title>Authio</title></head><body></body></html>');
+    }).catch(next);
+  };
+}
 function sendAuthioError(response, error, options = {}) {
   const challenge = error.wwwAuthenticate;
   if (challenge) response.append("WWW-Authenticate", challenge);
@@ -102,10 +161,21 @@ function readRawBody(request, maxBodySize) {
     request.on("error", reject);
   });
 }
+async function readLogoutToken(request) {
+  const parsed = request.body;
+  if (parsed && typeof parsed === "object" && !Buffer.isBuffer(parsed) && typeof parsed.logout_token === "string")
+    return parsed.logout_token;
+  const raw = Buffer.isBuffer(parsed) ? new Uint8Array(parsed) : typeof parsed === "string" ? new TextEncoder().encode(parsed) : request.readableEnded ? void 0 : await readRawBody(request, 64 * 1024);
+  return raw ? new URLSearchParams(new TextDecoder().decode(raw)).get("logout_token") ?? void 0 : void 0;
+}
+function requireResource(verifier) {
+  if (!verifier.resource) throw new TypeError("authioProtectedResourceMetadata needs a verifier configured with resource.");
+  return verifier.resource;
+}
 function isVerifier(value) {
   return typeof value.verify === "function";
 }
 
-export { allOf, anyOf, authioBearer, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRole, requireScope, sendAuthioError };
+export { allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["allOfRule","scopeRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","clientRule","anyOfRule"],"mappings":";;;AAmEA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAC5C,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKA,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcC,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,6BAA6B,CAAC,YAAA,KAAsC,aAAA,CAAcC,4BAAA,CAAwB,YAAY,CAAC;AAE7H,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,KAC/E,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAK,CAAC;AAEjD,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcT,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcU,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport type { AuthioResourceAccessSource, AuthioTypedWebhookEvent, AuthioWebhookDataByType } from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`). */\nexport const requireAuthenticationLevel = (minimumLevel: number): AuthioGuard => requireAuthio(authenticationLevelRule(minimumLevel));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,mBAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioCallbackError,\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioFrontChannelLogout,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n  /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n   * request's cookies) when Authio sent none. Session storage is the application's.\n   */\n  onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n  /** Called when a request is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    Promise.resolve()\n      .then(async () => {\n        let logout: AuthioFrontChannelLogout;\n\n        try {\n          logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioCallbackError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyper.authio/express",
-  "version": "0.1.1",
+  "version": "0.8.0",
   "description": "Express middleware for Authio: bearer validation, scope/role/permission/group/claim/organization/acr/amr/client guards, and signed webhook routes.",
   "license": "MIT",
   "type": "module",
@@ -32,8 +32,8 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@hyper.authio/client": "0.1.1",
-    "@hyper.authio/server": "0.1.1"
+    "@hyper.authio/client": "0.8.0",
+    "@hyper.authio/server": "0.8.0"
   },
   "keywords": [
     "authio",