@hyper.authio/server 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,739 @@
+'use strict';
+
+var client = require('@hyper.authio/client');
+var jose = require('jose');
+
+// src/user.ts
+var AuthioUser = class {
+  /** `sub`: the person's id, or the credential's for a machine caller. */
+  subject;
+  /** The client the token was issued to (`azp`, else `client_id`). */
+  clientId;
+  /** `sid`. */
+  sessionId;
+  /** `jti`. */
+  tokenId;
+  /** `aud`. */
+  audiences;
+  /** The granted scopes. */
+  scopes;
+  /** The roles of the seven `*_resource_access` claims, with their source and permissions. */
+  resourceAccess;
+  /** Every role name: the `*_resource_access` roles, then the flat role claims. */
+  roles;
+  /** Resource → every method any role allows on it. */
+  permissions;
+  /** The group names of the group claims. */
+  groups;
+  /** `org_id`. */
+  organizationId;
+  /** `org_alias`. */
+  organizationAlias;
+  /** `account_id`. */
+  accountId;
+  /** `acr`. */
+  acr;
+  /** `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. */
+  authenticationLevel;
+  /** `amr`. */
+  authenticationMethods;
+  /** `idp`. */
+  identityProvider;
+  /** `auth_time`. */
+  authenticatedAt;
+  /** `act`. */
+  actor;
+  /** `delegation_id`. */
+  delegationId;
+  email;
+  emailVerified;
+  name;
+  preferredUsername;
+  /** `credential_type`, on a token issued to an account credential or a consumer. */
+  credentialType;
+  /** `credential_id`. */
+  credentialId;
+  /** Every claim, as the token or the introspection answer carried it. */
+  claims;
+  flatRoles;
+  /**
+   * @param claims The token's payload, or the introspection answer's members.
+   * @param settings Where flat roles and groups are read from.
+   * @param token The access token, kept for forwarding and on-behalf-of.
+   */
+  constructor(claims, settings = {}, token) {
+    const text = (name) => typeof claims[name] === "string" && claims[name] ? claims[name] : void 0;
+    this.claims = Object.freeze({ ...claims });
+    this.subject = text(client.AuthioClaimTypes.Subject) ?? "";
+    this.clientId = text(client.AuthioClaimTypes.AuthorizedParty) ?? text(client.AuthioClaimTypes.ClientId);
+    this.sessionId = text(client.AuthioClaimTypes.SessionId);
+    this.tokenId = text(client.AuthioClaimTypes.JwtId);
+    this.audiences = Object.freeze(distinct(valuesOf(claims[client.AuthioClaimTypes.Audience])));
+    this.scopes = Object.freeze(distinct(valuesOf(claims[client.AuthioClaimTypes.Scope]).flatMap((scope) => scope.split(/\s+/)).filter(Boolean)));
+    this.resourceAccess = client.parseResourceAccess(claims);
+    this.flatRoles = Object.freeze((settings.roleClaims ?? ["role"]).flatMap((name) => valuesOf(claims[name])));
+    this.roles = Object.freeze(distinctIgnoringCase([...this.resourceAccess.roles, ...this.flatRoles]));
+    this.permissions = this.resourceAccess.permissions;
+    this.groups = Object.freeze(distinct((settings.groupClaims ?? ["groups"]).flatMap((name) => valuesOf(claims[name]))));
+    this.organizationId = text(client.AuthioClaimTypes.OrganizationId);
+    this.organizationAlias = text(client.AuthioClaimTypes.OrganizationAlias);
+    this.accountId = text(client.AuthioClaimTypes.AccountId);
+    this.acr = valuesOf(claims[client.AuthioClaimTypes.AuthenticationContextClass])[0];
+    this.authenticationLevel = this.acr !== void 0 && /^\d+$/.test(this.acr) ? Number(this.acr) : void 0;
+    this.authenticationMethods = Object.freeze(distinctIgnoringCase(valuesOf(claims[client.AuthioClaimTypes.AuthenticationMethods])));
+    this.identityProvider = text(client.AuthioClaimTypes.IdentityProvider);
+    this.authenticatedAt = toDate(claims[client.AuthioClaimTypes.AuthTime]);
+    this.actor = readActor(claims[client.AuthioClaimTypes.Actor]);
+    this.delegationId = text(client.AuthioClaimTypes.DelegationId);
+    this.email = text(client.AuthioClaimTypes.Email);
+    this.emailVerified = toBoolean(claims[client.AuthioClaimTypes.EmailVerified]);
+    this.name = text(client.AuthioClaimTypes.Name);
+    this.preferredUsername = text(client.AuthioClaimTypes.PreferredUsername);
+    this.credentialType = text(client.AuthioClaimTypes.CredentialType);
+    this.credentialId = text(client.AuthioClaimTypes.CredentialId);
+    Object.defineProperty(this, "token", { value: token, enumerable: false });
+  }
+  /** Whether an actor exchanged the token on the subject's behalf. */
+  get isDelegated() {
+    return this.actor !== void 0;
+  }
+  /** Whether the scope was granted. */
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  /**
+   * Whether the user holds the role. Without sources, from any `*_resource_access` claim or a flat role claim; with
+   * sources, only from those `*_resource_access` claims.
+   */
+  hasRole(role, options = {}) {
+    if (!role) return false;
+    if (options.sources && options.sources.length > 0) return this.resourceAccess.hasRole(role, options.sources);
+    const wanted = role.toLowerCase();
+    return this.resourceAccess.hasRole(role) || this.flatRoles.some((name) => name.toLowerCase() === wanted);
+  }
+  /**
+   * Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on
+   * `resource`. Case-insensitive.
+   */
+  hasPermission(resource, method, options = {}) {
+    return this.resourceAccess.grants(resource, method, options.sources);
+  }
+  /** Whether the user is in the group (exact match). */
+  hasGroup(group) {
+    return this.groups.includes(group);
+  }
+  /**
+   * Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an
+   * array claim matches when any item does).
+   */
+  hasClaim(type, ...values) {
+    const present = this.claimValues(type);
+    return values.length === 0 ? present.length > 0 : present.some((value) => values.includes(value));
+  }
+  /**
+   * The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.
+   */
+  claimValues(type) {
+    return valuesOf(this.claims[type]);
+  }
+  /** Every member but the raw token. */
+  toJSON() {
+    const { flatRoles: _flatRoles, ...members } = this;
+    return { ...members, resourceAccess: this.resourceAccess.entries, isDelegated: this.isDelegated };
+  }
+};
+function valuesOf(value) {
+  if (value === void 0 || value === null) return [];
+  if (Array.isArray(value)) return value.flatMap((item) => item === null || item === void 0 ? [] : [toText(item)]);
+  if (typeof value === "string" && value.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed)) return valuesOf(parsed);
+    } catch {
+      return [value];
+    }
+  }
+  return [toText(value)];
+}
+function toText(value) {
+  return typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function readActor(value, depth = 0) {
+  let actor = value;
+  if (typeof actor === "string") {
+    try {
+      actor = JSON.parse(actor);
+    } catch {
+      return void 0;
+    }
+  }
+  if (!actor || typeof actor !== "object" || Array.isArray(actor) || depth > 16) return void 0;
+  const record = actor;
+  return Object.freeze({
+    clientId: typeof record.client_id === "string" ? record.client_id : void 0,
+    subject: typeof record.sub === "string" ? record.sub : void 0,
+    actor: readActor(record.act, depth + 1)
+  });
+}
+function toDate(value) {
+  const seconds3 = typeof value === "number" ? value : typeof value === "string" && /^\d+$/.test(value) ? Number(value) : void 0;
+  return seconds3 === void 0 ? void 0 : new Date(seconds3 * 1e3);
+}
+function toBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function distinct(values) {
+  return [...new Set(values)];
+}
+function distinctIgnoringCase(values) {
+  const seen = /* @__PURE__ */ new Set();
+  return values.filter((value) => {
+    const key = value.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+// src/rules.ts
+function authorize(user, ...rules) {
+  const failures = rules.map((rule) => rule.check(user)).filter((failure) => failure !== void 0);
+  if (failures.length === 0) return void 0;
+  const bearer = failures.find((failure) => failure.error === "insufficient_user_authentication") ?? failures.find((failure) => failure.error);
+  return {
+    message: failures.map((failure) => failure.message).join(" "),
+    ...bearer?.error ? { error: bearer.error } : {},
+    ...bearer?.scope ? { scope: bearer.scope } : {}
+  };
+}
+function requireScope(scopes, match = "any") {
+  const required = listOf(scopes, "scope");
+  return {
+    description: `Authio scope (${match}): ${required.join(" ")}`,
+    check: (user) => satisfies(required, match, (scope) => user.hasScope(scope)) ? void 0 : {
+      message: `The token lacks the required scope (${match}): ${required.join(" ")}.`,
+      error: "insufficient_scope",
+      scope: required.join(" ")
+    }
+  };
+}
+function requireRole(roles, options = {}) {
+  const required = listOf(roles, "role");
+  const match = options.match ?? "any";
+  const from = describeSources(options.sources);
+  return {
+    description: `Authio role (${match}): ${required.join(", ")}${from}`,
+    check: (user) => satisfies(required, match, (role) => user.hasRole(role, { sources: options.sources })) ? void 0 : { message: `The caller lacks the required role (${match}): ${required.join(", ")}${from}.` }
+  };
+}
+function requirePermission(resource, method, options = {}) {
+  if (!resource?.trim() || !method?.trim()) throw new TypeError("A permission needs a resource and a method.");
+  const from = describeSources(options.sources);
+  return {
+    description: `Authio permission: ${resource}:${method}${from}`,
+    check: (user) => user.hasPermission(resource, method, { sources: options.sources }) ? void 0 : { message: `The caller lacks the permission ${resource}:${method}${from}.` }
+  };
+}
+function requireGroup(groups, match = "any") {
+  const required = listOf(groups, "group");
+  return {
+    description: `Authio group (${match}): ${required.join(", ")}`,
+    check: (user) => satisfies(required, match, (group) => user.hasGroup(group)) ? void 0 : { message: `The caller is not in the required group (${match}): ${required.join(", ")}.` }
+  };
+}
+function requireClaim(type, ...values) {
+  if (!type?.trim()) throw new TypeError("A claim rule needs a claim type.");
+  return {
+    description: values.length === 0 ? `Authio claim: ${type}` : `Authio claim: ${type} in ${values.join(", ")}`,
+    check: (user) => user.hasClaim(type, ...values) ? void 0 : { message: values.length === 0 ? `The token lacks the claim ${type}.` : `The token's claim ${type} is not one of: ${values.join(", ")}.` }
+  };
+}
+function requireOrganization(organization) {
+  const wanted = organization?.trim() || void 0;
+  return {
+    description: `Authio organization: ${wanted ?? "any"}`,
+    check: (user) => {
+      const satisfied = !!user.organizationId && (!wanted || user.organizationAlias?.toLowerCase() === wanted.toLowerCase() || user.organizationId.toLowerCase() === wanted.toLowerCase());
+      return satisfied ? void 0 : { message: wanted ? `The token is not in the organization ${wanted}.` : "The token has no organization context." };
+    }
+  };
+}
+function requireAuthenticationLevel(minimumLevel) {
+  if (!Number.isInteger(minimumLevel) || minimumLevel < 0) throw new RangeError("The minimum level must be a non-negative integer.");
+  return {
+    description: `Authio authentication level >= ${minimumLevel}`,
+    check: (user) => user.authenticationLevel !== void 0 && user.authenticationLevel >= minimumLevel ? void 0 : { message: `The authentication level must be at least ${minimumLevel}.`, error: "insufficient_user_authentication" }
+  };
+}
+function requireAuthenticationMethod(methods, match = "any") {
+  const required = listOf(methods, "authentication method");
+  return {
+    description: `Authio authentication method (${match}): ${required.join(", ")}`,
+    check: (user) => {
+      const used = user.authenticationMethods.map((method) => method.toLowerCase());
+      return satisfies(required, match, (method) => used.includes(method.toLowerCase())) ? void 0 : { message: `The user must authenticate with (${match}): ${required.join(", ")}.`, error: "insufficient_user_authentication" };
+    }
+  };
+}
+function requireClient(clientIds) {
+  const required = listOf(clientIds, "client id");
+  return {
+    description: `Authio client: ${required.join(", ")}`,
+    check: (user) => user.clientId !== void 0 && required.includes(user.clientId) ? void 0 : { message: `The token was not issued to an accepted client (${required.join(", ")}).` }
+  };
+}
+function allOf(...rules) {
+  return {
+    description: rules.map((rule) => rule.description).join(" and "),
+    check: (user) => authorize(user, ...rules)
+  };
+}
+function anyOf(...rules) {
+  if (rules.length === 0) throw new TypeError("anyOf needs at least one rule.");
+  return {
+    description: rules.map((rule) => rule.description).join(" or "),
+    check: (user) => {
+      const failures = rules.map((rule) => rule.check(user));
+      return failures.some((failure) => failure === void 0) ? void 0 : failures[0];
+    }
+  };
+}
+function listOf(values, name) {
+  const list = [...new Set((typeof values === "string" ? [values] : [...values]).filter((value) => value?.trim()))];
+  if (list.length === 0) throw new TypeError(`At least one ${name} is required.`);
+  return list;
+}
+function satisfies(required, match, holds) {
+  return match === "all" ? required.every(holds) : required.some(holds);
+}
+function describeSources(sources) {
+  return sources && sources.length > 0 ? ` from ${[...new Set(sources)].join(", ")}` : "";
+}
+var AuthioBearerError = class extends client.AuthioError {
+  status = 401;
+  /** `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). */
+  error;
+  /** Why the token was refused, safe to send to the caller. */
+  description;
+  constructor(description, options = {}) {
+    super(description ?? "A valid Authio access token is required.", { cause: options.cause });
+    this.error = "error" in options ? options.error : "invalid_token";
+    this.description = description === void 0 ? void 0 : toHeaderText(description);
+  }
+  /** The `WWW-Authenticate` value. */
+  get wwwAuthenticate() {
+    if (!this.error) return "Bearer";
+    return this.description ? `Bearer error="${this.error}", error_description="${this.description}"` : `Bearer error="${this.error}"`;
+  }
+};
+var AuthioForbiddenError = class extends client.AuthioError {
+  status = 403;
+  failure;
+  constructor(failure) {
+    super(failure.message);
+    this.failure = failure;
+  }
+  /** The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. */
+  get wwwAuthenticate() {
+    return toForbiddenChallenge(this.failure);
+  }
+};
+function toForbiddenChallenge(failure) {
+  if (!failure.error) return void 0;
+  const value = `Bearer error="${failure.error}", error_description="${escapeQuoted(failure.message)}"`;
+  return failure.scope ? `${value}, scope="${escapeQuoted(failure.scope)}"` : value;
+}
+function toProblemDetails(error) {
+  if (error instanceof AuthioBearerError)
+    return {
+      type: "https://tools.ietf.org/html/rfc9110#section-15.5.2",
+      title: "Unauthorized",
+      status: 401,
+      detail: "A valid Authio access token is required."
+    };
+  return {
+    type: "https://tools.ietf.org/html/rfc9110#section-15.5.4",
+    title: "Forbidden",
+    status: 403,
+    detail: error.failure.message || "The caller is not allowed to access this resource.",
+    ...error.failure.error ? { error: error.failure.error } : {},
+    ...error.failure.scope ? { scope: error.failure.scope } : {}
+  };
+}
+function toHeaderText(text) {
+  return [...text].map((character) => character >= " " && character <= "~" && character !== '"' && character !== "\\" ? character : "?").join("");
+}
+function escapeQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+var AuthioBearerErrorDescriptions = {
+  Inactive: "Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.",
+  Unconfirmed: "Authio could not be reached to confirm that the token is active.",
+  Empty: "The token is empty.",
+  Encrypted: "The token is encrypted; validate it with introspection ('introspectionOnly').",
+  SigningKeysUnavailable: "Authio could not be reached to read its signing keys."
+};
+var maxCachedAnswers = 1e4;
+function createAuthioVerifier(options) {
+  const audiences = [...new Set((typeof options.audiences === "string" ? [options.audiences] : [...options.audiences ?? []]).filter((value) => value?.trim()))];
+  if (audiences.length === 0) throw new client.AuthioConfigurationError("The Authio verifier needs at least one audience: the API's resource identifier or client id.");
+  const connection = client.resolveConnection(options);
+  const discovery = client.createAuthioDiscoveryClient(connection);
+  const introspection = options.introspection ?? "none";
+  const client$1 = resolveClient(options);
+  if (introspection !== "none" && !client$1)
+    throw new client.AuthioConfigurationError(
+      `Authio introspection ('${introspection}') needs the API's confidential client: pass options.client with its clientId and clientSecret or private key.`
+    );
+  const cacheDurationMs = client.seconds(options.introspectionCacheDuration, 30, "introspectionCacheDuration");
+  const clockSkew = client.seconds(options.clockSkew, 30, "clockSkew") / 1e3;
+  const algorithms = options.validAlgorithms && options.validAlgorithms.length > 0 ? [...options.validAlgorithms] : [...client.AuthioAsymmetricAlgorithms];
+  const rejectNonAccessTokens = options.rejectNonAccessTokens ?? true;
+  const claimSettings = { roleClaims: options.roleClaims, groupClaims: options.groupClaims };
+  const cache = /* @__PURE__ */ new Map();
+  let keys;
+  const introspect = async (token, key, signal) => {
+    const now = connection.clock.now();
+    const cached = cache.get(key);
+    if (cached && cached.until > now) return cached.result;
+    cache.delete(key);
+    const result = await client$1.introspect(token, { tokenTypeHint: client.AuthioTokenTypes.AccessToken, signal });
+    if (!result.active) return void 0;
+    const until = Math.min(now + cacheDurationMs, typeof result.exp === "number" ? result.exp * 1e3 : Number.POSITIVE_INFINITY);
+    if (until > now) {
+      if (cache.size >= maxCachedAnswers) cache.delete(cache.keys().next().value);
+      cache.set(key, { result, until });
+    }
+    return result;
+  };
+  const signingKeys = async (signal) => {
+    const document = await discovery.get(signal);
+    const uri = document.jwks_uri;
+    if (!uri) throw new client.AuthioError("The Authio discovery document has no jwks_uri.");
+    if (!keys || keys.uri !== uri) keys = { uri, set: jose.createRemoteJWKSet(new URL(uri), { [jose.customFetch]: connection.fetch, timeoutDuration: connection.httpTimeoutMs }) };
+    return keys.set;
+  };
+  const verifyJwt = async (token, signal) => {
+    if (client.isAuthioTokenEncrypted(token)) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Encrypted);
+    let keySet;
+    try {
+      keySet = await signingKeys(signal);
+    } catch (error) {
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.SigningKeysUnavailable, { cause: error });
+    }
+    let payload;
+    try {
+      ({ payload } = await jose.jwtVerify(token, keySet, {
+        issuer: connection.issuer,
+        audience: audiences,
+        algorithms,
+        clockTolerance: clockSkew,
+        requiredClaims: ["exp"],
+        currentDate: new Date(connection.clock.now())
+      }));
+    } catch (error) {
+      throw new AuthioBearerError(describeJwtFailure(error, audiences, token), { cause: error });
+    }
+    const type = typeof payload.typ === "string" ? payload.typ : void 0;
+    if (rejectNonAccessTokens && type !== void 0 && type.toLowerCase() !== "bearer")
+      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`);
+    if (introspection === "activeCheck") await confirmActive(token, payload, signal);
+    return new AuthioUser(payload, claimSettings, token);
+  };
+  const confirmActive = async (token, payload, signal) => {
+    const key = payload.jti ? `jti:${payload.jti}` : await keyForToken(token);
+    let result;
+    try {
+      result = await introspect(token, key, signal);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error });
+    }
+    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive);
+  };
+  const verifyByIntrospection = async (token, signal) => {
+    let result;
+    try {
+      result = await introspect(token, await keyForToken(token), signal);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error });
+    }
+    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive);
+    if (result.iss && result.iss !== connection.issuer) throw new AuthioBearerError(`The issuer '${result.iss}' is invalid`);
+    const tokenAudiences = [result.aud ?? []].flat();
+    if (!tokenAudiences.some((audience) => audiences.includes(audience))) throw new AuthioBearerError(describeAudience(tokenAudiences, audiences));
+    if (typeof result.exp === "number" && (result.exp + clockSkew) * 1e3 <= connection.clock.now())
+      throw new AuthioBearerError(`The token expired at '${new Date(result.exp * 1e3).toISOString()}'`);
+    const { active: _active, token_type: tokenType, username, ...members } = result;
+    const claims = { ...members };
+    if (typeof tokenType === "string" && claims.typ === void 0) claims.typ = tokenType;
+    if (typeof username === "string" && claims.preferred_username === void 0) claims.preferred_username = username;
+    if (typeof result.client_id === "string" && claims.azp === void 0) claims.azp = result.client_id;
+    const type = typeof claims.typ === "string" ? claims.typ : void 0;
+    if (rejectNonAccessTokens && type !== void 0 && type.toLowerCase() !== "bearer")
+      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`);
+    return new AuthioUser(claims, claimSettings, token);
+  };
+  const verify = async (token, signal) => {
+    if (typeof token !== "string" || !token.trim()) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Empty);
+    return introspection === "introspectionOnly" ? verifyByIntrospection(token.trim(), signal) : verifyJwt(token.trim(), signal);
+  };
+  return {
+    connection,
+    discovery,
+    audiences,
+    introspection,
+    client: client$1,
+    verify,
+    async verifyAuthorizationHeader(header, signal) {
+      const token = readBearerToken(header);
+      if (token === void 0) throw new AuthioBearerError(void 0, { error: void 0 });
+      return verify(token, signal);
+    }
+  };
+}
+function readBearerToken(header) {
+  const match = /^\s*Bearer\s+(\S+)\s*$/i.exec(header ?? "");
+  return match?.[1];
+}
+async function keyForToken(token) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token)));
+  return `token:${[...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function resolveClient(options) {
+  const given = options.client;
+  if (!given) return void 0;
+  if (isClient(given)) return given;
+  return client.createAuthioClient({
+    ...given,
+    issuer: options.issuer,
+    authority: options.authority,
+    realm: options.realm,
+    requireHttps: options.requireHttps,
+    discoveryCacheDuration: options.discoveryCacheDuration,
+    httpTimeout: options.httpTimeout,
+    fetch: options.fetch,
+    clock: options.clock
+  });
+}
+function isClient(value) {
+  return typeof value.introspect === "function" && typeof value.tokens === "object";
+}
+function describeJwtFailure(error, audiences, token) {
+  if (error instanceof jose.errors.JWTExpired) {
+    const exp = error.payload.exp;
+    return typeof exp === "number" ? `The token expired at '${new Date(exp * 1e3).toISOString()}'` : "The token has expired";
+  }
+  if (error instanceof jose.errors.JWTClaimValidationFailed) {
+    switch (error.claim) {
+      case "aud":
+        return describeAudience([error.payload.aud ?? []].flat(), audiences);
+      case "iss":
+        return `The issuer '${error.payload.iss ?? ""}' is invalid`;
+      case "nbf":
+        return typeof error.payload.nbf === "number" ? `The token is not valid before '${new Date(error.payload.nbf * 1e3).toISOString()}'` : "The token is not valid yet";
+      case "exp":
+        return "The token has no expiration";
+      default:
+        return `The token's ${error.claim} claim is invalid`;
+    }
+  }
+  if (error instanceof jose.errors.JWSSignatureVerificationFailed) return "The signature is invalid";
+  if (error instanceof jose.errors.JWKSNoMatchingKey) return "The signature key was not found";
+  if (error instanceof jose.errors.JOSEAlgNotAllowed) return `The algorithm '${algorithmOf(token)}' is not available`;
+  if (error instanceof jose.errors.JWKSTimeout || error instanceof jose.errors.JWKSInvalid) return AuthioBearerErrorDescriptions.SigningKeysUnavailable;
+  if (error instanceof jose.errors.JWTInvalid || error instanceof jose.errors.JWSInvalid) return "The token is malformed";
+  return void 0;
+}
+function describeAudience(tokenAudiences, audiences) {
+  const known = tokenAudiences.length === 0 ? "" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(" and ")}`;
+  const accepted = audiences.map((audience) => `'${audience}'`).join(" or ");
+  return audiences.length === 1 ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).` : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;
+}
+function algorithmOf(token) {
+  try {
+    return String(jose.decodeProtectedHeader(token).alg ?? "");
+  } catch {
+    return "";
+  }
+}
+function createAuthioWebhooks(options) {
+  const secrets = [...new Set([options.secret, ...options.secrets ?? []].filter((secret) => !!secret?.trim()))];
+  if (secrets.length === 0) throw new client.AuthioConfigurationError("Authio webhooks need the webhook's secret.");
+  const clock = options.clock ?? client.systemClock;
+  const tolerance = options.tolerance ?? 300;
+  const windowMs = (options.deduplicationWindow ?? 86400) * 1e3;
+  const maxBodySize = options.maxBodySize ?? 1024 * 1024;
+  const store = resolveStore(options.deduplication ?? "memory", clock);
+  const handlers = [];
+  const webhooks = {
+    maxBodySize,
+    on(type, handler) {
+      if (!type) throw new TypeError("An event type (or '*') is required.");
+      handlers.push({ type, handler });
+      return webhooks;
+    },
+    async handle(delivery) {
+      const body = typeof delivery.body === "string" ? new TextEncoder().encode(delivery.body) : delivery.body;
+      if (body.byteLength > maxBodySize) return { status: 413, reason: "too_large" };
+      const signature = headerOf(delivery.headers, client.AuthioWebhookHeaders.Signature);
+      let refusal = "no webhook secret matched";
+      for (const secret of secrets) {
+        const result = await client.verifyWebhookSignature(signature, body, secret, { tolerance, now: clock.now() });
+        if (result.valid) {
+          refusal = "";
+          break;
+        }
+        refusal = result.reason;
+      }
+      if (refusal) {
+        options.onError?.(new Error(refusal), { reason: "unsigned" });
+        return { status: 401, reason: "unsigned" };
+      }
+      const event = client.tryParseWebhookEvent(body);
+      if (!event) return { status: 400, reason: "unreadable" };
+      const eventId = headerOf(delivery.headers, client.AuthioWebhookHeaders.EventId)?.trim() || String(event.id ?? "");
+      if (eventId && !await store.tryBegin(eventId, windowMs)) return { status: 200, reason: "duplicate", event };
+      try {
+        for (const { type, handler } of handlers) if (type === "*" || type === event.type) await handler(event);
+      } catch (error) {
+        if (eventId) await store.release(eventId);
+        options.onError?.(error, { reason: "handler_failed", eventId, eventType: event.type });
+        return { status: 500, reason: "handler_failed", event };
+      }
+      return { status: 200, reason: "handled", event };
+    }
+  };
+  return webhooks;
+}
+function createMemoryDeduplicationStore(clock = client.systemClock) {
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    tryBegin(eventId, windowMs) {
+      const now = clock.now();
+      for (const [id, until2] of seen) {
+        if (until2 > now) break;
+        seen.delete(id);
+      }
+      const until = seen.get(eventId);
+      if (until !== void 0 && until > now) return false;
+      seen.delete(eventId);
+      seen.set(eventId, now + windowMs);
+      return true;
+    },
+    release(eventId) {
+      seen.delete(eventId);
+    }
+  };
+}
+function resolveStore(deduplication, clock) {
+  if (deduplication === "none") return { tryBegin: () => true, release: () => void 0 };
+  if (deduplication === "memory") return createMemoryDeduplicationStore(clock);
+  return deduplication;
+}
+function headerOf(headers, name) {
+  if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === wanted) return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+function createForwardingFetch(subject, inner = globalThis.fetch) {
+  const token = tokenOf(subject);
+  return (input, init) => {
+    if (!token) return inner(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    headers.set("authorization", `Bearer ${token}`);
+    return inner(input, { ...init, headers });
+  };
+}
+function createOnBehalfOf(options) {
+  const { client: client$1 } = options;
+  const scope = client.toScopeString(options.scopes);
+  const sortedScope = (scope ?? "").split(" ").filter(Boolean).sort().join(" ");
+  const skewMs = client.seconds(options.tokenRefreshSkew, client.AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
+  const entries = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const keyOf = async (subject) => {
+    const token = tokenOf(subject);
+    const jti = typeof subject === "string" ? void 0 : subject.tokenId;
+    return `${jti ? `jti:${jti}` : await keyForToken(token)}|${options.resource ?? ""}|${sortedScope}`;
+  };
+  const getToken = async (subject, signal) => {
+    const incoming = tokenOf(subject);
+    if (!incoming) throw new client.AuthioError("On-behalf-of needs the caller's access token, and the request has none.");
+    const key = await keyOf(subject);
+    const cached = entries.get(key);
+    if (cached && client$1.connection.clock.now() < cached.refreshAt) return cached;
+    let request = pending.get(key);
+    if (!request) {
+      request = client$1.tokens.exchange({ subjectToken: incoming, scopes: scope, resource: options.resource, signal }).then((response) => {
+        const token = client.toClientCredentialsToken(response, client$1.connection.clock.now(), skewMs);
+        entries.set(key, token);
+        return token;
+      }).finally(() => pending.delete(key));
+      pending.set(key, request);
+    }
+    return request;
+  };
+  const invalidate = async (subject, accessToken) => {
+    const key = await keyOf(subject);
+    if (accessToken === void 0 || entries.get(key)?.accessToken === accessToken) entries.delete(key);
+  };
+  return {
+    getToken,
+    invalidate,
+    fetch(subject, inner = client$1.connection.fetch) {
+      return async (input, init) => {
+        const request = new Request(input, init);
+        const body = request.body ? await request.arrayBuffer() : void 0;
+        const attempt = (token2) => {
+          const headers = new Headers(request.headers);
+          headers.set("authorization", `${token2.tokenType} ${token2.accessToken}`);
+          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });
+        };
+        const token = await getToken(subject, request.signal);
+        const response = await attempt(token);
+        if (response.status !== 401) return response;
+        await invalidate(subject, token.accessToken);
+        return attempt(await getToken(subject, request.signal));
+      };
+    }
+  };
+}
+function tokenOf(subject) {
+  if (!subject) return void 0;
+  return typeof subject === "string" ? subject : subject.token;
+}
+
+exports.AuthioBearerError = AuthioBearerError;
+exports.AuthioBearerErrorDescriptions = AuthioBearerErrorDescriptions;
+exports.AuthioForbiddenError = AuthioForbiddenError;
+exports.AuthioUser = AuthioUser;
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.authorize = authorize;
+exports.createAuthioVerifier = createAuthioVerifier;
+exports.createAuthioWebhooks = createAuthioWebhooks;
+exports.createForwardingFetch = createForwardingFetch;
+exports.createMemoryDeduplicationStore = createMemoryDeduplicationStore;
+exports.createOnBehalfOf = createOnBehalfOf;
+exports.readBearerToken = readBearerToken;
+exports.requireAuthenticationLevel = requireAuthenticationLevel;
+exports.requireAuthenticationMethod = requireAuthenticationMethod;
+exports.requireClaim = requireClaim;
+exports.requireClient = requireClient;
+exports.requireGroup = requireGroup;
+exports.requireOrganization = requireOrganization;
+exports.requirePermission = requirePermission;
+exports.requireRole = requireRole;
+exports.requireScope = requireScope;
+exports.toForbiddenChallenge = toForbiddenChallenge;
+exports.toProblemDetails = toProblemDetails;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map