@hyper.authio/express 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +3 -2
  2. package/dist/index.cjs +12 -7
  3. package/dist/index.cjs.map +1 -1
  4. package/dist/index.d.cts +3 -2
  5. package/dist/index.d.ts +3 -2
  6. package/dist/index.js +12 -7
  7. package/dist/index.js.map +1 -1
  8. package/package.json +3 -3
package/README.md CHANGED
@@ -48,8 +48,9 @@ app.post("/api/payouts", requireAuthio(requirePermission("payouts", "create"), a
48
48
  token goes through unauthenticated.
49
49
  - `requireScope`, `requireRole`, `requirePermission`, `requireGroup`, `requireClaim`, `requireOrganization`,
50
50
  `requireAuthenticationLevel`, `requireAuthenticationMethod`, `requireRecentAuthentication`, `requireCallerKind` and
51
- `requireClient` answer `403`, with `insufficient_scope` or `insufficient_user_authentication` (with `acr_values` and
52
- `max_age`, RFC 9470) in `WWW-Authenticate` when that is the reason.
51
+ `requireClient` answer `403`, with `insufficient_scope` in `WWW-Authenticate` when a scope is missing. A refusal that
52
+ asks for a stronger or more recent sign-in answers `401` with `insufficient_user_authentication` (with `acr_values`
53
+ and `max_age`), as RFC 9470 §3 has it.
53
54
  - With `requiredScopes` on the verifier, `authioBearer` itself answers `403 insufficient_scope` when a token lacks one.
54
55
  - Every guard is also a rule: `requireAuthio(...)`, `allOf(...)` and `anyOf(...)` combine guards of this package and
55
56
  rules of `@hyper.authio/server` alike, and are guards themselves.
package/dist/index.cjs CHANGED
@@ -8,7 +8,11 @@ var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
8
8
  function authioBearer(verifier, options = {}) {
9
9
  const resolved = isVerifier(verifier) ? verifier : server.createAuthioVerifier(verifier);
10
10
  return (request, response, next) => {
11
- request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
11
+ request[responseSettings] = {
12
+ problemDetails: options.problemDetails,
13
+ passErrors: options.passErrors,
14
+ resourceMetadata: resolved.resourceMetadataUrl
15
+ };
12
16
  const header = request.headers.authorization;
13
17
  if (options.optional && !header) {
14
18
  next();
@@ -17,9 +21,9 @@ function authioBearer(verifier, options = {}) {
17
21
  resolved.verifyAuthorizationHeader(header).then((user) => {
18
22
  request.authio = { user, token: user.token };
19
23
  const failure = resolved.requiredScopes.length > 0 ? server.requireScope(resolved.requiredScopes, "all").check(user) : void 0;
20
- if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure), options);
24
+ if (failure) return refuse(request, response, next, new server.AuthioForbiddenError(failure));
21
25
  next();
22
- }).catch((error) => refuse(request, response, next, error, options));
26
+ }).catch((error) => refuse(request, response, next, error));
23
27
  };
24
28
  }
25
29
  function requireAuthio(...rules) {
@@ -126,11 +130,12 @@ function sendAuthioError(response, error, options = {}) {
126
130
  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(server.toProblemDetails(error)));
127
131
  else response.end();
128
132
  }
129
- function refuse(request, response, next, error, options) {
130
- const settings = options ?? request[responseSettings] ?? {};
133
+ function refuse(request, response, next, error) {
134
+ const settings = request[responseSettings] ?? {};
131
135
  if (!(error instanceof server.AuthioBearerError) && !(error instanceof server.AuthioForbiddenError)) return next(error);
132
- if (settings.passErrors) return next(error);
133
- sendAuthioError(response, error, settings);
136
+ const refusal = error instanceof server.AuthioForbiddenError ? error.withResourceMetadata(settings.resourceMetadata) : error;
137
+ if (settings.passErrors) return next(refusal);
138
+ sendAuthioError(response, refusal, settings);
134
139
  }
135
140
  function readRawBody(request, maxBodySize) {
136
141
  const parsed = request.body;
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","AuthioCallbackError","toProblemDetails"],"mappings":";;;;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,0BAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiBlB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n AuthioCallbackError,\n AuthioTokenValidationError,\n type AuthioCallerKind,\n type AuthioClient,\n type AuthioFrontChannelLogout,\n type AuthioLogoutToken,\n type AuthioResourceAccessSource,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n allOf as allOfRule,\n anyOf as anyOfRule,\n authorize,\n AuthioBearerError,\n AuthioForbiddenError,\n createAuthioVerifier,\n createAuthioWebhooks,\n createProtectedResourceMetadata,\n protectedResourceMetadataPath,\n requireAuthenticationLevel as authenticationLevelRule,\n requireAuthenticationMethod as authenticationMethodRule,\n requireCallerKind as callerKindRule,\n requireClaim as claimRule,\n requireClient as clientRule,\n requireGroup as groupRule,\n requireOrganization as organizationRule,\n requirePermission as permissionRule,\n requireRecentAuthentication as recentAuthenticationRule,\n requireRole as roleRule,\n requireScope as scopeRule,\n toProblemDetails,\n type AuthioProtectedResourceMetadataOptions,\n type AuthioMatch,\n type AuthioRule,\n type AuthioRuleFailure,\n type AuthioUser,\n type AuthioVerifier,\n type AuthioVerifierOptions,\n type AuthioWebhookHandler,\n type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n /** The caller. */\n readonly user: AuthioUser;\n /** The access token the caller was read from. */\n readonly token: string;\n}\n\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n /** The Authio caller, once `authioBearer` validated the token. */\n authio?: AuthioRequestContext;\n }\n }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n problemDetails?: boolean;\n /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n return (request, response, next) => {\n (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n const header = request.headers.authorization;\n\n if (options.optional && !header) {\n next();\n return;\n }\n\n resolved\n .verifyAuthorizationHeader(header)\n .then((user) => {\n request.authio = { user, token: user.token! };\n\n const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n next();\n })\n .catch((error: unknown) => refuse(request, response, next, error, options));\n };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n const guard: RequestHandler = (request, response, next) => {\n const user = request.authio?.user;\n\n if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n const failure = authorize(user, ...rules);\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n next();\n };\n\n return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n roles: string | readonly string[],\n options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n const webhooks = createAuthioWebhooks(options);\n\n const route = ((request: Request, response: Response, next: NextFunction) => {\n readRawBody(request, webhooks.maxBodySize)\n .then(async (body) => {\n if (body === undefined) {\n response.status(413).end();\n return;\n }\n\n const outcome = await webhooks.handle({ body, headers: request.headers });\n\n response.status(outcome.status).end();\n })\n .catch(next);\n }) as AuthioWebhookRoute;\n\n route.on = ((type: string, handler: AuthioWebhookHandler) => {\n webhooks.on(type, handler);\n return route;\n }) as AuthioWebhookRoute[\"on\"];\n\n return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n | AuthioProtectedResourceMetadataOptions\n | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n const settings: AuthioProtectedResourceMetadataOptions =\n \"verifier\" in options\n ? {\n ...options,\n resource: requireResource(options.verifier),\n issuer: options.verifier.connection.issuer,\n scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n }\n : options;\n const document = JSON.stringify(createProtectedResourceMetadata(settings));\n const path = protectedResourceMetadataPath(settings.resource);\n\n return (request, response, next) => {\n if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n /** The client the logout tokens are addressed to (its id is their audience). */\n client: AuthioClient;\n /**\n * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n * the application's.\n */\n onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n /** Called when a token is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n readLogoutToken(request)\n .then(async (logoutToken) => {\n if (!logoutToken) {\n response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n return;\n }\n\n let logout: AuthioLogoutToken;\n\n try {\n logout = await options.client.validateLogoutToken(logoutToken);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioTokenValidationError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).end();\n })\n .catch(next);\n };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n client: AuthioClient;\n /**\n * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n * request's cookies) when Authio sent none. Session storage is the application's.\n */\n onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n /** Called when a request is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n Promise.resolve()\n .then(async () => {\n let logout: AuthioFrontChannelLogout;\n\n try {\n logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioCallbackError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n })\n .catch(next);\n };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n const challenge = error.wwwAuthenticate;\n\n if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n response.status(error.status);\n\n if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n if (settings.passErrors) return next(error);\n\n sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n return Promise.reject(\n new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n );\n\n const declared = Number(request.headers[\"content-length\"]);\n\n if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n let size = 0;\n let done = false;\n\n request.on(\"data\", (chunk: Buffer) => {\n if (done) return;\n\n size += chunk.byteLength;\n\n if (size > maxBodySize) {\n done = true;\n request.pause();\n resolve(undefined);\n return;\n }\n\n chunks.push(chunk);\n });\n request.on(\"end\", () => {\n if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n });\n request.on(\"error\", reject);\n });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n return (parsed as Record<string, string>).logout_token;\n\n const raw = Buffer.isBuffer(parsed)\n ? new Uint8Array(parsed)\n : typeof parsed === \"string\"\n ? new TextEncoder().encode(parsed)\n : request.readableEnded\n ? undefined\n : await readRawBody(request, 64 * 1024);\n\n return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
1
+ {"version":3,"sources":["../src/index.ts"],"names":["createAuthioVerifier","scopeRule","AuthioForbiddenError","allOfRule","AuthioBearerError","authorize","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule","createAuthioWebhooks","createProtectedResourceMetadata","protectedResourceMetadataPath","AuthioTokenValidationError","AuthioCallbackError","toProblemDetails"],"mappings":";;;;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAWA,4BAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI;AAAA,MACnD,gBAAgB,OAAA,CAAQ,cAAA;AAAA,MACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,kBAAkB,QAAA,CAAS;AAAA,KAC7B;AAEA,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIC,mBAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIC,2BAAA,CAAqB,OAA4B,CAAC,CAAA;AAE1G,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,OAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACrE,CAAA;AACF;AAaO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,YAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAIC,wBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAUC,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAIH,2BAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqBG,gBAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcJ,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcK,kBAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,wBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,mBAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,mBAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,0BAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,iCAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,kCAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,kCAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,wBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,oBAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcZ,YAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAca,YAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAWC,4BAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAUC,sCAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAOC,oCAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,iCAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiBC,0BAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAUC,uBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,KAAA,EAAsB;AAC9F,EAAA,MAAM,QAAA,GAAY,OAAA,CAAgC,gBAAgB,CAAA,IAAK,EAAC;AAExE,EAAA,IAAI,EAAE,iBAAiBlB,wBAAA,CAAA,IAAsB,EAAE,iBAAiBF,2BAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AAExG,EAAA,MAAM,UAAU,KAAA,YAAiBA,2BAAA,GAAuB,MAAM,oBAAA,CAAqB,QAAA,CAAS,gBAAgB,CAAA,GAAI,KAAA;AAEhH,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,OAAO,CAAA;AAE5C,EAAA,eAAA,CAAgB,QAAA,EAAU,SAAS,QAAQ,CAAA;AAC7C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.cjs","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n AuthioCallbackError,\n AuthioTokenValidationError,\n type AuthioCallerKind,\n type AuthioClient,\n type AuthioFrontChannelLogout,\n type AuthioLogoutToken,\n type AuthioResourceAccessSource,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n allOf as allOfRule,\n anyOf as anyOfRule,\n authorize,\n AuthioBearerError,\n AuthioForbiddenError,\n createAuthioVerifier,\n createAuthioWebhooks,\n createProtectedResourceMetadata,\n protectedResourceMetadataPath,\n requireAuthenticationLevel as authenticationLevelRule,\n requireAuthenticationMethod as authenticationMethodRule,\n requireCallerKind as callerKindRule,\n requireClaim as claimRule,\n requireClient as clientRule,\n requireGroup as groupRule,\n requireOrganization as organizationRule,\n requirePermission as permissionRule,\n requireRecentAuthentication as recentAuthenticationRule,\n requireRole as roleRule,\n requireScope as scopeRule,\n toProblemDetails,\n type AuthioProtectedResourceMetadataOptions,\n type AuthioMatch,\n type AuthioRule,\n type AuthioRuleFailure,\n type AuthioUser,\n type AuthioVerifier,\n type AuthioVerifierOptions,\n type AuthioWebhookHandler,\n type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n /** The caller. */\n readonly user: AuthioUser;\n /** The access token the caller was read from. */\n readonly token: string;\n}\n\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n /** The Authio caller, once `authioBearer` validated the token. */\n authio?: AuthioRequestContext;\n }\n }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n problemDetails?: boolean;\n /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions & { resourceMetadata?: string } };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n return (request, response, next) => {\n (request as RequestWithSettings)[responseSettings] = {\n problemDetails: options.problemDetails,\n passErrors: options.passErrors,\n resourceMetadata: resolved.resourceMetadataUrl,\n };\n\n const header = request.headers.authorization;\n\n if (options.optional && !header) {\n next();\n return;\n }\n\n resolved\n .verifyAuthorizationHeader(header)\n .then((user) => {\n request.authio = { user, token: user.token! };\n\n const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure));\n\n next();\n })\n .catch((error: unknown) => refuse(request, response, next, error));\n };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller,\n * `401` with `insufficient_user_authentication` when a rule asks for a stronger or more recent sign-in (RFC 9470 §3),\n * and `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n const guard: RequestHandler = (request, response, next) => {\n const user = request.authio?.user;\n\n if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n const failure = authorize(user, ...rules);\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n next();\n };\n\n return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n roles: string | readonly string[],\n options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n const webhooks = createAuthioWebhooks(options);\n\n const route = ((request: Request, response: Response, next: NextFunction) => {\n readRawBody(request, webhooks.maxBodySize)\n .then(async (body) => {\n if (body === undefined) {\n response.status(413).end();\n return;\n }\n\n const outcome = await webhooks.handle({ body, headers: request.headers });\n\n response.status(outcome.status).end();\n })\n .catch(next);\n }) as AuthioWebhookRoute;\n\n route.on = ((type: string, handler: AuthioWebhookHandler) => {\n webhooks.on(type, handler);\n return route;\n }) as AuthioWebhookRoute[\"on\"];\n\n return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n | AuthioProtectedResourceMetadataOptions\n | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n const settings: AuthioProtectedResourceMetadataOptions =\n \"verifier\" in options\n ? {\n ...options,\n resource: requireResource(options.verifier),\n issuer: options.verifier.connection.issuer,\n scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n }\n : options;\n const document = JSON.stringify(createProtectedResourceMetadata(settings));\n const path = protectedResourceMetadataPath(settings.resource);\n\n return (request, response, next) => {\n if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n /** The client the logout tokens are addressed to (its id is their audience). */\n client: AuthioClient;\n /**\n * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n * the application's.\n */\n onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n /** Called when a token is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n readLogoutToken(request)\n .then(async (logoutToken) => {\n if (!logoutToken) {\n response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n return;\n }\n\n let logout: AuthioLogoutToken;\n\n try {\n logout = await options.client.validateLogoutToken(logoutToken);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioTokenValidationError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).end();\n })\n .catch(next);\n };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n client: AuthioClient;\n /**\n * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n * request's cookies) when Authio sent none. Session storage is the application's.\n */\n onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n /** Called when a request is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n Promise.resolve()\n .then(async () => {\n let logout: AuthioFrontChannelLogout;\n\n try {\n logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioCallbackError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n })\n .catch(next);\n };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n const challenge = error.wwwAuthenticate;\n\n if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n response.status(error.status);\n\n if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown): void {\n const settings = (request as RequestWithSettings)[responseSettings] ?? {};\n\n if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n\n const refusal = error instanceof AuthioForbiddenError ? error.withResourceMetadata(settings.resourceMetadata) : error;\n\n if (settings.passErrors) return next(refusal);\n\n sendAuthioError(response, refusal, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n return Promise.reject(\n new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n );\n\n const declared = Number(request.headers[\"content-length\"]);\n\n if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n let size = 0;\n let done = false;\n\n request.on(\"data\", (chunk: Buffer) => {\n if (done) return;\n\n size += chunk.byteLength;\n\n if (size > maxBodySize) {\n done = true;\n request.pause();\n resolve(undefined);\n return;\n }\n\n chunks.push(chunk);\n });\n request.on(\"end\", () => {\n if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n });\n request.on(\"error\", reject);\n });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n return (parsed as Record<string, string>).logout_token;\n\n const raw = Buffer.isBuffer(parsed)\n ? new Uint8Array(parsed)\n : typeof parsed === \"string\"\n ? new TextEncoder().encode(parsed)\n : request.readableEnded\n ? undefined\n : await readRawBody(request, 64 * 1024);\n\n return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
package/dist/index.d.cts CHANGED
@@ -49,8 +49,9 @@ declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions,
49
49
  */
50
50
  type AuthioGuard = RequestHandler & AuthioRule;
51
51
  /**
52
- * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
53
- * `403` with the joined refusal otherwise.
52
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller,
53
+ * `401` with `insufficient_user_authentication` when a rule asks for a stronger or more recent sign-in (RFC 9470 §3),
54
+ * and `403` with the joined refusal otherwise.
54
55
  */
55
56
  declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
56
57
  /** Requires granted scopes. */
package/dist/index.d.ts CHANGED
@@ -49,8 +49,9 @@ declare function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions,
49
49
  */
50
50
  type AuthioGuard = RequestHandler & AuthioRule;
51
51
  /**
52
- * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and
53
- * `403` with the joined refusal otherwise.
52
+ * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller,
53
+ * `401` with `insufficient_user_authentication` when a rule asks for a stronger or more recent sign-in (RFC 9470 §3),
54
+ * and `403` with the joined refusal otherwise.
54
55
  */
55
56
  declare function requireAuthio(...rules: AuthioRule[]): AuthioGuard;
56
57
  /** Requires granted scopes. */
package/dist/index.js CHANGED
@@ -6,7 +6,11 @@ var responseSettings = /* @__PURE__ */ Symbol.for("authio.express.response");
6
6
  function authioBearer(verifier, options = {}) {
7
7
  const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);
8
8
  return (request, response, next) => {
9
- request[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };
9
+ request[responseSettings] = {
10
+ problemDetails: options.problemDetails,
11
+ passErrors: options.passErrors,
12
+ resourceMetadata: resolved.resourceMetadataUrl
13
+ };
10
14
  const header = request.headers.authorization;
11
15
  if (options.optional && !header) {
12
16
  next();
@@ -15,9 +19,9 @@ function authioBearer(verifier, options = {}) {
15
19
  resolved.verifyAuthorizationHeader(header).then((user) => {
16
20
  request.authio = { user, token: user.token };
17
21
  const failure = resolved.requiredScopes.length > 0 ? requireScope$1(resolved.requiredScopes, "all").check(user) : void 0;
18
- if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure), options);
22
+ if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));
19
23
  next();
20
- }).catch((error) => refuse(request, response, next, error, options));
24
+ }).catch((error) => refuse(request, response, next, error));
21
25
  };
22
26
  }
23
27
  function requireAuthio(...rules) {
@@ -124,11 +128,12 @@ function sendAuthioError(response, error, options = {}) {
124
128
  if (options.problemDetails) response.type("application/problem+json").send(JSON.stringify(toProblemDetails(error)));
125
129
  else response.end();
126
130
  }
127
- function refuse(request, response, next, error, options) {
128
- const settings = options ?? request[responseSettings] ?? {};
131
+ function refuse(request, response, next, error) {
132
+ const settings = request[responseSettings] ?? {};
129
133
  if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);
130
- if (settings.passErrors) return next(error);
131
- sendAuthioError(response, error, settings);
134
+ const refusal = error instanceof AuthioForbiddenError ? error.withResourceMetadata(settings.resourceMetadata) : error;
135
+ if (settings.passErrors) return next(refusal);
136
+ sendAuthioError(response, refusal, settings);
132
137
  }
133
138
  function readRawBody(request, maxBodySize) {
134
139
  const parsed = request.body;
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI,EAAE,gBAAgB,OAAA,CAAQ,cAAA,EAAgB,UAAA,EAAY,OAAA,CAAQ,UAAA,EAAW;AAE9H,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,EAAS,OAAO,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,MAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAA,EAAG,OAAO,CAAA;AAEnH,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC9E,CAAA;AACF;AAYO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,mBAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,OAAgB,OAAA,EAAuC;AAC/H,EAAA,MAAM,QAAA,GAAW,OAAA,IAAY,OAAA,CAAgC,gBAAgB,KAAK,EAAC;AAEnF,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AACxG,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,KAAK,CAAA;AAE1C,EAAA,eAAA,CAAgB,QAAA,EAAU,OAAO,QAAQ,CAAA;AAC3C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n AuthioCallbackError,\n AuthioTokenValidationError,\n type AuthioCallerKind,\n type AuthioClient,\n type AuthioFrontChannelLogout,\n type AuthioLogoutToken,\n type AuthioResourceAccessSource,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n allOf as allOfRule,\n anyOf as anyOfRule,\n authorize,\n AuthioBearerError,\n AuthioForbiddenError,\n createAuthioVerifier,\n createAuthioWebhooks,\n createProtectedResourceMetadata,\n protectedResourceMetadataPath,\n requireAuthenticationLevel as authenticationLevelRule,\n requireAuthenticationMethod as authenticationMethodRule,\n requireCallerKind as callerKindRule,\n requireClaim as claimRule,\n requireClient as clientRule,\n requireGroup as groupRule,\n requireOrganization as organizationRule,\n requirePermission as permissionRule,\n requireRecentAuthentication as recentAuthenticationRule,\n requireRole as roleRule,\n requireScope as scopeRule,\n toProblemDetails,\n type AuthioProtectedResourceMetadataOptions,\n type AuthioMatch,\n type AuthioRule,\n type AuthioRuleFailure,\n type AuthioUser,\n type AuthioVerifier,\n type AuthioVerifierOptions,\n type AuthioWebhookHandler,\n type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n /** The caller. */\n readonly user: AuthioUser;\n /** The access token the caller was read from. */\n readonly token: string;\n}\n\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n /** The Authio caller, once `authioBearer` validated the token. */\n authio?: AuthioRequestContext;\n }\n }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n problemDetails?: boolean;\n /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n return (request, response, next) => {\n (request as RequestWithSettings)[responseSettings] = { problemDetails: options.problemDetails, passErrors: options.passErrors };\n\n const header = request.headers.authorization;\n\n if (options.optional && !header) {\n next();\n return;\n }\n\n resolved\n .verifyAuthorizationHeader(header)\n .then((user) => {\n request.authio = { user, token: user.token! };\n\n const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure), options);\n\n next();\n })\n .catch((error: unknown) => refuse(request, response, next, error, options));\n };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller and\n * `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n const guard: RequestHandler = (request, response, next) => {\n const user = request.authio?.user;\n\n if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n const failure = authorize(user, ...rules);\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n next();\n };\n\n return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n roles: string | readonly string[],\n options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n const webhooks = createAuthioWebhooks(options);\n\n const route = ((request: Request, response: Response, next: NextFunction) => {\n readRawBody(request, webhooks.maxBodySize)\n .then(async (body) => {\n if (body === undefined) {\n response.status(413).end();\n return;\n }\n\n const outcome = await webhooks.handle({ body, headers: request.headers });\n\n response.status(outcome.status).end();\n })\n .catch(next);\n }) as AuthioWebhookRoute;\n\n route.on = ((type: string, handler: AuthioWebhookHandler) => {\n webhooks.on(type, handler);\n return route;\n }) as AuthioWebhookRoute[\"on\"];\n\n return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n | AuthioProtectedResourceMetadataOptions\n | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n const settings: AuthioProtectedResourceMetadataOptions =\n \"verifier\" in options\n ? {\n ...options,\n resource: requireResource(options.verifier),\n issuer: options.verifier.connection.issuer,\n scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n }\n : options;\n const document = JSON.stringify(createProtectedResourceMetadata(settings));\n const path = protectedResourceMetadataPath(settings.resource);\n\n return (request, response, next) => {\n if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n /** The client the logout tokens are addressed to (its id is their audience). */\n client: AuthioClient;\n /**\n * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n * the application's.\n */\n onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n /** Called when a token is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n readLogoutToken(request)\n .then(async (logoutToken) => {\n if (!logoutToken) {\n response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n return;\n }\n\n let logout: AuthioLogoutToken;\n\n try {\n logout = await options.client.validateLogoutToken(logoutToken);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioTokenValidationError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).end();\n })\n .catch(next);\n };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n client: AuthioClient;\n /**\n * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n * request's cookies) when Authio sent none. Session storage is the application's.\n */\n onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n /** Called when a request is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n Promise.resolve()\n .then(async () => {\n let logout: AuthioFrontChannelLogout;\n\n try {\n logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioCallbackError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n })\n .catch(next);\n };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n const challenge = error.wwwAuthenticate;\n\n if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n response.status(error.status);\n\n if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown, options?: AuthioResponseOptions): void {\n const settings = options ?? (request as RequestWithSettings)[responseSettings] ?? {};\n\n if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n if (settings.passErrors) return next(error);\n\n sendAuthioError(response, error, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n return Promise.reject(\n new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n );\n\n const declared = Number(request.headers[\"content-length\"]);\n\n if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n let size = 0;\n let done = false;\n\n request.on(\"data\", (chunk: Buffer) => {\n if (done) return;\n\n size += chunk.byteLength;\n\n if (size > maxBodySize) {\n done = true;\n request.pause();\n resolve(undefined);\n return;\n }\n\n chunks.push(chunk);\n });\n request.on(\"end\", () => {\n if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n });\n request.on(\"error\", reject);\n });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n return (parsed as Record<string, string>).logout_token;\n\n const raw = Buffer.isBuffer(parsed)\n ? new Uint8Array(parsed)\n : typeof parsed === \"string\"\n ? new TextEncoder().encode(parsed)\n : request.readableEnded\n ? undefined\n : await readRawBody(request, 64 * 1024);\n\n return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
1
+ {"version":3,"sources":["../src/index.ts"],"names":["scopeRule","allOfRule","roleRule","permissionRule","groupRule","claimRule","organizationRule","authenticationLevelRule","authenticationMethodRule","recentAuthenticationRule","callerKindRule","clientRule","anyOfRule"],"mappings":";;;;AAmFA,IAAM,gBAAA,mBAAmB,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAA;AAUtD,SAAS,YAAA,CAAa,QAAA,EAAkD,OAAA,GAA+B,EAAC,EAAmB;AAChI,EAAA,MAAM,WAAW,UAAA,CAAW,QAAQ,CAAA,GAAI,QAAA,GAAW,qBAAqB,QAAQ,CAAA;AAEhF,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAC,OAAA,CAAgC,gBAAgB,CAAA,GAAI;AAAA,MACnD,gBAAgB,OAAA,CAAQ,cAAA;AAAA,MACxB,YAAY,OAAA,CAAQ,UAAA;AAAA,MACpB,kBAAkB,QAAA,CAAS;AAAA,KAC7B;AAEA,IAAA,MAAM,MAAA,GAAS,QAAQ,OAAA,CAAQ,aAAA;AAE/B,IAAA,IAAI,OAAA,CAAQ,QAAA,IAAY,CAAC,MAAA,EAAQ;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA;AAAA,IACF;AAEA,IAAA,QAAA,CACG,yBAAA,CAA0B,MAAM,CAAA,CAChC,IAAA,CAAK,CAAC,IAAA,KAAS;AACd,MAAA,OAAA,CAAQ,MAAA,GAAS,EAAE,IAAA,EAAM,KAAA,EAAO,KAAK,KAAA,EAAO;AAE5C,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,cAAA,CAAe,MAAA,GAAS,CAAA,GAAIA,cAAA,CAAU,QAAA,CAAS,cAAA,EAAgB,KAAK,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA;AAE7G,MAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAA4B,CAAC,CAAA;AAE1G,MAAA,IAAA,EAAK;AAAA,IACP,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,KAAA,KAAmB,OAAO,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACrE,CAAA;AACF;AAaO,SAAS,iBAAiB,KAAA,EAAkC;AACjE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,wCAAwC,CAAA;AAEpF,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAM,CAAC,CAAA,GAAKC,OAAA,CAAU,GAAG,KAAK,CAAA;AAChE,EAAA,MAAM,KAAA,GAAwB,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,MAAA,EAAQ,IAAA;AAE7B,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,MAAA,CAAO,SAAS,QAAA,EAAU,IAAA,EAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,CAAC,CAAA;AAExG,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,CAAA;AAExC,IAAA,IAAI,OAAA,SAAgB,MAAA,CAAO,OAAA,EAAS,UAAU,IAAA,EAAM,IAAI,oBAAA,CAAqB,OAAO,CAAC,CAAA;AAErF,IAAA,IAAA,EAAK;AAAA,EACP,CAAA;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,KAAA,EAAO,EAAE,aAAa,IAAA,CAAK,WAAA,EAAa,KAAA,EAAO,CAAC,SAAqB,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK,GAAG,CAAA;AACvH;AAGO,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcD,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,WAAA,GAAc,CACzB,KAAA,EACA,OAAA,KACgB,cAAcE,aAAA,CAAS,KAAA,EAAO,OAAO,CAAC;AAEjD,IAAM,iBAAA,GAAoB,CAAC,QAAA,EAAkB,MAAA,EAAgB,OAAA,KAClE,cAAcC,mBAAA,CAAe,QAAA,EAAU,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,YAAA,GAAe,CAAC,MAAA,EAAoC,KAAA,KAAqC,cAAcC,cAAA,CAAU,MAAA,EAAQ,KAAK,CAAC;AAErI,IAAM,YAAA,GAAe,CAAC,IAAA,EAAA,GAAiB,MAAA,KAAkC,cAAcC,cAAA,CAAU,IAAA,EAAM,GAAG,MAAM,CAAC;AAEjH,IAAM,sBAAsB,CAAC,YAAA,KAAuC,aAAA,CAAcC,qBAAA,CAAiB,YAAY,CAAC;AAEhH,IAAM,0BAAA,GAA6B,CAAC,YAAA,EAAsB,OAAA,KAC/D,cAAcC,4BAAA,CAAwB,YAAA,EAAc,OAAO,CAAC;AAEvD,IAAM,2BAAA,GAA8B,CAAC,OAAA,EAAqC,KAAA,EAAqB,OAAA,KACpG,cAAcC,6BAAA,CAAyB,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC;AAE1D,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAgB,OAAA,KAC1D,cAAcC,6BAAA,CAAyB,MAAA,EAAQ,OAAO,CAAC;AAElD,IAAM,oBAAoB,CAAC,KAAA,KAAuE,aAAA,CAAcC,mBAAA,CAAe,KAAK,CAAC;AAErI,IAAM,gBAAgB,CAAC,SAAA,KAAuD,aAAA,CAAcC,eAAA,CAAW,SAAS,CAAC;AAEjH,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcV,OAAA,CAAU,GAAG,KAAK,CAAC;AAExF,IAAM,QAAQ,CAAA,GAAI,KAAA,KAAqC,cAAcW,OAAA,CAAU,GAAG,KAAK,CAAC;AAexF,SAAS,eAAe,OAAA,EAAmD;AAChF,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAE7C,EAAA,MAAM,KAAA,IAAS,CAAC,OAAA,EAAkB,QAAA,EAAoB,IAAA,KAAuB;AAC3E,IAAA,WAAA,CAAY,SAAS,QAAA,CAAS,WAAW,CAAA,CACtC,IAAA,CAAK,OAAO,IAAA,KAAS;AACpB,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,GAAU,MAAM,QAAA,CAAS,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA;AAExE,MAAA,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,GAAA,EAAI;AAAA,IACtC,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA,CAAA;AAEA,EAAA,KAAA,CAAM,EAAA,IAAM,CAAC,IAAA,EAAc,OAAA,KAAkC;AAC3D,IAAA,QAAA,CAAS,EAAA,CAAG,MAAM,OAAO,CAAA;AACzB,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA;AAEA,EAAA,OAAO,KAAA;AACT;AAaO,SAAS,gCAAgC,OAAA,EAAsE;AACpH,EAAA,MAAM,QAAA,GACJ,cAAc,OAAA,GACV;AAAA,IACE,GAAG,OAAA;AAAA,IACH,QAAA,EAAU,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAA;AAAA,IAC1C,MAAA,EAAQ,OAAA,CAAQ,QAAA,CAAS,UAAA,CAAW,MAAA;AAAA,IACpC,eAAA,EAAiB,OAAA,CAAQ,eAAA,KAAoB,OAAA,CAAQ,QAAA,CAAS,eAAe,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,QAAA,CAAS,cAAA,GAAiB,MAAA;AAAA,GAC9H,GACA,OAAA;AACN,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,+BAAA,CAAgC,QAAQ,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,6BAAA,CAA8B,QAAA,CAAS,QAAQ,CAAA;AAE5D,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,IAAK,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,IAAW,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,IAAA,SAAa,IAAA,EAAK;AAEtH,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,sBAAsB,CAAA,CAAE,KAAK,kBAAkB,CAAA,CAAE,KAAK,QAAQ,CAAA;AAAA,EAC9F,CAAA;AACF;AAuBO,SAAS,wBAAwB,OAAA,EAAyD;AAC/F,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,eAAA,CAAgB,OAAO,CAAA,CACpB,IAAA,CAAK,OAAO,WAAA,KAAgB;AAC3B,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,iBAAA,EAAmB,iBAAA,EAAmB,sCAAA,EAAwC,CAAA;AACjH,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,WAAW,CAAA;AAAA,MAC/D,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,0BAAA,CAAA,EAA6B,MAAM,KAAA;AAC1D,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,GAAA,EAAI;AAAA,IAC3B,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAuBO,SAAS,yBAAyB,OAAA,EAA0D;AACjG,EAAA,OAAO,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,KAAS;AAClC,IAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,UAAU,CAAA;AAExC,IAAA,OAAA,CAAQ,OAAA,EAAQ,CACb,IAAA,CAAK,YAAY;AAChB,MAAA,IAAI,MAAA;AAEJ,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,0BAAA,CAA2B,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAA,IAAe,OAAA,CAAQ,GAAA,EAAK,kBAAkB,CAAA,CAAE,YAAY,CAAA;AAAA,MACjI,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,UAAU,KAAK,CAAA;AACvB,QAAA,IAAI,EAAE,KAAA,YAAiB,mBAAA,CAAA,EAAsB,MAAM,KAAA;AACnD,QAAA,QAAA,CAAS,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,OAAO,iBAAA,EAAmB,iBAAA,EAAmB,KAAA,CAAM,OAAA,EAAS,CAAA;AACxF,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,OAAA,CAAQ,QAAA,CAAS,MAAA,EAAQ,OAAO,CAAA;AACtC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA,CAAE,KAAK,0BAA0B,CAAA,CAAE,KAAK,mGAAmG,CAAA;AAAA,IAChK,CAAC,CAAA,CACA,KAAA,CAAM,IAAI,CAAA;AAAA,EACf,CAAA;AACF;AAKO,SAAS,eAAA,CAAgB,QAAA,EAAoB,KAAA,EAAiD,OAAA,GAAiC,EAAC,EAAS;AAC9I,EAAA,MAAM,YAAY,KAAA,CAAM,eAAA;AAExB,EAAA,IAAI,SAAA,EAAW,QAAA,CAAS,MAAA,CAAO,kBAAA,EAAoB,SAAS,CAAA;AAE5D,EAAA,QAAA,CAAS,MAAA,CAAO,MAAM,MAAM,CAAA;AAE5B,EAAA,IAAI,OAAA,CAAQ,cAAA,EAAgB,QAAA,CAAS,IAAA,CAAK,0BAA0B,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,gBAAA,CAAiB,KAAK,CAAC,CAAC,CAAA;AAAA,gBACpG,GAAA,EAAI;AACpB;AAEA,SAAS,MAAA,CAAO,OAAA,EAAkB,QAAA,EAAoB,IAAA,EAAoB,KAAA,EAAsB;AAC9F,EAAA,MAAM,QAAA,GAAY,OAAA,CAAgC,gBAAgB,CAAA,IAAK,EAAC;AAExE,EAAA,IAAI,EAAE,iBAAiB,iBAAA,CAAA,IAAsB,EAAE,iBAAiB,oBAAA,CAAA,EAAuB,OAAO,KAAK,KAAK,CAAA;AAExG,EAAA,MAAM,UAAU,KAAA,YAAiB,oBAAA,GAAuB,MAAM,oBAAA,CAAqB,QAAA,CAAS,gBAAgB,CAAA,GAAI,KAAA;AAEhH,EAAA,IAAI,QAAA,CAAS,UAAA,EAAY,OAAO,IAAA,CAAK,OAAO,CAAA;AAE5C,EAAA,eAAA,CAAgB,QAAA,EAAU,SAAS,QAAQ,CAAA;AAC7C;AAEA,SAAS,WAAA,CAAY,SAAkB,WAAA,EAAsD;AAC3F,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,SAAU,OAAA,CAAQ,OAAA,CAAQ,MAAA,CAAO,UAAA,GAAa,WAAA,GAAc,MAAA,GAAY,IAAI,UAAA,CAAW,MAAM,CAAC,CAAA;AACxH,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAC,CAAA;AAEvF,EAAA,IAAI,OAAA,CAAQ,aAAA,IAAkB,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,IAAQ,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,IAAA,CAAK,MAAM,EAAE,MAAA,GAAS,CAAA;AAClI,IAAA,OAAO,OAAA,CAAQ,MAAA;AAAA,MACb,IAAI,MAAM,yHAAyH;AAAA,KACrI;AAEF,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,OAAA,CAAQ,gBAAgB,CAAC,CAAA;AAEzD,EAAA,IAAI,MAAA,CAAO,SAAS,QAAQ,CAAA,IAAK,WAAW,WAAA,EAAa,OAAO,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA;AAEzF,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,SAAmB,EAAC;AAC1B,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,IAAA,GAAO,KAAA;AAEX,IAAA,OAAA,CAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AACpC,MAAA,IAAI,IAAA,EAAM;AAEV,MAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AAEd,MAAA,IAAI,OAAO,WAAA,EAAa;AACtB,QAAA,IAAA,GAAO,IAAA;AACP,QAAA,OAAA,CAAQ,KAAA,EAAM;AACd,QAAA,OAAA,CAAQ,MAAS,CAAA;AACjB,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,IACnB,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,OAAO,MAAM;AACtB,MAAA,IAAI,CAAC,MAAM,OAAA,CAAQ,IAAI,WAAW,MAAA,CAAO,MAAA,CAAO,MAAM,CAAC,CAAC,CAAA;AAAA,IAC1D,CAAC,CAAA;AACD,IAAA,OAAA,CAAQ,EAAA,CAAG,SAAS,MAAM,CAAA;AAAA,EAC5B,CAAC,CAAA;AACH;AAEA,eAAe,gBAAgB,OAAA,EAA+C;AAC5E,EAAA,MAAM,SAAU,OAAA,CAAyC,IAAA;AAEzD,EAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,IAAK,OAAQ,MAAA,CAAmC,YAAA,KAAiB,QAAA;AAClI,IAAA,OAAQ,MAAA,CAAkC,YAAA;AAE5C,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,GAC9B,IAAI,UAAA,CAAW,MAAM,CAAA,GACrB,OAAO,MAAA,KAAW,QAAA,GAChB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA,GAC/B,OAAA,CAAQ,aAAA,GACN,MAAA,GACA,MAAM,WAAA,CAAY,OAAA,EAAS,EAAA,GAAK,IAAI,CAAA;AAE5C,EAAA,OAAO,GAAA,GAAO,IAAI,eAAA,CAAgB,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,GAAA,CAAI,cAAc,KAAK,MAAA,GAAa,MAAA;AACvG;AAEA,SAAS,gBAAgB,QAAA,EAAkC;AACzD,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,MAAM,IAAI,UAAU,4EAA4E,CAAA;AAExH,EAAA,OAAO,QAAA,CAAS,QAAA;AAClB;AAEA,SAAS,WAAW,KAAA,EAAwE;AAC1F,EAAA,OAAO,OAAQ,MAAyB,MAAA,KAAW,UAAA;AACrD","file":"index.js","sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from \"express\";\nimport {\n AuthioCallbackError,\n AuthioTokenValidationError,\n type AuthioCallerKind,\n type AuthioClient,\n type AuthioFrontChannelLogout,\n type AuthioLogoutToken,\n type AuthioResourceAccessSource,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n} from \"@hyper.authio/client\";\nimport {\n allOf as allOfRule,\n anyOf as anyOfRule,\n authorize,\n AuthioBearerError,\n AuthioForbiddenError,\n createAuthioVerifier,\n createAuthioWebhooks,\n createProtectedResourceMetadata,\n protectedResourceMetadataPath,\n requireAuthenticationLevel as authenticationLevelRule,\n requireAuthenticationMethod as authenticationMethodRule,\n requireCallerKind as callerKindRule,\n requireClaim as claimRule,\n requireClient as clientRule,\n requireGroup as groupRule,\n requireOrganization as organizationRule,\n requirePermission as permissionRule,\n requireRecentAuthentication as recentAuthenticationRule,\n requireRole as roleRule,\n requireScope as scopeRule,\n toProblemDetails,\n type AuthioProtectedResourceMetadataOptions,\n type AuthioMatch,\n type AuthioRule,\n type AuthioRuleFailure,\n type AuthioUser,\n type AuthioVerifier,\n type AuthioVerifierOptions,\n type AuthioWebhookHandler,\n type AuthioWebhookOptions,\n} from \"@hyper.authio/server\";\n\n/**\n * What `authioBearer` puts on the request.\n */\nexport interface AuthioRequestContext {\n /** The caller. */\n readonly user: AuthioUser;\n /** The access token the caller was read from. */\n readonly token: string;\n}\n\ndeclare global {\n // eslint-disable-next-line @typescript-eslint/no-namespace\n namespace Express {\n interface Request {\n /** The Authio caller, once `authioBearer` validated the token. */\n authio?: AuthioRequestContext;\n }\n }\n}\n\n/**\n * How refusals are answered.\n */\nexport interface AuthioResponseOptions {\n /** Answers `401` and `403` with problem details (RFC 9457) as well as the `WWW-Authenticate` header. */\n problemDetails?: boolean;\n /** Passes refusals to `next(error)` instead of answering, for an application's own error handler. */\n passErrors?: boolean;\n}\n\n/**\n * Options of `authioBearer`.\n */\nexport interface AuthioBearerOptions extends AuthioResponseOptions {\n /** Lets a request without a token through, unauthenticated; a token that is present must still be valid. */\n optional?: boolean;\n}\n\nconst responseSettings = Symbol.for(\"authio.express.response\");\n\ntype RequestWithSettings = Request & { [responseSettings]?: AuthioResponseOptions & { resourceMetadata?: string } };\n\n/**\n * Validates the `Authorization: Bearer` token and puts the caller on `req.authio`. Answers `401` with the\n * `WWW-Authenticate` challenge when the token is missing or invalid.\n *\n * @param verifier A verifier, or its options.\n */\nexport function authioBearer(verifier: AuthioVerifier | AuthioVerifierOptions, options: AuthioBearerOptions = {}): RequestHandler {\n const resolved = isVerifier(verifier) ? verifier : createAuthioVerifier(verifier);\n\n return (request, response, next) => {\n (request as RequestWithSettings)[responseSettings] = {\n problemDetails: options.problemDetails,\n passErrors: options.passErrors,\n resourceMetadata: resolved.resourceMetadataUrl,\n };\n\n const header = request.headers.authorization;\n\n if (options.optional && !header) {\n next();\n return;\n }\n\n resolved\n .verifyAuthorizationHeader(header)\n .then((user) => {\n request.authio = { user, token: user.token! };\n\n const failure = resolved.requiredScopes.length > 0 ? scopeRule(resolved.requiredScopes, \"all\").check(user) : undefined;\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure as AuthioRuleFailure));\n\n next();\n })\n .catch((error: unknown) => refuse(request, response, next, error));\n };\n}\n\n/**\n * An Express guard that is also an Authio rule: use it as middleware, or pass it to `requireAuthio`, `allOf` and\n * `anyOf` like any rule of `@hyper.authio/server`.\n */\nexport type AuthioGuard = RequestHandler & AuthioRule;\n\n/**\n * Requires every rule (guards of this package or rules of `@hyper.authio/server`); answers `401` without a caller,\n * `401` with `insufficient_user_authentication` when a rule asks for a stronger or more recent sign-in (RFC 9470 §3),\n * and `403` with the joined refusal otherwise.\n */\nexport function requireAuthio(...rules: AuthioRule[]): AuthioGuard {\n if (rules.length === 0) throw new TypeError(\"requireAuthio needs at least one rule.\");\n\n const rule = rules.length === 1 ? rules[0]! : allOfRule(...rules);\n const guard: RequestHandler = (request, response, next) => {\n const user = request.authio?.user;\n\n if (!user) return refuse(request, response, next, new AuthioBearerError(undefined, { error: undefined }));\n\n const failure = authorize(user, ...rules);\n\n if (failure) return refuse(request, response, next, new AuthioForbiddenError(failure));\n\n next();\n };\n\n return Object.assign(guard, { description: rule.description, check: (user: AuthioUser) => authorize(user, ...rules) });\n}\n\n/** Requires granted scopes. */\nexport const requireScope = (scopes: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(scopeRule(scopes, match));\n/** Requires roles, from any source or only from the given `*_resource_access` claims. */\nexport const requireRole = (\n roles: string | readonly string[],\n options?: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] },\n): AuthioGuard => requireAuthio(roleRule(roles, options));\n/** Requires a permission (`method` on `resource`). */\nexport const requirePermission = (resource: string, method: string, options?: { sources?: readonly AuthioResourceAccessSource[] }): AuthioGuard =>\n requireAuthio(permissionRule(resource, method, options));\n/** Requires groups. */\nexport const requireGroup = (groups: string | readonly string[], match?: AuthioMatch): AuthioGuard => requireAuthio(groupRule(groups, match));\n/** Requires a claim, or one of its values. */\nexport const requireClaim = (type: string, ...values: string[]): AuthioGuard => requireAuthio(claimRule(type, ...values));\n/** Requires an organization context, or a given organization. */\nexport const requireOrganization = (organization?: string): AuthioGuard => requireAuthio(organizationRule(organization));\n/** Requires a minimum authentication level (`acr`), and optionally a sign-in at most `maxAge` seconds old. */\nexport const requireAuthenticationLevel = (minimumLevel: number, options?: Parameters<typeof authenticationLevelRule>[1]): AuthioGuard =>\n requireAuthio(authenticationLevelRule(minimumLevel, options));\n/** Requires authentication methods (`amr`). */\nexport const requireAuthenticationMethod = (methods: string | readonly string[], match?: AuthioMatch, options?: { acrValues?: string }): AuthioGuard =>\n requireAuthio(authenticationMethodRule(methods, match, options));\n/** Requires a sign-in at most `maxAge` seconds old (`auth_time`). */\nexport const requireRecentAuthentication = (maxAge: number, options?: Parameters<typeof recentAuthenticationRule>[1]): AuthioGuard =>\n requireAuthio(recentAuthenticationRule(maxAge, options));\n/** Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`. */\nexport const requireCallerKind = (kinds: AuthioCallerKind | readonly AuthioCallerKind[]): AuthioGuard => requireAuthio(callerKindRule(kinds));\n/** Requires the token to have been issued to one of the clients. */\nexport const requireClient = (clientIds: string | readonly string[]): AuthioGuard => requireAuthio(clientRule(clientIds));\n/** Requires every rule. */\nexport const allOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(allOfRule(...rules));\n/** Requires at least one rule. */\nexport const anyOf = (...rules: AuthioRule[]): AuthioGuard => requireAuthio(anyOfRule(...rules));\n\n/**\n * A webhook route: verifies the signature over the raw body, deduplicates and dispatches. Mount it before any JSON\n * body parser, or behind `express.raw()`.\n */\nexport interface AuthioWebhookRoute extends RequestHandler {\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhookRoute;\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhookRoute;\n}\n\n/**\n * Creates a webhook route: `app.post(\"/webhooks/authio\", authioWebhooks({ secret }).on(\"user_created\", …))`.\n * Answers `200` handled or duplicate, `400` unreadable, `401` bad signature, `413` too large, `500` handler failure.\n */\nexport function authioWebhooks(options: AuthioWebhookOptions): AuthioWebhookRoute {\n const webhooks = createAuthioWebhooks(options);\n\n const route = ((request: Request, response: Response, next: NextFunction) => {\n readRawBody(request, webhooks.maxBodySize)\n .then(async (body) => {\n if (body === undefined) {\n response.status(413).end();\n return;\n }\n\n const outcome = await webhooks.handle({ body, headers: request.headers });\n\n response.status(outcome.status).end();\n })\n .catch(next);\n }) as AuthioWebhookRoute;\n\n route.on = ((type: string, handler: AuthioWebhookHandler) => {\n webhooks.on(type, handler);\n return route;\n }) as AuthioWebhookRoute[\"on\"];\n\n return route;\n}\n\n/**\n * Options of `authioProtectedResourceMetadata`: the metadata itself, or a verifier configured with `resource`.\n */\nexport type AuthioProtectedResourceMetadataRouteOptions =\n | AuthioProtectedResourceMetadataOptions\n | (Omit<AuthioProtectedResourceMetadataOptions, \"resource\" | \"issuer\" | \"authority\" | \"realm\"> & { verifier: AuthioVerifier });\n\n/**\n * Serves the API's protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource{path of the\n * resource}`: `app.use(authioProtectedResourceMetadata({ verifier }))`. Every other request goes on to `next`.\n */\nexport function authioProtectedResourceMetadata(options: AuthioProtectedResourceMetadataRouteOptions): RequestHandler {\n const settings: AuthioProtectedResourceMetadataOptions =\n \"verifier\" in options\n ? {\n ...options,\n resource: requireResource(options.verifier),\n issuer: options.verifier.connection.issuer,\n scopesSupported: options.scopesSupported ?? (options.verifier.requiredScopes.length > 0 ? options.verifier.requiredScopes : undefined),\n }\n : options;\n const document = JSON.stringify(createProtectedResourceMetadata(settings));\n const path = protectedResourceMetadataPath(settings.resource);\n\n return (request, response, next) => {\n if ((request.method !== \"GET\" && request.method !== \"HEAD\") || request.path.replace(/\\/+$/, \"\") !== path) return next();\n\n response.set(\"Cache-Control\", \"public, max-age=3600\").type(\"application/json\").send(document);\n };\n}\n\n/**\n * Options of `authioBackchannelLogout`.\n */\nexport interface AuthioBackchannelLogoutOptions {\n /** The client the logout tokens are addressed to (its id is their audience). */\n client: AuthioClient;\n /**\n * Ends the sessions the token names: every session of `subject`, or the one `sessionId` names. Session storage is\n * the application's.\n */\n onLogout: (logout: AuthioLogoutToken, request: Request) => void | Promise<void>;\n /** Called when a token is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The back-channel logout endpoint (OpenID Connect Back-Channel Logout 1.0): reads `logout_token` from the\n * form-encoded body, validates it with the client and calls `onLogout`. Answers `200` on success, `400`\n * (`invalid_request`) for a token that does not validate, and `500` when `onLogout` throws; always `Cache-Control:\n * no-store`. Works with or without `express.urlencoded()` in front of it.\n */\nexport function authioBackchannelLogout(options: AuthioBackchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n readLogoutToken(request)\n .then(async (logoutToken) => {\n if (!logoutToken) {\n response.status(400).json({ error: \"invalid_request\", error_description: \"The request carries no logout_token.\" });\n return;\n }\n\n let logout: AuthioLogoutToken;\n\n try {\n logout = await options.client.validateLogoutToken(logoutToken);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioTokenValidationError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).end();\n })\n .catch(next);\n };\n}\n\n/**\n * Options of `authioFrontchannelLogout`.\n */\nexport interface AuthioFrontchannelLogoutOptions {\n /** The client Authio ends the sessions of (its issuer is checked against `iss`). */\n client: AuthioClient;\n /**\n * Ends the sessions the request names: the Authio session `sessionId`, or the browser's own session (read from the\n * request's cookies) when Authio sent none. Session storage is the application's.\n */\n onLogout: (logout: AuthioFrontChannelLogout, request: Request) => void | Promise<void>;\n /** Called when a request is refused. */\n onError?: (error: unknown) => void;\n}\n\n/**\n * The front-channel logout endpoint (OpenID Connect Front-Channel Logout 1.0), the page Authio loads in an iframe when\n * a session ends: checks `iss` and `sid` with the client and calls `onLogout`. Answers `200` with an empty page, `400`\n * (`invalid_request`) for another issuer or a `sid` without `iss`, and `500` when `onLogout` throws; always\n * `Cache-Control: no-store`. Register its URL as the client's front-channel logout URI, with the session required.\n */\nexport function authioFrontchannelLogout(options: AuthioFrontchannelLogoutOptions): RequestHandler {\n return (request, response, next) => {\n response.set(\"Cache-Control\", \"no-store\");\n\n Promise.resolve()\n .then(async () => {\n let logout: AuthioFrontChannelLogout;\n\n try {\n logout = options.client.validateFrontChannelLogout(new URL(request.originalUrl ?? request.url, \"http://localhost\").searchParams);\n } catch (error) {\n options.onError?.(error);\n if (!(error instanceof AuthioCallbackError)) throw error;\n response.status(400).json({ error: \"invalid_request\", error_description: error.message });\n return;\n }\n\n await options.onLogout(logout, request);\n response.status(200).type(\"text/html; charset=utf-8\").send('<!doctype html><html><head><meta charset=\"utf-8\"><title>Authio</title></head><body></body></html>');\n })\n .catch(next);\n };\n}\n\n/**\n * Answers a refusal: `WWW-Authenticate`, the status, and problem details when asked.\n */\nexport function sendAuthioError(response: Response, error: AuthioBearerError | AuthioForbiddenError, options: AuthioResponseOptions = {}): void {\n const challenge = error.wwwAuthenticate;\n\n if (challenge) response.append(\"WWW-Authenticate\", challenge);\n\n response.status(error.status);\n\n if (options.problemDetails) response.type(\"application/problem+json\").send(JSON.stringify(toProblemDetails(error)));\n else response.end();\n}\n\nfunction refuse(request: Request, response: Response, next: NextFunction, error: unknown): void {\n const settings = (request as RequestWithSettings)[responseSettings] ?? {};\n\n if (!(error instanceof AuthioBearerError) && !(error instanceof AuthioForbiddenError)) return next(error);\n\n const refusal = error instanceof AuthioForbiddenError ? error.withResourceMetadata(settings.resourceMetadata) : error;\n\n if (settings.passErrors) return next(refusal);\n\n sendAuthioError(response, refusal, settings);\n}\n\nfunction readRawBody(request: Request, maxBodySize: number): Promise<Uint8Array | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (Buffer.isBuffer(parsed)) return Promise.resolve(parsed.byteLength > maxBodySize ? undefined : new Uint8Array(parsed));\n if (typeof parsed === \"string\") return Promise.resolve(new TextEncoder().encode(parsed));\n\n if (request.readableEnded || (parsed !== undefined && parsed !== null && typeof parsed === \"object\" && Object.keys(parsed).length > 0))\n return Promise.reject(\n new Error(\"The Authio webhook route needs the raw body: mount it before express.json(), or use express.raw({ type: '*/*' }) on it.\"),\n );\n\n const declared = Number(request.headers[\"content-length\"]);\n\n if (Number.isFinite(declared) && declared > maxBodySize) return Promise.resolve(undefined);\n\n return new Promise((resolve, reject) => {\n const chunks: Buffer[] = [];\n let size = 0;\n let done = false;\n\n request.on(\"data\", (chunk: Buffer) => {\n if (done) return;\n\n size += chunk.byteLength;\n\n if (size > maxBodySize) {\n done = true;\n request.pause();\n resolve(undefined);\n return;\n }\n\n chunks.push(chunk);\n });\n request.on(\"end\", () => {\n if (!done) resolve(new Uint8Array(Buffer.concat(chunks)));\n });\n request.on(\"error\", reject);\n });\n}\n\nasync function readLogoutToken(request: Request): Promise<string | undefined> {\n const parsed = (request as Request & { body?: unknown }).body;\n\n if (parsed && typeof parsed === \"object\" && !Buffer.isBuffer(parsed) && typeof (parsed as Record<string, unknown>).logout_token === \"string\")\n return (parsed as Record<string, string>).logout_token;\n\n const raw = Buffer.isBuffer(parsed)\n ? new Uint8Array(parsed)\n : typeof parsed === \"string\"\n ? new TextEncoder().encode(parsed)\n : request.readableEnded\n ? undefined\n : await readRawBody(request, 64 * 1024);\n\n return raw ? (new URLSearchParams(new TextDecoder().decode(raw)).get(\"logout_token\") ?? undefined) : undefined;\n}\n\nfunction requireResource(verifier: AuthioVerifier): string {\n if (!verifier.resource) throw new TypeError(\"authioProtectedResourceMetadata needs a verifier configured with resource.\");\n\n return verifier.resource;\n}\n\nfunction isVerifier(value: AuthioVerifier | AuthioVerifierOptions): value is AuthioVerifier {\n return typeof (value as AuthioVerifier).verify === \"function\";\n}\n\nexport type { AuthioMatch, AuthioRule, AuthioUser, AuthioVerifier, AuthioVerifierOptions } from \"@hyper.authio/server\";\n"]}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@hyper.authio/express",
3
- "version": "0.8.0",
3
+ "version": "0.9.0",
4
4
  "description": "Express middleware for Authio: bearer validation, scope/role/permission/group/claim/organization/acr/amr/client guards, and signed webhook routes.",
5
5
  "license": "MIT",
6
6
  "type": "module",
@@ -32,8 +32,8 @@
32
32
  "build": "tsup"
33
33
  },
34
34
  "dependencies": {
35
- "@hyper.authio/client": "0.8.0",
36
- "@hyper.authio/server": "0.8.0"
35
+ "@hyper.authio/client": "0.9.0",
36
+ "@hyper.authio/server": "0.9.0"
37
37
  },
38
38
  "keywords": [
39
39
  "authio",