@hyper.authio/server 0.0.0-stage → 0.7.0

package/dist/index.cjs

@@ -0,0 +1,913 @@
+'use strict';
+
+var client = require('@hyper.authio/client');
+
+// src/user.ts
+var accessTokenTypes = /* @__PURE__ */ new Set(["bearer", "api_key"]);
+var AuthioUser = class _AuthioUser {
+  /** `sub`: the person's id, or the credential's for a machine caller. */
+  subject;
+  /**
+   * Who called: `user` (a person signed in), `client` (a client as itself), `consumer` (a machine consumer of a
+   * client) or `account_credential` (a credential of an Authio account).
+   */
+  kind;
+  /**
+   * How a machine caller proved who it is (`client_secret`, `personal_access_token`, `api_key`,
+   * `consumer_api_key`); `undefined` for a person or a client.
+   */
+  credentialForm;
+  /** `consumer_name`, for a consumer. */
+  consumerName;
+  /** `credential_name`, for an account credential. */
+  credentialName;
+  /** `owner_user_id`: the person who made the credential. */
+  ownerUserId;
+  /**
+   * `owner_username`: the person who made the credential. On an account credential Authio wrote it to
+   * `consumer_name` before, which is read when `owner_username` is absent.
+   */
+  ownerUsername;
+  /** `credential_realm`: the one realm an account credential is limited to. */
+  credentialRealm;
+  /** `credential_client`: the one client an account credential is limited to. */
+  credentialClient;
+  /** Whether an administrator impersonates the subject. */
+  impersonated;
+  /** The administrator impersonating the subject. */
+  impersonator;
+  /** Whether a client acts for the subject through a delegation (`act` with `client_id`). */
+  delegated;
+  /** The clients acting for the subject, outermost first. */
+  actorChain;
+  /** `auth_time`, in seconds since the epoch. */
+  authTime;
+  /** The client the token was issued to (`azp`, else `client_id`). */
+  clientId;
+  /** `sid`. */
+  sessionId;
+  /** `jti`. */
+  tokenId;
+  /** `aud`. */
+  audiences;
+  /** The granted scopes. */
+  scopes;
+  /** The roles of the seven `*_resource_access` claims, with their source and permissions. */
+  resourceAccess;
+  /** Every role name: the `*_resource_access` roles, then the flat role claims. */
+  roles;
+  /** Resource → every method any role allows on it. */
+  permissions;
+  /** The group names of the group claims. */
+  groups;
+  /** `org_id`. */
+  organizationId;
+  /** `org_alias`. */
+  organizationAlias;
+  /** `account_id`. */
+  accountId;
+  /** `acr`. */
+  acr;
+  /** `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. */
+  authenticationLevel;
+  /** `amr`. */
+  authenticationMethods;
+  /** `idp`. */
+  identityProvider;
+  /** `auth_time`. */
+  authenticatedAt;
+  /** `act`. */
+  actor;
+  /** `delegation_id`. */
+  delegationId;
+  email;
+  emailVerified;
+  name;
+  preferredUsername;
+  /** `credential_type`, on a token issued to an account credential or a consumer. */
+  credentialType;
+  /** `credential_id`. */
+  credentialId;
+  /** Every claim, as the token or the introspection answer carried it. */
+  claims;
+  flatRoles;
+  /**
+   * @param claims The token's payload, or the introspection answer's members.
+   * @param settings Where flat roles and groups are read from.
+   * @param token The access token, kept for forwarding and on-behalf-of.
+   * @param source Where the claims come from: a JWT (default) or an introspection answer. An introspection answer for
+   * a consumer that reports no `exp` and no `actor_type` is the consumer's API key (Authio reports no lifetime for a
+   * key), so its `credentialForm` is `consumer_api_key`.
+   */
+  constructor(claims, settings = {}, token, source = "token") {
+    const text = (name) => typeof claims[name] === "string" && claims[name] ? claims[name] : void 0;
+    this.claims = Object.freeze({ ...claims });
+    this.subject = text(client.AuthioClaimTypes.Subject) ?? "";
+    this.clientId = text(client.AuthioClaimTypes.AuthorizedParty) ?? text(client.AuthioClaimTypes.ClientId);
+    this.sessionId = text(client.AuthioClaimTypes.SessionId);
+    this.tokenId = text(client.AuthioClaimTypes.JwtId);
+    this.audiences = Object.freeze(distinct(valuesOf(claims[client.AuthioClaimTypes.Audience])));
+    this.scopes = Object.freeze(distinct(valuesOf(claims[client.AuthioClaimTypes.Scope]).flatMap((scope) => scope.split(/\s+/)).filter(Boolean)));
+    this.resourceAccess = client.parseResourceAccess(claims);
+    this.flatRoles = Object.freeze((settings.roleClaims ?? ["role"]).flatMap((name) => valuesOf(claims[name])));
+    this.roles = Object.freeze(distinctIgnoringCase([...this.resourceAccess.roles, ...this.flatRoles]));
+    this.permissions = this.resourceAccess.permissions;
+    this.groups = Object.freeze(distinct((settings.groupClaims ?? ["groups"]).flatMap((name) => valuesOf(claims[name]))));
+    this.organizationId = text(client.AuthioClaimTypes.OrganizationId);
+    this.organizationAlias = text(client.AuthioClaimTypes.OrganizationAlias);
+    this.accountId = text(client.AuthioClaimTypes.AccountId);
+    this.acr = valuesOf(claims[client.AuthioClaimTypes.AuthenticationContextClass])[0];
+    this.authenticationLevel = this.acr !== void 0 && /^\d+$/.test(this.acr) ? Number(this.acr) : void 0;
+    this.authenticationMethods = Object.freeze(distinctIgnoringCase(valuesOf(claims[client.AuthioClaimTypes.AuthenticationMethods])));
+    this.identityProvider = text(client.AuthioClaimTypes.IdentityProvider);
+    this.authenticatedAt = toDate(claims[client.AuthioClaimTypes.AuthTime]);
+    this.actor = readActor(claims[client.AuthioClaimTypes.Actor]);
+    this.delegationId = text(client.AuthioClaimTypes.DelegationId);
+    this.email = text(client.AuthioClaimTypes.Email);
+    this.emailVerified = toBoolean(claims[client.AuthioClaimTypes.EmailVerified]);
+    this.name = text(client.AuthioClaimTypes.Name);
+    this.preferredUsername = text(client.AuthioClaimTypes.PreferredUsername);
+    this.credentialType = text(client.AuthioClaimTypes.CredentialType);
+    this.credentialId = text(client.AuthioClaimTypes.CredentialId);
+    this.authTime = toSeconds(claims[client.AuthioClaimTypes.AuthTime]);
+    this.kind = this.credentialType === "client_consumer" ? "consumer" : this.credentialType === "account_secret" ? "account_credential" : this.authTime !== void 0 ? "user" : "client";
+    const machine = this.kind === "consumer" || this.kind === "account_credential";
+    const keyIntrospected = source === "introspection" && this.kind === "consumer" && claims[client.AuthioClaimTypes.Expiration] === void 0;
+    this.credentialForm = machine ? text(client.AuthioClaimTypes.ActorType) ?? (keyIntrospected ? "consumer_api_key" : "client_secret") : void 0;
+    this.consumerName = this.kind === "consumer" ? text(client.AuthioClaimTypes.ConsumerName) : void 0;
+    this.credentialName = text(client.AuthioClaimTypes.CredentialName);
+    this.ownerUserId = text(client.AuthioClaimTypes.OwnerUserId);
+    this.ownerUsername = text(client.AuthioClaimTypes.OwnerUsername) ?? (this.kind === "account_credential" ? text(client.AuthioClaimTypes.ConsumerName) : void 0);
+    this.credentialRealm = text(client.AuthioClaimTypes.CredentialRealm);
+    this.credentialClient = text(client.AuthioClaimTypes.CredentialClient);
+    this.delegated = this.actor?.clientId !== void 0;
+    this.actorChain = Object.freeze(chainOf(this.actor));
+    this.impersonated = !this.delegated && this.actor?.subject !== void 0;
+    this.impersonator = this.impersonated ? Object.freeze({ subject: this.actor.subject, name: this.actor.name }) : void 0;
+    Object.defineProperty(this, "token", { value: token, enumerable: false });
+  }
+  /**
+   * Reads the caller from an introspection answer: `client_id` becomes `azp`, `username` becomes
+   * `preferred_username`, and `token_type` becomes `typ` unless it is `api_key` (a consumer's API key).
+   */
+  static fromIntrospection(result, settings = {}, token) {
+    return new _AuthioUser(claimsOfIntrospection(result), settings, token, "introspection");
+  }
+  /** Whether the scope was granted. */
+  hasScope(scope) {
+    return this.scopes.includes(scope);
+  }
+  /**
+   * Whether the user holds the role. Without sources, from any `*_resource_access` claim or a flat role claim; with
+   * sources, only from those `*_resource_access` claims.
+   */
+  hasRole(role, options = {}) {
+    if (!role) return false;
+    if (options.sources && options.sources.length > 0) return this.resourceAccess.hasRole(role, options.sources);
+    const wanted = role.toLowerCase();
+    return this.resourceAccess.hasRole(role) || this.flatRoles.some((name) => name.toLowerCase() === wanted);
+  }
+  /**
+   * Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on
+   * `resource`. Case-insensitive.
+   */
+  hasPermission(resource, method, options = {}) {
+    return this.resourceAccess.grants(resource, method, options.sources);
+  }
+  /** Whether the user is in the group (exact match). */
+  hasGroup(group) {
+    return this.groups.includes(group);
+  }
+  /**
+   * Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an
+   * array claim matches when any item does).
+   */
+  hasClaim(type, ...values) {
+    const present = this.claimValues(type);
+    return values.length === 0 ? present.length > 0 : present.some((value) => values.includes(value));
+  }
+  /**
+   * The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.
+   */
+  claimValues(type) {
+    return valuesOf(this.claims[type]);
+  }
+  /** Every member but the raw token. */
+  toJSON() {
+    const { flatRoles: _flatRoles, ...members } = this;
+    return { ...members, resourceAccess: this.resourceAccess.entries };
+  }
+};
+function claimsOfIntrospection(result) {
+  const { active: _active, token_type: tokenType, username, ...members } = result;
+  const claims = { ...members };
+  if (typeof tokenType === "string" && claims.typ === void 0 && tokenType.toLowerCase() !== "api_key") claims.typ = tokenType;
+  if (typeof username === "string" && claims.preferred_username === void 0) claims.preferred_username = username;
+  if (typeof result.client_id === "string" && claims.azp === void 0) claims.azp = result.client_id;
+  return claims;
+}
+function isAccessTokenType(type) {
+  return accessTokenTypes.has(type.toLowerCase());
+}
+function valuesOf(value) {
+  if (value === void 0 || value === null) return [];
+  if (Array.isArray(value)) return value.flatMap((item) => item === null || item === void 0 ? [] : [toText(item)]);
+  if (typeof value === "string" && value.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(value);
+      if (Array.isArray(parsed)) return valuesOf(parsed);
+    } catch {
+      return [value];
+    }
+  }
+  return [toText(value)];
+}
+function toText(value) {
+  return typeof value === "string" ? value : typeof value === "object" ? JSON.stringify(value) : String(value);
+}
+function readActor(value, depth = 0) {
+  let actor = value;
+  if (typeof actor === "string") {
+    try {
+      actor = JSON.parse(actor);
+    } catch {
+      return void 0;
+    }
+  }
+  if (!actor || typeof actor !== "object" || Array.isArray(actor) || depth > 16) return void 0;
+  const record = actor;
+  return Object.freeze({
+    clientId: typeof record.client_id === "string" && record.client_id ? record.client_id : void 0,
+    subject: typeof record.sub === "string" && record.sub ? record.sub : void 0,
+    name: typeof record.name === "string" && record.name ? record.name : void 0,
+    actor: readActor(record.act, depth + 1)
+  });
+}
+function chainOf(actor) {
+  const chain = [];
+  for (let current = actor; current; current = current.actor) if (current.clientId) chain.push(current.clientId);
+  return chain;
+}
+function toSeconds(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : typeof value === "string" && /^\d+$/.test(value) ? Number(value) : void 0;
+}
+function toDate(value) {
+  const seconds3 = typeof value === "number" ? value : typeof value === "string" && /^\d+$/.test(value) ? Number(value) : void 0;
+  return seconds3 === void 0 ? void 0 : new Date(seconds3 * 1e3);
+}
+function toBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function distinct(values) {
+  return [...new Set(values)];
+}
+function distinctIgnoringCase(values) {
+  const seen = /* @__PURE__ */ new Set();
+  return values.filter((value) => {
+    const key = value.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function authorize(user, ...rules) {
+  const failures = rules.map((rule) => rule.check(user)).filter((failure) => failure !== void 0);
+  if (failures.length === 0) return void 0;
+  const stepUps = failures.filter((failure) => failure.error === "insufficient_user_authentication");
+  const bearer = stepUps[0] ?? failures.find((failure) => failure.error);
+  const acrValues = strongestAcr(stepUps.map((failure) => failure.acrValues));
+  const maxAges = stepUps.map((failure) => failure.maxAge).filter((value) => value !== void 0);
+  return {
+    message: failures.map((failure) => failure.message).join(" "),
+    ...bearer?.error ? { error: bearer.error } : {},
+    ...bearer?.scope ? { scope: bearer.scope } : {},
+    ...acrValues ? { acrValues } : {},
+    ...maxAges.length > 0 ? { maxAge: Math.min(...maxAges) } : {}
+  };
+}
+function requireScope(scopes, match = "any") {
+  const required = listOf(scopes, "scope");
+  return {
+    description: `Authio scope (${match}): ${required.join(" ")}`,
+    check: (user) => satisfies(required, match, (scope) => user.hasScope(scope)) ? void 0 : {
+      message: `The token lacks the required scope (${match}): ${required.join(" ")}.`,
+      error: "insufficient_scope",
+      scope: required.join(" ")
+    }
+  };
+}
+function requireRole(roles, options = {}) {
+  const required = listOf(roles, "role");
+  const match = options.match ?? "any";
+  const from = describeSources(options.sources);
+  return {
+    description: `Authio role (${match}): ${required.join(", ")}${from}`,
+    check: (user) => satisfies(required, match, (role) => user.hasRole(role, { sources: options.sources })) ? void 0 : { message: `The caller lacks the required role (${match}): ${required.join(", ")}${from}.` }
+  };
+}
+function requirePermission(resource, method, options = {}) {
+  if (!resource?.trim() || !method?.trim()) throw new TypeError("A permission needs a resource and a method.");
+  const from = describeSources(options.sources);
+  return {
+    description: `Authio permission: ${resource}:${method}${from}`,
+    check: (user) => user.hasPermission(resource, method, { sources: options.sources }) ? void 0 : { message: `The caller lacks the permission ${resource}:${method}${from}.` }
+  };
+}
+function requireGroup(groups, match = "any") {
+  const required = listOf(groups, "group");
+  return {
+    description: `Authio group (${match}): ${required.join(", ")}`,
+    check: (user) => satisfies(required, match, (group) => user.hasGroup(group)) ? void 0 : { message: `The caller is not in the required group (${match}): ${required.join(", ")}.` }
+  };
+}
+function requireClaim(type, ...values) {
+  if (!type?.trim()) throw new TypeError("A claim rule needs a claim type.");
+  return {
+    description: values.length === 0 ? `Authio claim: ${type}` : `Authio claim: ${type} in ${values.join(", ")}`,
+    check: (user) => user.hasClaim(type, ...values) ? void 0 : { message: values.length === 0 ? `The token lacks the claim ${type}.` : `The token's claim ${type} is not one of: ${values.join(", ")}.` }
+  };
+}
+function requireOrganization(organization) {
+  const wanted = organization?.trim() || void 0;
+  return {
+    description: `Authio organization: ${wanted ?? "any"}`,
+    check: (user) => {
+      const satisfied = !!user.organizationId && (!wanted || user.organizationAlias?.toLowerCase() === wanted.toLowerCase() || user.organizationId.toLowerCase() === wanted.toLowerCase());
+      return satisfied ? void 0 : { message: wanted ? `The token is not in the organization ${wanted}.` : "The token has no organization context." };
+    }
+  };
+}
+function requireAuthenticationLevel(minimumLevel, options = {}) {
+  if (!Number.isInteger(minimumLevel) || minimumLevel < 0) throw new RangeError("The minimum level must be a non-negative integer.");
+  const recency = options.maxAge === void 0 ? void 0 : requireRecentAuthentication(options.maxAge, { clock: options.clock });
+  return {
+    description: `Authio authentication level >= ${minimumLevel}${recency ? `, ${recency.description}` : ""}`,
+    check: (user) => {
+      const levelMet = user.authenticationLevel !== void 0 && user.authenticationLevel >= minimumLevel;
+      const recent = recency?.check(user);
+      if (levelMet && !recent) return void 0;
+      return {
+        message: [levelMet ? void 0 : `The authentication level must be at least ${minimumLevel}.`, recent?.message].filter(Boolean).join(" "),
+        error: "insufficient_user_authentication",
+        acrValues: String(minimumLevel),
+        ...options.maxAge !== void 0 ? { maxAge: options.maxAge } : {}
+      };
+    }
+  };
+}
+var methodLevels = { mfa: "2", otp: "2", mca: "2", sms: "2", swk: "3", hwk: "3" };
+function requireAuthenticationMethod(methods, match = "any", options = {}) {
+  const required = listOf(methods, "authentication method");
+  const levels = required.map((method) => methodLevels[method.toLowerCase()]).filter((level) => level !== void 0);
+  const acrValues = options.acrValues ?? (levels.length === 0 ? void 0 : match === "all" ? strongestAcr(levels) : weakestAcr(levels));
+  return {
+    description: `Authio authentication method (${match}): ${required.join(", ")}`,
+    check: (user) => {
+      const used = user.authenticationMethods.map((method) => method.toLowerCase());
+      return satisfies(required, match, (method) => used.includes(method.toLowerCase())) ? void 0 : {
+        message: `The user must authenticate with (${match}): ${required.join(", ")}.`,
+        error: "insufficient_user_authentication",
+        ...acrValues ? { acrValues } : {}
+      };
+    }
+  };
+}
+function requireRecentAuthentication(maxAge, options = {}) {
+  if (!Number.isInteger(maxAge) || maxAge < 0) throw new RangeError("maxAge must be a non-negative whole number of seconds.");
+  const clock = options.clock ?? client.systemClock;
+  return {
+    description: `Authio sign-in at most ${maxAge} s old`,
+    check: (user) => user.authTime !== void 0 && clock.now() - user.authTime * 1e3 <= maxAge * 1e3 ? void 0 : {
+      message: user.authTime === void 0 ? `The token carries no sign-in time; a sign-in at most ${maxAge} seconds old is required.` : `The sign-in must be at most ${maxAge} seconds old.`,
+      error: "insufficient_user_authentication",
+      maxAge
+    }
+  };
+}
+function requireCallerKind(kinds) {
+  const required = listOf(kinds, "caller kind");
+  return {
+    description: `Authio caller kind: ${required.join(", ")}`,
+    check: (user) => required.includes(user.kind) ? void 0 : { message: `The caller is a ${user.kind}, not one of: ${required.join(", ")}.` }
+  };
+}
+function requireClient(clientIds) {
+  const required = listOf(clientIds, "client id");
+  return {
+    description: `Authio client: ${required.join(", ")}`,
+    check: (user) => user.clientId !== void 0 && required.includes(user.clientId) ? void 0 : { message: `The token was not issued to an accepted client (${required.join(", ")}).` }
+  };
+}
+function allOf(...rules) {
+  return {
+    description: rules.map((rule) => rule.description).join(" and "),
+    check: (user) => authorize(user, ...rules)
+  };
+}
+function anyOf(...rules) {
+  if (rules.length === 0) throw new TypeError("anyOf needs at least one rule.");
+  return {
+    description: rules.map((rule) => rule.description).join(" or "),
+    check: (user) => {
+      const failures = rules.map((rule) => rule.check(user));
+      return failures.some((failure) => failure === void 0) ? void 0 : failures[0];
+    }
+  };
+}
+function listOf(values, name) {
+  const list = [...new Set((typeof values === "string" ? [values] : [...values]).filter((value) => value?.trim()))];
+  if (list.length === 0) throw new TypeError(`At least one ${name} is required.`);
+  return list;
+}
+function satisfies(required, match, holds) {
+  return match === "all" ? required.every(holds) : required.some(holds);
+}
+function strongestAcr(values) {
+  return rankAcr(values, (left, right) => right - left);
+}
+function weakestAcr(values) {
+  return rankAcr(values, (left, right) => left - right);
+}
+function rankAcr(values, order) {
+  const known = values.filter((value) => !!value);
+  const numeric = known.filter((value) => /^\d+$/.test(value)).sort((left, right) => order(Number(left), Number(right)));
+  return numeric[0] ?? known[0];
+}
+function describeSources(sources) {
+  return sources && sources.length > 0 ? ` from ${[...new Set(sources)].join(", ")}` : "";
+}
+var AuthioBearerError = class _AuthioBearerError extends client.AuthioError {
+  status = 401;
+  /** `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). */
+  error;
+  /** Why the token was refused, safe to send to the caller. */
+  description;
+  /** Why the token was refused, as a stable code; `undefined` when there was no token or Authio could not be asked. */
+  reason;
+  /** The API's protected resource metadata URL (RFC 9728), sent as `resource_metadata` when configured. */
+  resourceMetadata;
+  constructor(description, options = {}) {
+    super(description ?? "A valid Authio access token is required.", { cause: options.cause });
+    this.error = "error" in options ? options.error : "invalid_token";
+    this.description = description === void 0 ? void 0 : toHeaderText(description);
+    this.reason = options.reason;
+    this.resourceMetadata = options.resourceMetadata;
+  }
+  /** The same refusal, pointing at the API's protected resource metadata. */
+  withResourceMetadata(resourceMetadata) {
+    if (!resourceMetadata || resourceMetadata === this.resourceMetadata) return this;
+    return new _AuthioBearerError(this.description, { error: this.error, cause: this.cause, reason: this.reason, resourceMetadata });
+  }
+  /** The `WWW-Authenticate` value. */
+  get wwwAuthenticate() {
+    const parameters = [];
+    if (this.error) parameters.push(`error="${this.error}"`);
+    if (this.error && this.description) parameters.push(`error_description="${this.description}"`);
+    if (this.resourceMetadata) parameters.push(`resource_metadata="${escapeQuoted(this.resourceMetadata)}"`);
+    return parameters.length === 0 ? "Bearer" : `Bearer ${parameters.join(", ")}`;
+  }
+};
+var AuthioForbiddenError = class extends client.AuthioError {
+  status = 403;
+  failure;
+  constructor(failure) {
+    super(failure.message);
+    this.failure = failure;
+  }
+  /** The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. */
+  get wwwAuthenticate() {
+    return toForbiddenChallenge(this.failure);
+  }
+};
+function toForbiddenChallenge(failure) {
+  if (!failure.error) return void 0;
+  const parameters = [`error="${failure.error}"`, `error_description="${escapeQuoted(toHeaderText(failure.message))}"`];
+  if (failure.scope) parameters.push(`scope="${escapeQuoted(failure.scope)}"`);
+  if (failure.acrValues) parameters.push(`acr_values="${escapeQuoted(failure.acrValues)}"`);
+  if (failure.maxAge !== void 0) parameters.push(`max_age=${failure.maxAge}`);
+  return `Bearer ${parameters.join(", ")}`;
+}
+function toProblemDetails(error) {
+  if (error instanceof AuthioBearerError)
+    return {
+      type: "https://tools.ietf.org/html/rfc9110#section-15.5.2",
+      title: "Unauthorized",
+      status: 401,
+      detail: "A valid Authio access token is required."
+    };
+  return {
+    type: "https://tools.ietf.org/html/rfc9110#section-15.5.4",
+    title: "Forbidden",
+    status: 403,
+    detail: error.failure.message || "The caller is not allowed to access this resource.",
+    ...error.failure.error ? { error: error.failure.error } : {},
+    ...error.failure.scope ? { scope: error.failure.scope } : {},
+    ...error.failure.acrValues ? { acr_values: error.failure.acrValues } : {},
+    ...error.failure.maxAge !== void 0 ? { max_age: error.failure.maxAge } : {}
+  };
+}
+function toHeaderText(text) {
+  return [...text].map((character) => character >= " " && character <= "~" && character !== '"' && character !== "\\" ? character : "?").join("");
+}
+function escapeQuoted(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function protectedResourceMetadataUrl(resource) {
+  const url = parseResource(resource);
+  const path = url.pathname.replace(/\/+$/, "");
+  return `${url.origin}${client.AuthioDefaults.ProtectedResourceMetadataPath}${path}`;
+}
+function protectedResourceMetadataPath(resource) {
+  return new URL(protectedResourceMetadataUrl(resource)).pathname;
+}
+function createProtectedResourceMetadata(options) {
+  parseResource(options.resource);
+  const document = {
+    ...options.extra,
+    resource: options.resource,
+    authorization_servers: [client.resolveIssuer(options)],
+    bearer_methods_supported: ["header"]
+  };
+  if (options.scopesSupported && options.scopesSupported.length > 0) document.scopes_supported = [...options.scopesSupported];
+  if (options.resourceName) document.resource_name = options.resourceName;
+  if (options.resourceDocumentation) document.resource_documentation = options.resourceDocumentation;
+  return document;
+}
+function parseResource(resource) {
+  let url;
+  try {
+    url = new URL(resource);
+  } catch (error) {
+    throw new client.AuthioConfigurationError(`The resource '${resource}' is not an absolute URL.`, { cause: error });
+  }
+  if (url.hash) throw new client.AuthioConfigurationError(`The resource '${resource}' must not carry a fragment (RFC 8707).`);
+  return url;
+}
+
+// src/verifier.ts
+var AuthioBearerErrorDescriptions = {
+  Inactive: "Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.",
+  Unconfirmed: "Authio could not be reached to confirm that the token is active.",
+  Empty: "The token is empty.",
+  Encrypted: "The token is encrypted; set clientEncryptionKey to decrypt it, or validate it with introspection ('introspectionOnly').",
+  SigningKeysUnavailable: "Authio could not be reached to read its signing keys."
+};
+var maxCachedAnswers = 1e4;
+function createAuthioVerifier(options) {
+  const resource = options.resource?.trim() || void 0;
+  const given = typeof options.audiences === "string" ? [options.audiences] : [...options.audiences ?? []];
+  const audiences = [...new Set([...given, ...resource ? [resource] : []].filter((value) => value?.trim()))];
+  if (audiences.length === 0)
+    throw new client.AuthioConfigurationError("The Authio verifier needs at least one audience: the API's resource identifier or client id.");
+  const connection = client.resolveConnection(options);
+  const discovery = client.createAuthioDiscoveryClient(connection);
+  const introspection = options.introspection ?? "none";
+  const client$1 = resolveClient(options);
+  if (introspection !== "none" && !client$1)
+    throw new client.AuthioConfigurationError(
+      `Authio introspection ('${introspection}') needs the API's confidential client: pass options.client with its clientId and clientSecret or private key.`
+    );
+  const resourceMetadataUrl = resolveResourceMetadata(options.resourceMetadata, resource);
+  const cacheDurationMs = client.seconds(options.introspectionCacheDuration, 30, "introspectionCacheDuration");
+  const clockSkew = client.seconds(options.clockSkew, 30, "clockSkew") / 1e3;
+  const algorithms = options.validAlgorithms && options.validAlgorithms.length > 0 ? [...options.validAlgorithms] : void 0;
+  const rejectNonAccessTokens = options.rejectNonAccessTokens ?? true;
+  const claimSettings = { roleClaims: options.roleClaims, groupClaims: options.groupClaims };
+  const cache = /* @__PURE__ */ new Map();
+  const signingKeys = client.createAuthioSigningKeys(connection, discovery);
+  const encryptionKey = options.clientEncryptionKey ?? (options.clientEncryptionKeyPath ? client.encryptionKeyFromFile(options.clientEncryptionKeyPath) : void 0);
+  const decrypt = encryptionKey === void 0 ? void 0 : client.createAuthioTokenDecrypter(encryptionKey, {
+    setting: options.clientEncryptionKey === void 0 ? "clientEncryptionKeyPath" : "clientEncryptionKey",
+    allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms
+  });
+  const requiredScopes = Object.freeze([...new Set((options.requiredScopes ?? []).filter((scope) => scope?.trim()))]);
+  const introspect = async (token, key, signal) => {
+    const now = connection.clock.now();
+    const cached = cache.get(key);
+    if (cached && cached.until > now) return cached.result;
+    cache.delete(key);
+    const result = await client$1.introspect(token, { tokenTypeHint: client.AuthioTokenTypes.AccessToken, signal });
+    if (!result.active) return void 0;
+    const until = Math.min(now + cacheDurationMs, typeof result.exp === "number" ? result.exp * 1e3 : Number.POSITIVE_INFINITY);
+    if (until > now) {
+      if (cache.size >= maxCachedAnswers) cache.delete(cache.keys().next().value);
+      cache.set(key, { result, until });
+    }
+    return result;
+  };
+  const verifyJwt = async (token, signal) => {
+    let signed = token;
+    if (client.isAuthioTokenEncrypted(token)) {
+      if (!decrypt) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Encrypted, { reason: "decryption_failed" });
+      try {
+        signed = await decrypt(token);
+      } catch (error) {
+        if (error instanceof client.AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });
+        throw error;
+      }
+    }
+    let keySet;
+    try {
+      keySet = await signingKeys(signal);
+    } catch (error) {
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.SigningKeysUnavailable, { cause: error, reason: "signing_keys_unavailable" });
+    }
+    let payload;
+    try {
+      ({ payload } = await client.verifyAuthioJwt(signed, keySet, {
+        issuer: connection.issuer,
+        audiences,
+        algorithms,
+        clockSkew,
+        now: connection.clock.now()
+      }));
+    } catch (error) {
+      if (error instanceof client.AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });
+      throw error;
+    }
+    const type = typeof payload.typ === "string" ? payload.typ : void 0;
+    if (rejectNonAccessTokens && type !== void 0 && type.toLowerCase() !== "bearer")
+      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: "not_access_token" });
+    if (introspection === "activeCheck") await confirmActive(token, payload, signal);
+    return new AuthioUser(payload, claimSettings, token);
+  };
+  const confirmActive = async (token, payload, signal) => {
+    const key = payload.jti ? `jti:${payload.jti}` : await keyForToken(token);
+    let result;
+    try {
+      result = await introspect(token, key, signal);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: "unconfirmed" });
+    }
+    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: "inactive" });
+  };
+  const verifyByIntrospection = async (token, signal) => {
+    let result;
+    try {
+      result = await introspect(token, await keyForToken(token), signal);
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: "unconfirmed" });
+    }
+    if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: "inactive" });
+    if (result.iss && result.iss !== connection.issuer) throw new AuthioBearerError(`The issuer '${result.iss}' is invalid`, { reason: "invalid_issuer" });
+    const tokenAudiences = [result.aud ?? []].flat();
+    if (!tokenAudiences.some((audience) => audiences.includes(audience)))
+      throw new AuthioBearerError(describeAudience(tokenAudiences, audiences), { reason: "invalid_audience" });
+    if (typeof result.exp === "number" && (result.exp + clockSkew) * 1e3 <= connection.clock.now())
+      throw new AuthioBearerError(`The token expired at '${new Date(result.exp * 1e3).toISOString()}'`, { reason: "expired" });
+    const claims = claimsOfIntrospection(result);
+    const type = typeof claims.typ === "string" ? claims.typ : void 0;
+    if (rejectNonAccessTokens && type !== void 0 && !isAccessTokenType(type))
+      throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: "not_access_token" });
+    return new AuthioUser(claims, claimSettings, token, "introspection");
+  };
+  const verify = async (token, signal) => {
+    try {
+      if (typeof token !== "string" || !token.trim()) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Empty, { reason: "malformed" });
+      return introspection === "introspectionOnly" ? await verifyByIntrospection(token.trim(), signal) : await verifyJwt(token.trim(), signal);
+    } catch (error) {
+      throw error instanceof AuthioBearerError ? error.withResourceMetadata(resourceMetadataUrl) : error;
+    }
+  };
+  return {
+    connection,
+    discovery,
+    audiences,
+    resource,
+    resourceMetadataUrl,
+    requiredScopes,
+    introspection,
+    client: client$1,
+    verify,
+    async verifyAuthorizationHeader(header, signal) {
+      const token = readBearerToken(header);
+      if (token === void 0) throw new AuthioBearerError(void 0, { error: void 0, resourceMetadata: resourceMetadataUrl });
+      return verify(token, signal);
+    }
+  };
+}
+function readBearerToken(header) {
+  const match = /^\s*Bearer\s+(\S+)\s*$/i.exec(header ?? "");
+  return match?.[1];
+}
+async function keyForToken(token) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token)));
+  return `token:${[...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function resolveResourceMetadata(setting, resource) {
+  if (!setting) return void 0;
+  if (typeof setting === "string") return setting;
+  if (!resource)
+    throw new client.AuthioConfigurationError("resourceMetadata: true needs the API's resource identifier: set options.resource, or pass the metadata URL.");
+  return protectedResourceMetadataUrl(resource);
+}
+function resolveClient(options) {
+  const given = options.client;
+  if (!given) return void 0;
+  if (isClient(given)) return given;
+  return client.createAuthioClient({
+    ...given,
+    issuer: options.issuer,
+    authority: options.authority,
+    realm: options.realm,
+    requireHttps: options.requireHttps,
+    discoveryCacheDuration: options.discoveryCacheDuration,
+    httpTimeout: options.httpTimeout,
+    fetch: options.fetch,
+    clock: options.clock
+  });
+}
+function isClient(value) {
+  return typeof value.introspect === "function" && typeof value.tokens === "object";
+}
+function describeAudience(tokenAudiences, audiences) {
+  const known = tokenAudiences.length === 0 ? "" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(" and ")}`;
+  const accepted = audiences.map((audience) => `'${audience}'`).join(" or ");
+  return audiences.length === 1 ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).` : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;
+}
+function createAuthioWebhooks(options) {
+  const secrets = [...new Set([options.secret, ...options.secrets ?? []].filter((secret) => !!secret?.trim()))];
+  if (secrets.length === 0) throw new client.AuthioConfigurationError("Authio webhooks need the webhook's secret.");
+  const clock = options.clock ?? client.systemClock;
+  const tolerance = options.tolerance ?? 300;
+  const windowMs = (options.deduplicationWindow ?? 86400) * 1e3;
+  const maxBodySize = options.maxBodySize ?? 1024 * 1024;
+  const store = resolveStore(options.deduplication ?? "memory", clock);
+  const handlers = [];
+  const webhooks = {
+    maxBodySize,
+    on(type, handler) {
+      if (!type) throw new TypeError("An event type (or '*') is required.");
+      handlers.push({ type, handler });
+      return webhooks;
+    },
+    async handle(delivery) {
+      const body = typeof delivery.body === "string" ? new TextEncoder().encode(delivery.body) : delivery.body;
+      if (body.byteLength > maxBodySize) return { status: 413, reason: "too_large" };
+      const signature = headerOf(delivery.headers, client.AuthioWebhookHeaders.Signature);
+      let refusal = "no webhook secret matched";
+      for (const secret of secrets) {
+        const result = await client.verifyWebhookSignature(signature, body, secret, { tolerance, now: clock.now() });
+        if (result.valid) {
+          refusal = "";
+          break;
+        }
+        refusal = result.reason;
+      }
+      if (refusal) {
+        options.onError?.(new Error(refusal), { reason: "unsigned" });
+        return { status: 401, reason: "unsigned" };
+      }
+      const event = client.tryParseWebhookEvent(body);
+      if (!event) return { status: 400, reason: "unreadable" };
+      const eventId = headerOf(delivery.headers, client.AuthioWebhookHeaders.EventId)?.trim() || String(event.id ?? "");
+      if (eventId && !await store.tryBegin(eventId, windowMs)) return { status: 200, reason: "duplicate", event };
+      try {
+        for (const { type, handler } of handlers) if (type === "*" || type === event.type) await handler(event);
+      } catch (error) {
+        if (eventId) await store.release(eventId);
+        options.onError?.(error, { reason: "handler_failed", eventId, eventType: event.type });
+        return { status: 500, reason: "handler_failed", event };
+      }
+      return { status: 200, reason: "handled", event };
+    }
+  };
+  return webhooks;
+}
+function createMemoryDeduplicationStore(clock = client.systemClock) {
+  const seen = /* @__PURE__ */ new Map();
+  return {
+    tryBegin(eventId, windowMs) {
+      const now = clock.now();
+      for (const [id, until2] of seen) {
+        if (until2 > now) break;
+        seen.delete(id);
+      }
+      const until = seen.get(eventId);
+      if (until !== void 0 && until > now) return false;
+      seen.delete(eventId);
+      seen.set(eventId, now + windowMs);
+      return true;
+    },
+    release(eventId) {
+      seen.delete(eventId);
+    }
+  };
+}
+function resolveStore(deduplication, clock) {
+  if (deduplication === "none") return { tryBegin: () => true, release: () => void 0 };
+  if (deduplication === "memory") return createMemoryDeduplicationStore(clock);
+  return deduplication;
+}
+function headerOf(headers, name) {
+  if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === wanted) return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+function createForwardingFetch(subject, inner = globalThis.fetch) {
+  const token = tokenOf(subject);
+  return (input, init) => {
+    if (!token) return inner(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    headers.set("authorization", `Bearer ${token}`);
+    return inner(input, { ...init, headers });
+  };
+}
+function createOnBehalfOf(options) {
+  const { client: client$1 } = options;
+  const scope = client.toScopeString(options.scopes);
+  const sortedScope = (scope ?? "").split(" ").filter(Boolean).sort().join(" ");
+  const skewMs = client.seconds(options.tokenRefreshSkew, client.AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
+  const entries = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const keyOf = async (subject) => {
+    const token = tokenOf(subject);
+    const jti = typeof subject === "string" ? void 0 : subject.tokenId;
+    return `${jti ? `jti:${jti}` : await keyForToken(token)}|${options.resource ?? ""}|${sortedScope}`;
+  };
+  const getToken = async (subject, signal) => {
+    const incoming = tokenOf(subject);
+    if (!incoming) throw new client.AuthioError("On-behalf-of needs the caller's access token, and the request has none.");
+    const key = await keyOf(subject);
+    const cached = entries.get(key);
+    if (cached && client$1.connection.clock.now() < cached.refreshAt) return cached;
+    let request = pending.get(key);
+    if (!request) {
+      request = client$1.tokens.exchange({ subjectToken: incoming, scopes: scope, resource: options.resource, signal }).then((response) => {
+        const token = client.toClientCredentialsToken(response, client$1.connection.clock.now(), skewMs);
+        entries.set(key, token);
+        return token;
+      }).finally(() => pending.delete(key));
+      pending.set(key, request);
+    }
+    return request;
+  };
+  const invalidate = async (subject, accessToken) => {
+    const key = await keyOf(subject);
+    if (accessToken === void 0 || entries.get(key)?.accessToken === accessToken) entries.delete(key);
+  };
+  return {
+    getToken,
+    invalidate,
+    fetch(subject, inner = client$1.connection.fetch) {
+      return async (input, init) => {
+        const request = new Request(input, init);
+        const body = request.body ? await request.arrayBuffer() : void 0;
+        const attempt = (token2) => {
+          const headers = new Headers(request.headers);
+          headers.set("authorization", `${token2.tokenType} ${token2.accessToken}`);
+          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });
+        };
+        const token = await getToken(subject, request.signal);
+        const response = await attempt(token);
+        if (response.status !== 401) return response;
+        await invalidate(subject, token.accessToken);
+        return attempt(await getToken(subject, request.signal));
+      };
+    }
+  };
+}
+function tokenOf(subject) {
+  if (!subject) return void 0;
+  return typeof subject === "string" ? subject : subject.token;
+}
+
+exports.AuthioBearerError = AuthioBearerError;
+exports.AuthioBearerErrorDescriptions = AuthioBearerErrorDescriptions;
+exports.AuthioForbiddenError = AuthioForbiddenError;
+exports.AuthioUser = AuthioUser;
+exports.allOf = allOf;
+exports.anyOf = anyOf;
+exports.authorize = authorize;
+exports.createAuthioVerifier = createAuthioVerifier;
+exports.createAuthioWebhooks = createAuthioWebhooks;
+exports.createForwardingFetch = createForwardingFetch;
+exports.createMemoryDeduplicationStore = createMemoryDeduplicationStore;
+exports.createOnBehalfOf = createOnBehalfOf;
+exports.createProtectedResourceMetadata = createProtectedResourceMetadata;
+exports.protectedResourceMetadataPath = protectedResourceMetadataPath;
+exports.protectedResourceMetadataUrl = protectedResourceMetadataUrl;
+exports.readBearerToken = readBearerToken;
+exports.requireAuthenticationLevel = requireAuthenticationLevel;
+exports.requireAuthenticationMethod = requireAuthenticationMethod;
+exports.requireCallerKind = requireCallerKind;
+exports.requireClaim = requireClaim;
+exports.requireClient = requireClient;
+exports.requireGroup = requireGroup;
+exports.requireOrganization = requireOrganization;
+exports.requirePermission = requirePermission;
+exports.requireRecentAuthentication = requireRecentAuthentication;
+exports.requireRole = requireRole;
+exports.requireScope = requireScope;
+exports.toForbiddenChallenge = toForbiddenChallenge;
+exports.toProblemDetails = toProblemDetails;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map