@hyper.authio/express 0.7.0 → 0.8.0

package/README.md

@@ -85,6 +85,23 @@ Register the URL as the client's back-channel logout URI in Authio. The handler
 `express.urlencoded()`), validates it with `client.validateLogoutToken`, answers `200`, `400` (`invalid_request`) for
 a token that does not validate, and always sends `Cache-Control: no-store`.
 
+## Front-channel logout
+
+```ts
+app.get(
+  "/auth/frontchannel-logout",
+  authioFrontchannelLogout({
+    client,
+    onLogout: async ({ sessionId }, request) => (sessionId ? sessions.destroyWhere({ sessionId }) : sessions.destroy(request)),
+  }),
+);
+```
+
+Register the URL as the client's front-channel logout URI in Authio, with the session required so Authio sends `iss`
+and `sid`. Authio loads it in an iframe when a session ends; the handler checks `iss` with
+`client.validateFrontChannelLogout`, answers `200` with an empty page, `400` (`invalid_request`) for another issuer or a
+`sid` without `iss`, and always sends `Cache-Control: no-store`.
+
 ## License
 
 MIT

package/dist/index.cjs

@@ -101,6 +101,24 @@ function authioBackchannelLogout(options) {
     }).catch(next);
   };
 }
+function authioFrontchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    Promise.resolve().then(async () => {
+      let logout;
+      try {
+        logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, "http://localhost").searchParams);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof client.AuthioCallbackError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).type("text/html; charset=utf-8").send('<!doctype html><html><head><meta charset="utf-8"><title>Authio</title></head><body></body></html>');
+    }).catch(next);
+  };
+}
 function sendAuthioError(response, error, options = {}) {
   const challenge = error.wwwAuthenticate;
   if (challenge) response.append("WWW-Authenticate", challenge);
@@ -164,6 +182,7 @@ exports.allOf = allOf;
 exports.anyOf = anyOf;
 exports.authioBackchannelLogout = authioBackchannelLogout;
 exports.authioBearer = authioBearer;
+exports.authioFrontchannelLogout = authioFrontchannelLogout;
 exports.authioProtectedResourceMetadata = authioProtectedResourceMetadata;
 exports.authioWebhooks = authioWebhooks;
 exports.requireAuthenticationLevel = requireAuthenticationLevel;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","toProblemDetails"],"mappings":";;;;;;AAiFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBjB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","AuthioCallbackError","toProblemDetails"],"mappings":";;;;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,0BAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBlB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioCallbackError,\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioFrontChannelLogout,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n  /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n   * request's cookies) when Authio sent none. Session storage is the application's.\n   */\n  onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n  /** Called when a request is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    Promise.resolve()\n      .then(async () => {\n        let logout: AuthioFrontChannelLogout;\n\n        try {\n          logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioCallbackError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { Request, RequestHandler, Response } from 'express';
-import { AuthioClient, AuthioLogoutToken, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioClient, AuthioLogoutToken, AuthioFrontChannelLogout, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
 import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
 export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
 
@@ -131,9 +131,30 @@ interface AuthioBackchannelLogoutOptions {
  * no-store`. Works with or without `express.urlencoded()` in front of it.
  */
 declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Options of `authioFrontchannelLogout`.
+ */
+interface AuthioFrontchannelLogoutOptions {
+    /** The client Authio ends the sessions of (its issuer is checked against `iss`). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the
+     * request's cookies) when Authio sent none. Session storage is the application's.
+     */
+    onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;
+    /** Called when a request is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when
+ * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`
+ * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always
+ * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.
+ */
+declare function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler;
 /**
  * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
  */
 declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
 
-export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioFrontchannelLogoutOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Request, RequestHandler, Response } from 'express';
-import { AuthioClient, AuthioLogoutToken, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
+import { AuthioClient, AuthioLogoutToken, AuthioFrontChannelLogout, AuthioWebhookDataByType, AuthioTypedWebhookEvent, AuthioCallerKind, AuthioResourceAccessSource } from '@hyper.authio/client';
 import { AuthioUser, AuthioRule, AuthioProtectedResourceMetadataOptions, AuthioVerifier, AuthioWebhookHandler, AuthioVerifierOptions, AuthioWebhookOptions, requireAuthenticationLevel as requireAuthenticationLevel$1, AuthioMatch, requireRecentAuthentication as requireRecentAuthentication$1, AuthioBearerError, AuthioForbiddenError } from '@hyper.authio/server';
 export { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from '@hyper.authio/server';
 
@@ -131,9 +131,30 @@ interface AuthioBackchannelLogoutOptions {
  * no-store`. Works with or without `express.urlencoded()` in front of it.
  */
 declare function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler;
+/**
+ * Options of `authioFrontchannelLogout`.
+ */
+interface AuthioFrontchannelLogoutOptions {
+    /** The client Authio ends the sessions of (its issuer is checked against `iss`). */
+    client: AuthioClient;
+    /**
+     * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the
+     * request's cookies) when Authio sent none. Session storage is the application's.
+     */
+    onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;
+    /** Called when a request is refused. */
+    onError?: (error: unknown) => void;
+}
+/**
+ * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when
+ * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`
+ * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always
+ * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.
+ */
+declare function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler;
 /**
  * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.
  */
 declare function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options?: AuthioResponseOptions): void;
 
-export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
+export { type AuthioBackchannelLogoutOptions, type AuthioBearerOptions, type AuthioFrontchannelLogoutOptions, type AuthioGuard, type AuthioProtectedResourceMetadataRouteOptions, type AuthioRequestContext, type AuthioResponseOptions, type AuthioWebhookRoute, allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { AuthioTokenValidationError } from '@hyper.authio/client';
+import { AuthioTokenValidationError, AuthioCallbackError } from '@hyper.authio/client';
 import { createAuthioVerifier, requireScope as requireScope$1, AuthioForbiddenError, allOf as allOf$1, authorize, requireRole as requireRole$1, requirePermission as requirePermission$1, requireGroup as requireGroup$1, requireClaim as requireClaim$1, requireOrganization as requireOrganization$1, requireAuthenticationLevel as requireAuthenticationLevel$1, requireAuthenticationMethod as requireAuthenticationMethod$1, requireRecentAuthentication as requireRecentAuthentication$1, requireCallerKind as requireCallerKind$1, requireClient as requireClient$1, anyOf as anyOf$1, createAuthioWebhooks, createProtectedResourceMetadata, protectedResourceMetadataPath, toProblemDetails, AuthioBearerError } from '@hyper.authio/server';
 
 // src/index.ts
@@ -99,6 +99,24 @@ function authioBackchannelLogout(options) {
     }).catch(next);
   };
 }
+function authioFrontchannelLogout(options) {
+  return (request, response, next) => {
+    response.set("Cache-Control", "no-store");
+    Promise.resolve().then(async () => {
+      let logout;
+      try {
+        logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, "http://localhost").searchParams);
+      } catch (error) {
+        options.onError?.(error);
+        if (!(error instanceof AuthioCallbackError)) throw error;
+        response.status(400).json({ error: "invalid_request", error_description: error.message });
+        return;
+      }
+      await options.onLogout(logout, request);
+      response.status(200).type("text/html; charset=utf-8").send('<!doctype html><html><head><meta charset="utf-8"><title>Authio</title></head><body></body></html>');
+    }).catch(next);
+  };
+}
 function sendAuthioError(response, error, options = {}) {
   const challenge = error.wwwAuthenticate;
   if (challenge) response.append("WWW-Authenticate", challenge);
@@ -158,6 +176,6 @@ function isVerifier(value) {
   return typeof value.verify === "function";
 }
 
-export { allOf, anyOf, authioBackchannelLogout, authioBearer, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
+export { allOf, anyOf, authioBackchannelLogout, authioBearer, authioFrontchannelLogout, authioProtectedResourceMetadata, authioWebhooks, requireAuthenticationLevel, requireAuthenticationMethod, requireAuthio, requireCallerKind, requireClaim, requireClient, requireGroup, requireOrganization, requirePermission, requireRecentAuthentication, requireRole, requireScope, sendAuthioError };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAiFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,mBAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n  AuthioCallbackError,\n  AuthioTokenValidationError,\n  type AuthioCallerKind,\n  type AuthioClient,\n  type AuthioFrontChannelLogout,\n  type AuthioLogoutToken,\n  type AuthioResourceAccessSource,\n  type AuthioTypedWebhookEvent,\n  type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n  allOf as allOfRule,\n  anyOf as anyOfRule,\n  authorize,\n  AuthioBearerError,\n  AuthioForbiddenError,\n  createAuthioVerifier,\n  createAuthioWebhooks,\n  createProtectedResourceMetadata,\n  protectedResourceMetadataPath,\n  requireAuthenticationLevel as authenticationLevelRule,\n  requireAuthenticationMethod as authenticationMethodRule,\n  requireCallerKind as callerKindRule,\n  requireClaim as claimRule,\n  requireClient as clientRule,\n  requireGroup as groupRule,\n  requireOrganization as organizationRule,\n  requirePermission as permissionRule,\n  requireRecentAuthentication as recentAuthenticationRule,\n  requireRole as roleRule,\n  requireScope as scopeRule,\n  toProblemDetails,\n  type AuthioProtectedResourceMetadataOptions,\n  type AuthioMatch,\n  type AuthioRule,\n  type AuthioRuleFailure,\n  type AuthioUser,\n  type AuthioVerifier,\n  type AuthioVerifierOptions,\n  type AuthioWebhookHandler,\n  type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n  /** The caller. */\n  readonly user: AuthioUser;\n  /** The access token the caller was read from. */\n  readonly token: string;\n}\n\ndeclare global {\n  // eslint-disable-next-line @typescript-eslint/no-namespace\n  namespace Express {\n    interface Request {\n      /** The Authio caller, once `authioBearer` validated the token. */\n      authio?: AuthioRequestContext;\n    }\n  }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n  /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n  problemDetails?: boolean;\n  /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n  passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n  /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n  optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n  return (request, response, next) => {\n    (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n    const header = request.headers.authorization;\n\n    if (options.optional && !header) {\n      next();\n      return;\n    }\n\n    resolved\n      .verifyAuthorizationHeader(header)\n      .then((user) => {\n        request.authio = { user, token: user.token! };\n\n        const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n        if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n        next();\n      })\n      .catch((error: unknown) => refuse(request, response, next, error, options));\n  };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n  if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n  const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n  const guard: RequestHandler = (request, response, next) => {\n    const user = request.authio?.user;\n\n    if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n    const failure = authorize(user, ...rules);\n\n    if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n    next();\n  };\n\n  return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n  roles: string | readonly string[],\n  options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n  requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n  requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n  requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n  requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n  on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n  on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n  const webhooks = createAuthioWebhooks(options);\n\n  const route = ((request: Request, response: Response, next: NextFunction) => {\n    readRawBody(request, webhooks.maxBodySize)\n      .then(async (body) => {\n        if (body === undefined) {\n          response.status(413).end();\n          return;\n        }\n\n        const outcome = await webhooks.handle({ body, headers: request.headers });\n\n        response.status(outcome.status).end();\n      })\n      .catch(next);\n  }) as AuthioWebhookRoute;\n\n  route.on = ((type: string, handler: AuthioWebhookHandler) => {\n    webhooks.on(type, handler);\n    return route;\n  }) as AuthioWebhookRoute[\"on\"];\n\n  return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n  | AuthioProtectedResourceMetadataOptions\n  | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n  const settings: AuthioProtectedResourceMetadataOptions =\n    \"verifier\" in options\n      ? {\n          ...options,\n          resource: requireResource(options.verifier),\n          issuer: options.verifier.connection.issuer,\n          scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n        }\n      : options;\n  const document = JSON.stringify(createProtectedResourceMetadata(settings));\n  const path = protectedResourceMetadataPath(settings.resource);\n\n  return (request, response, next) => {\n    if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n    response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n  };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n  /** The client the logout tokens are addressed to (its id is their audience). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n   * the application's.\n   */\n  onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n  /** Called when a token is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    readLogoutToken(request)\n      .then(async (logoutToken) => {\n        if (!logoutToken) {\n          response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n          return;\n        }\n\n        let logout: AuthioLogoutToken;\n\n        try {\n          logout = await options.client.validateLogoutToken(logoutToken);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioTokenValidationError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).end();\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n  /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n  client: AuthioClient;\n  /**\n   * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n   * request's cookies) when Authio sent none. Session storage is the application's.\n   */\n  onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n  /** Called when a request is refused. */\n  onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n  return (request, response, next) => {\n    response.set(\"Cache-Control\", \"no-store\");\n\n    Promise.resolve()\n      .then(async () => {\n        let logout: AuthioFrontChannelLogout;\n\n        try {\n          logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n        } catch (error) {\n          options.onError?.(error);\n          if (!(error instanceof AuthioCallbackError)) throw error;\n          response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n          return;\n        }\n\n        await options.onLogout(logout, request);\n        response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n      })\n      .catch(next);\n  };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n  const challenge = error.wwwAuthenticate;\n\n  if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n  response.status(error.status);\n\n  if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n  else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n  const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n  if (settings.passErrors) return next(error);\n\n  sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n  if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n  if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n    return Promise.reject(\n      new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n    );\n\n  const declared = Number(request.headers[\"content-length\"]);\n\n  if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    let done = false;\n\n    request.on(\"data\", (chunk: Buffer) => {\n      if (done) return;\n\n      size += chunk.byteLength;\n\n      if (size > maxBodySize) {\n        done = true;\n        request.pause();\n        resolve(undefined);\n        return;\n      }\n\n      chunks.push(chunk);\n    });\n    request.on(\"end\", () => {\n      if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n    });\n    request.on(\"error\", reject);\n  });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n  const parsed = (request as Request & { body?: unknown }).body;\n\n  if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n    return (parsed as Record<string, string>).logout_token;\n\n  const raw = Buffer.isBuffer(parsed)\n    ? new Uint8Array(parsed)\n    : typeof parsed === \"string\"\n      ? new TextEncoder().encode(parsed)\n      : request.readableEnded\n        ? undefined\n        : await readRawBody(request, 64 * 1024);\n\n  return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n  if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n  return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n  return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyper.authio/express",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Express middleware for Authio: bearer validation, scope/role/permission/group/claim/organization/acr/amr/client guards, and signed webhook routes.",
   "license": "MIT",
   "type": "module",
@@ -32,8 +32,8 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@hyper.authio/client": "0.7.0",
-    "@hyper.authio/server": "0.7.0"
+    "@hyper.authio/client": "0.8.0",
+    "@hyper.authio/server": "0.8.0"
   },
   "keywords": [
     "authio",