@incorta/auth 1.6.0 → 1.7.0

package/README.md

@@ -45,6 +45,46 @@ use it when the public `incortaUrl` is not routable from the app — e.g.
 `http://host.docker.internal:8080/incorta` from a local container; the
 authorize redirect and issuer validation stay on the public URL).
 
+## App access policy (`appAccess` / `INCORTA_APP_ACCESS`)
+
+Who may use the app, enforced by the whole-app gate:
+
+- `public` — anyone with the URL, signed in or not. The gate is inert for app
+  routes; the auth routes stay mounted, so signing in remains possible and
+  sessions become optional (handle `session == null`).
+- `authenticated` (default) — any signed-in Incorta user. Exactly the
+  pre-policy behavior, and what an absent/unknown `INCORTA_APP_ACCESS` means
+  (unknown values warn and fall back here — never to `public`).
+- `catalog` — signed in AND at least VIEW access to this app in the Incorta
+  catalog. The SDK asks `GET {incortaUrl}/apps-catalog/check` with the
+  session's own access token; Incorta resolves which app the token belongs to
+  from the OAuth client registration's `(incorta-app:<id>)` name suffix
+  (written once, server-side, at registration), so the endpoint can
+  only ever answer about this app. Verdicts (allow and deny) are cached 30s
+  per user; apps not registered in the catalog stay open to authenticated
+  users (legacy-open). When Incorta cannot answer, the gate fails CLOSED with
+  a distinct 503 "temporarily unavailable" page (failures are not cached).
+
+Enforcement surfaces:
+
+- `auth.gate(request): Promise<Response | null>` — the whole-app gate: serve
+  the `Response` when non-null (auth routes, login redirects, the 403
+  access-denied page — which names the signed-in user and offers a
+  switch-account logout — or the 503 page), continue to your app on `null`.
+- `@incorta/auth/express`: `appGate(auth)` middleware is `auth.gate` for
+  Express/Connect. `requireAuth(auth)` always demands a session regardless of
+  policy (an explicit route guard is the author's promise), and under
+  `catalog` additionally requires VIEW, attaching the verdict as
+  `req.incortaAuth.appAccess`.
+- `auth.getAppAccess(session): Promise<AppAccess>` — the cached verdict
+  (`registered`, `access` bitmask, `canView`, `canEdit`, `allowed`) for
+  permission-aware UX in any mode.
+
+`GET {basePath}/refresh?redirect_to=` supports the catalog gate: it refreshes
+an expired access token through a browser round trip (persisting the rotated
+refresh-token cookie) and bounces back — the gate sends navigations there
+instead of calling Incorta with a token it knows is expired.
+
 ## Session model
 
 The cookie is an encrypted JWT (JWE `dir`/`A256GCM`, key derived from

package/dist/{config-DmeXKgtO.d.cts → app-access-BSsKtvbi.d.cts}

@@ -112,6 +112,23 @@ interface IncortaAuthConfig {
      * @default false
      */
     exposeAccessToken?: boolean;
+    /**
+     * Who may use the app — enforced by the whole-app gate (`auth.gate`, and
+     * the framework middlewares built on it):
+     *
+     * - `"public"`: anyone with the URL, signed in or not (login stays
+     *   available, sessions become optional);
+     * - `"authenticated"` (default): any signed-in Incorta user;
+     * - `"catalog"`: signed-in AND at least VIEW access to this app in the
+     *   Incorta catalog, verified against `/apps-catalog/check` with a 30s
+     *   per-user cache. Unregistered apps stay open to authenticated users
+     *   (legacy-open); an unanswerable check fails CLOSED (503).
+     *
+     * Normally stamped by the Incorta Apps platform via `INCORTA_APP_ACCESS`.
+     * An unrecognized env value falls back to `"authenticated"` (never to
+     * `"public"` — a typo must not open the app) with a console warning.
+     */
+    appAccess?: AppAccessPolicy;
     /**
      * How to sign in when the app runs inside a cross-site iframe (the Incorta
      * builder preview). `"redirect"` (default) bounces the frame to Incorta —
@@ -152,6 +169,7 @@ interface ResolvedConfig {
     cookieSameSite: "lax" | "none";
     cookiePartitioned: boolean;
     exposeAccessToken: boolean;
+    appAccess: AppAccessPolicy;
     embeddedSignIn: "redirect" | "new-tab";
     /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
     issuer: string;
@@ -160,4 +178,43 @@ interface ResolvedConfig {
     fetch: typeof fetch;
 }
 
-export type { IncortaAuthConfig as I, ResolvedConfig as R, SessionInfo as S, IncortaUser as a, SessionData as b };
+/**
+ * Platform-stamped access policy for the app (`INCORTA_APP_ACCESS`):
+ *
+ * - `"public"`       — anyone with the URL; the whole-app gate is inert
+ *                      (login routes stay mounted, sessions are optional);
+ * - `"authenticated"`— any signed-in Incorta user (the pre-policy behavior,
+ *                      and the default when the platform stamped nothing);
+ * - `"catalog"`      — signed-in AND at least VIEW access to this app in the
+ *                      Incorta catalog (`/apps-catalog/check`).
+ */
+type AppAccessPolicy = "public" | "authenticated" | "catalog";
+/** Incorta permission bits (com.incorta.api.Action). */
+declare const VIEW_BIT = 1;
+declare const SHARE_BIT = 2;
+declare const EDIT_BIT = 4;
+/** The catalog's verdict about the session user's access to THIS app. */
+interface AppAccess {
+    /**
+     * The app is registered in the Incorta catalog. `false` means it predates
+     * the catalog integration — the gate treats it as legacy-open (any
+     * authenticated tenant user may enter).
+     */
+    registered: boolean;
+    /** Effective Incorta permission bitmask (VIEW=1, SHARE=2, EDIT=4). */
+    access: number;
+    canView: boolean;
+    canEdit: boolean;
+    /** What the runtime gate enforces: unregistered (legacy-open) or ≥ VIEW. */
+    allowed: boolean;
+}
+/** Incorta could not answer (unreachable, 5xx, disabled) — gates fail CLOSED. */
+declare class AppAccessUnavailableError extends Error {
+    constructor(cause: string);
+}
+/** Incorta rejected the session's access token (expired/revoked) — re-login. */
+declare class AppAccessTokenRejectedError extends Error {
+    constructor();
+}
+
+export { type AppAccess as A, EDIT_BIT as E, type IncortaAuthConfig as I, type ResolvedConfig as R, type SessionInfo as S, VIEW_BIT as V, type AppAccessPolicy as a, AppAccessTokenRejectedError as b, AppAccessUnavailableError as c, type IncortaUser as d, SHARE_BIT as e, type SessionData as f };

package/dist/{config-DmeXKgtO.d.ts → app-access-BSsKtvbi.d.ts}

@@ -112,6 +112,23 @@ interface IncortaAuthConfig {
      * @default false
      */
     exposeAccessToken?: boolean;
+    /**
+     * Who may use the app — enforced by the whole-app gate (`auth.gate`, and
+     * the framework middlewares built on it):
+     *
+     * - `"public"`: anyone with the URL, signed in or not (login stays
+     *   available, sessions become optional);
+     * - `"authenticated"` (default): any signed-in Incorta user;
+     * - `"catalog"`: signed-in AND at least VIEW access to this app in the
+     *   Incorta catalog, verified against `/apps-catalog/check` with a 30s
+     *   per-user cache. Unregistered apps stay open to authenticated users
+     *   (legacy-open); an unanswerable check fails CLOSED (503).
+     *
+     * Normally stamped by the Incorta Apps platform via `INCORTA_APP_ACCESS`.
+     * An unrecognized env value falls back to `"authenticated"` (never to
+     * `"public"` — a typo must not open the app) with a console warning.
+     */
+    appAccess?: AppAccessPolicy;
     /**
      * How to sign in when the app runs inside a cross-site iframe (the Incorta
      * builder preview). `"redirect"` (default) bounces the frame to Incorta —
@@ -152,6 +169,7 @@ interface ResolvedConfig {
     cookieSameSite: "lax" | "none";
     cookiePartitioned: boolean;
     exposeAccessToken: boolean;
+    appAccess: AppAccessPolicy;
     embeddedSignIn: "redirect" | "new-tab";
     /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
     issuer: string;
@@ -160,4 +178,43 @@ interface ResolvedConfig {
     fetch: typeof fetch;
 }
 
-export type { IncortaAuthConfig as I, ResolvedConfig as R, SessionInfo as S, IncortaUser as a, SessionData as b };
+/**
+ * Platform-stamped access policy for the app (`INCORTA_APP_ACCESS`):
+ *
+ * - `"public"`       — anyone with the URL; the whole-app gate is inert
+ *                      (login routes stay mounted, sessions are optional);
+ * - `"authenticated"`— any signed-in Incorta user (the pre-policy behavior,
+ *                      and the default when the platform stamped nothing);
+ * - `"catalog"`      — signed-in AND at least VIEW access to this app in the
+ *                      Incorta catalog (`/apps-catalog/check`).
+ */
+type AppAccessPolicy = "public" | "authenticated" | "catalog";
+/** Incorta permission bits (com.incorta.api.Action). */
+declare const VIEW_BIT = 1;
+declare const SHARE_BIT = 2;
+declare const EDIT_BIT = 4;
+/** The catalog's verdict about the session user's access to THIS app. */
+interface AppAccess {
+    /**
+     * The app is registered in the Incorta catalog. `false` means it predates
+     * the catalog integration — the gate treats it as legacy-open (any
+     * authenticated tenant user may enter).
+     */
+    registered: boolean;
+    /** Effective Incorta permission bitmask (VIEW=1, SHARE=2, EDIT=4). */
+    access: number;
+    canView: boolean;
+    canEdit: boolean;
+    /** What the runtime gate enforces: unregistered (legacy-open) or ≥ VIEW. */
+    allowed: boolean;
+}
+/** Incorta could not answer (unreachable, 5xx, disabled) — gates fail CLOSED. */
+declare class AppAccessUnavailableError extends Error {
+    constructor(cause: string);
+}
+/** Incorta rejected the session's access token (expired/revoked) — re-login. */
+declare class AppAccessTokenRejectedError extends Error {
+    constructor();
+}
+
+export { type AppAccess as A, EDIT_BIT as E, type IncortaAuthConfig as I, type ResolvedConfig as R, type SessionInfo as S, VIEW_BIT as V, type AppAccessPolicy as a, AppAccessTokenRejectedError as b, AppAccessUnavailableError as c, type IncortaUser as d, SHARE_BIT as e, type SessionData as f };

package/dist/chunk-TMXOEIA2.js

@@ -0,0 +1,102 @@
+// src/core/app-access.ts
+var VIEW_BIT = 1;
+var SHARE_BIT = 2;
+var EDIT_BIT = 4;
+var AppAccessUnavailableError = class extends Error {
+  constructor(cause) {
+    super(`[incorta-auth] App access check unavailable: ${cause}`);
+    this.name = "AppAccessUnavailableError";
+  }
+};
+var AppAccessTokenRejectedError = class extends Error {
+  constructor() {
+    super("[incorta-auth] Incorta rejected the session token during the app access check");
+    this.name = "AppAccessTokenRejectedError";
+  }
+};
+var APP_ACCESS_CACHE_TTL_MS = 3e4;
+var CHECK_TIMEOUT_MS = 5e3;
+var CACHE_MAX_ENTRIES = 5e3;
+function toVerdict(registered, access) {
+  const canView = (access & VIEW_BIT) === VIEW_BIT;
+  return {
+    registered,
+    access,
+    canView,
+    canEdit: (access & EDIT_BIT) === EDIT_BIT,
+    allowed: !registered || canView
+  };
+}
+function createAppAccessChecker(config) {
+  const base = config.internalIncortaUrl ?? config.incortaUrl;
+  const checkUrl = `${base}/apps-catalog/check`;
+  const cache = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  function prune(now) {
+    if (cache.size < CACHE_MAX_ENTRIES) return;
+    for (const [key, entry] of cache) {
+      if (entry.expiresAt <= now) cache.delete(key);
+    }
+  }
+  async function fetchVerdict(accessToken) {
+    let response;
+    try {
+      response = await config.fetch(checkUrl, {
+        headers: {
+          accept: "application/json",
+          authorization: `Bearer ${accessToken}`
+        },
+        signal: AbortSignal.timeout(CHECK_TIMEOUT_MS)
+      });
+    } catch (error) {
+      throw new AppAccessUnavailableError(error.message);
+    }
+    if (response.status === 401) throw new AppAccessTokenRejectedError();
+    if (!response.ok) {
+      throw new AppAccessUnavailableError(`HTTP ${response.status}`);
+    }
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new AppAccessUnavailableError("invalid JSON response");
+    }
+    if (typeof body.registered !== "boolean" || typeof body.access !== "number") {
+      throw new AppAccessUnavailableError("malformed check response");
+    }
+    return toVerdict(body.registered, body.access);
+  }
+  async function check(accessToken, userKey) {
+    const now = Date.now();
+    const cached = cache.get(userKey);
+    if (cached && cached.expiresAt > now) return cached.verdict;
+    const pending = inFlight.get(userKey);
+    if (pending) return pending;
+    const promise = fetchVerdict(accessToken).then((verdict) => {
+      prune(now);
+      cache.set(userKey, { verdict, expiresAt: Date.now() + APP_ACCESS_CACHE_TTL_MS });
+      return verdict;
+    }).finally(() => {
+      inFlight.delete(userKey);
+    });
+    inFlight.set(userKey, promise);
+    return promise;
+  }
+  return {
+    check,
+    clearCache() {
+      cache.clear();
+      inFlight.clear();
+    }
+  };
+}
+
+export {
+  VIEW_BIT,
+  SHARE_BIT,
+  EDIT_BIT,
+  AppAccessUnavailableError,
+  AppAccessTokenRejectedError,
+  createAppAccessChecker
+};
+//# sourceMappingURL=chunk-TMXOEIA2.js.map

package/dist/chunk-TMXOEIA2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/app-access.ts"],"sourcesContent":["import type { ResolvedConfig } from \"./config.js\";\n\n/**\n * Platform-stamped access policy for the app (`INCORTA_APP_ACCESS`):\n *\n * - `\"public\"`       — anyone with the URL; the whole-app gate is inert\n *                      (login routes stay mounted, sessions are optional);\n * - `\"authenticated\"`— any signed-in Incorta user (the pre-policy behavior,\n *                      and the default when the platform stamped nothing);\n * - `\"catalog\"`      — signed-in AND at least VIEW access to this app in the\n *                      Incorta catalog (`/apps-catalog/check`).\n */\nexport type AppAccessPolicy = \"public\" | \"authenticated\" | \"catalog\";\n\n/** Incorta permission bits (com.incorta.api.Action). */\nexport const VIEW_BIT = 1;\nexport const SHARE_BIT = 2;\nexport const EDIT_BIT = 4;\n\n/** The catalog's verdict about the session user's access to THIS app. */\nexport interface AppAccess {\n  /**\n   * The app is registered in the Incorta catalog. `false` means it predates\n   * the catalog integration — the gate treats it as legacy-open (any\n   * authenticated tenant user may enter).\n   */\n  registered: boolean;\n  /** Effective Incorta permission bitmask (VIEW=1, SHARE=2, EDIT=4). */\n  access: number;\n  canView: boolean;\n  canEdit: boolean;\n  /** What the runtime gate enforces: unregistered (legacy-open) or ≥ VIEW. */\n  allowed: boolean;\n}\n\n/** Incorta could not answer (unreachable, 5xx, disabled) — gates fail CLOSED. */\nexport class AppAccessUnavailableError extends Error {\n  constructor(cause: string) {\n    super(`[incorta-auth] App access check unavailable: ${cause}`);\n    this.name = \"AppAccessUnavailableError\";\n  }\n}\n\n/** Incorta rejected the session's access token (expired/revoked) — re-login. */\nexport class AppAccessTokenRejectedError extends Error {\n  constructor() {\n    super(\"[incorta-auth] Incorta rejected the session token during the app access check\");\n    this.name = \"AppAccessTokenRejectedError\";\n  }\n}\n\n/** Verdicts are cached (allow AND deny) this long per user. */\nexport const APP_ACCESS_CACHE_TTL_MS = 30_000;\nconst CHECK_TIMEOUT_MS = 5_000;\n/** Lazy prune threshold — entries are (user × 30s), so this is generous. */\nconst CACHE_MAX_ENTRIES = 5_000;\n\ninterface CacheEntry {\n  verdict: AppAccess;\n  expiresAt: number;\n}\n\nexport interface AppAccessChecker {\n  /**\n   * The catalog verdict for the user behind `accessToken`, served from the\n   * per-user cache when fresh. Throws {@link AppAccessUnavailableError} when\n   * Incorta cannot answer and {@link AppAccessTokenRejectedError} when it\n   * rejects the token itself.\n   */\n  check(accessToken: string, userKey: string): Promise<AppAccess>;\n  /** Test hook: drops all cached verdicts. */\n  clearCache(): void;\n}\n\nfunction toVerdict(registered: boolean, access: number): AppAccess {\n  const canView = (access & VIEW_BIT) === VIEW_BIT;\n  return {\n    registered,\n    access,\n    canView,\n    canEdit: (access & EDIT_BIT) === EDIT_BIT,\n    allowed: !registered || canView,\n  };\n}\n\n/**\n * Client for `GET {incortaUrl}/apps-catalog/check` — the backend resolves\n * which app the token belongs to from its OAuth client (`software_id`), so\n * the request carries nothing but the user's own Bearer token. Server-side\n * call, so the split-horizon `internalIncortaUrl` wins when set.\n *\n * Verdicts (allow and deny alike) are cached per user for\n * {@link APP_ACCESS_CACHE_TTL_MS}; failures are NOT cached — the next\n * request retries, and callers fail closed in the meantime. Concurrent\n * checks for the same user share one in-flight request.\n */\nexport function createAppAccessChecker(config: ResolvedConfig): AppAccessChecker {\n  const base = config.internalIncortaUrl ?? config.incortaUrl;\n  const checkUrl = `${base}/apps-catalog/check`;\n  const cache = new Map<string, CacheEntry>();\n  const inFlight = new Map<string, Promise<AppAccess>>();\n\n  function prune(now: number): void {\n    if (cache.size < CACHE_MAX_ENTRIES) return;\n    for (const [key, entry] of cache) {\n      if (entry.expiresAt <= now) cache.delete(key);\n    }\n  }\n\n  async function fetchVerdict(accessToken: string): Promise<AppAccess> {\n    let response: Response;\n    try {\n      response = await config.fetch(checkUrl, {\n        headers: {\n          accept: \"application/json\",\n          authorization: `Bearer ${accessToken}`,\n        },\n        signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n      });\n    } catch (error) {\n      throw new AppAccessUnavailableError((error as Error).message);\n    }\n\n    if (response.status === 401) throw new AppAccessTokenRejectedError();\n    if (!response.ok) {\n      // 404 covers both \"Incorta Apps disabled for the tenant\" and an older\n      // Incorta without the /check command — verdicts are unavailable either\n      // way, and gates never fail open.\n      throw new AppAccessUnavailableError(`HTTP ${response.status}`);\n    }\n\n    let body: { registered?: unknown; access?: unknown };\n    try {\n      body = (await response.json()) as { registered?: unknown; access?: unknown };\n    } catch {\n      throw new AppAccessUnavailableError(\"invalid JSON response\");\n    }\n    if (typeof body.registered !== \"boolean\" || typeof body.access !== \"number\") {\n      throw new AppAccessUnavailableError(\"malformed check response\");\n    }\n    return toVerdict(body.registered, body.access);\n  }\n\n  async function check(accessToken: string, userKey: string): Promise<AppAccess> {\n    const now = Date.now();\n    const cached = cache.get(userKey);\n    if (cached && cached.expiresAt > now) return cached.verdict;\n\n    const pending = inFlight.get(userKey);\n    if (pending) return pending;\n\n    const promise = fetchVerdict(accessToken)\n      .then((verdict) => {\n        prune(now);\n        cache.set(userKey, { verdict, expiresAt: Date.now() + APP_ACCESS_CACHE_TTL_MS });\n        return verdict;\n      })\n      .finally(() => {\n        inFlight.delete(userKey);\n      });\n    inFlight.set(userKey, promise);\n    return promise;\n  }\n\n  return {\n    check,\n    clearCache() {\n      cache.clear();\n      inFlight.clear();\n    },\n  };\n}\n"],"mappings":";AAeO,IAAM,WAAW;AACjB,IAAM,YAAY;AAClB,IAAM,WAAW;AAmBjB,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,YAAY,OAAe;AACzB,UAAM,gDAAgD,KAAK,EAAE;AAC7D,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,cAAc;AACZ,UAAM,+EAA+E;AACrF,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,0BAA0B;AACvC,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB;AAmB1B,SAAS,UAAU,YAAqB,QAA2B;AACjE,QAAM,WAAW,SAAS,cAAc;AACxC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,SAAS,cAAc;AAAA,IACjC,SAAS,CAAC,cAAc;AAAA,EAC1B;AACF;AAaO,SAAS,uBAAuB,QAA0C;AAC/E,QAAM,OAAO,OAAO,sBAAsB,OAAO;AACjD,QAAM,WAAW,GAAG,IAAI;AACxB,QAAM,QAAQ,oBAAI,IAAwB;AAC1C,QAAM,WAAW,oBAAI,IAAgC;AAErD,WAAS,MAAM,KAAmB;AAChC,QAAI,MAAM,OAAO,kBAAmB;AACpC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO;AAChC,UAAI,MAAM,aAAa,IAAK,OAAM,OAAO,GAAG;AAAA,IAC9C;AAAA,EACF;AAEA,iBAAe,aAAa,aAAyC;AACnE,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,OAAO,MAAM,UAAU;AAAA,QACtC,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,eAAe,UAAU,WAAW;AAAA,QACtC;AAAA,QACA,QAAQ,YAAY,QAAQ,gBAAgB;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,0BAA2B,MAAgB,OAAO;AAAA,IAC9D;AAEA,QAAI,SAAS,WAAW,IAAK,OAAM,IAAI,4BAA4B;AACnE,QAAI,CAAC,SAAS,IAAI;AAIhB,YAAM,IAAI,0BAA0B,QAAQ,SAAS,MAAM,EAAE;AAAA,IAC/D;AAEA,QAAI;AACJ,QAAI;AACF,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B,QAAQ;AACN,YAAM,IAAI,0BAA0B,uBAAuB;AAAA,IAC7D;AACA,QAAI,OAAO,KAAK,eAAe,aAAa,OAAO,KAAK,WAAW,UAAU;AAC3E,YAAM,IAAI,0BAA0B,0BAA0B;AAAA,IAChE;AACA,WAAO,UAAU,KAAK,YAAY,KAAK,MAAM;AAAA,EAC/C;AAEA,iBAAe,MAAM,aAAqB,SAAqC;AAC7E,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,SAAS,MAAM,IAAI,OAAO;AAChC,QAAI,UAAU,OAAO,YAAY,IAAK,QAAO,OAAO;AAEpD,UAAM,UAAU,SAAS,IAAI,OAAO;AACpC,QAAI,QAAS,QAAO;AAEpB,UAAM,UAAU,aAAa,WAAW,EACrC,KAAK,CAAC,YAAY;AACjB,YAAM,GAAG;AACT,YAAM,IAAI,SAAS,EAAE,SAAS,WAAW,KAAK,IAAI,IAAI,wBAAwB,CAAC;AAC/E,aAAO;AAAA,IACT,CAAC,EACA,QAAQ,MAAM;AACb,eAAS,OAAO,OAAO;AAAA,IACzB,CAAC;AACH,aAAS,IAAI,SAAS,OAAO;AAC7B,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa;AACX,YAAM,MAAM;AACZ,eAAS,MAAM;AAAA,IACjB;AAAA,EACF;AACF;","names":[]}

package/dist/express.cjs

@@ -20,11 +20,20 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/express.ts
 var express_exports = {};
 __export(express_exports, {
+  appGate: () => appGate,
   incortaAuth: () => incortaAuth,
   requireAuth: () => requireAuth
 });
 module.exports = __toCommonJS(express_exports);
 
+// src/core/app-access.ts
+var AppAccessTokenRejectedError = class extends Error {
+  constructor() {
+    super("[incorta-auth] Incorta rejected the session token during the app access check");
+    this.name = "AppAccessTokenRejectedError";
+  }
+};
+
 // src/node.ts
 async function toWebRequest(req) {
   const proto = req.headers["x-forwarded-proto"]?.split(",")[0]?.trim() ?? (req.socket.encrypted ? "https" : "http");
@@ -104,8 +113,32 @@ function requireAuth(auth, options = {}) {
         req.incortaAuth = await auth.getSession(await toWebRequest(req));
       }
       if (req.incortaAuth) {
-        next();
-        return;
+        if (auth.config.appAccess !== "catalog") {
+          next();
+          return;
+        }
+        const session = req.incortaAuth;
+        try {
+          const verdict = await auth.getAppAccess(session);
+          if (verdict.allowed) {
+            session.appAccess = verdict;
+            next();
+            return;
+          }
+          res.statusCode = 403;
+          res.setHeader("content-type", "application/json; charset=utf-8");
+          res.end(JSON.stringify({ error: "app_access_denied" }));
+          return;
+        } catch (error) {
+          if (!(error instanceof AppAccessTokenRejectedError)) {
+            res.statusCode = 503;
+            res.setHeader("content-type", "application/json; charset=utf-8");
+            res.setHeader("retry-after", "30");
+            res.end(JSON.stringify({ error: "app_access_unavailable" }));
+            return;
+          }
+          req.incortaAuth = null;
+        }
       }
       const wantsHtml = (req.headers.accept ?? "").includes("text/html");
       if (mode === "redirect" || mode === "auto" && wantsHtml) {
@@ -126,8 +159,25 @@ function requireAuth(auth, options = {}) {
     }
   };
 }
+function appGate(auth) {
+  return async (req, res, next) => {
+    try {
+      const request = await toWebRequest(req);
+      const response = await auth.gate(request);
+      if (response) {
+        await sendWebResponse(res, response);
+        return;
+      }
+      req.incortaAuth = await auth.getSession(request);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  appGate,
   incortaAuth,
   requireAuth
 });

package/dist/express.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/express.ts","../src/node.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/** Guards a route: only signed-in Incorta users get through. */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        next();\n        return;\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { IncortaAuth } from \"./index.js\";\n\nexport type { IncortaAuth } from \"./index.js\";\n\n/**\n * Builds a web-standard `Request` from a Node request. Buffers the body (the\n * auth routes are GET/POST-without-body, so this stays tiny).\n */\nexport async function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const proto =\n    (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n    ((req.socket as { encrypted?: boolean }).encrypted ? \"https\" : \"http\");\n  const host = req.headers.host ?? \"localhost\";\n  // Express rewrites req.url when routers are mounted — originalUrl keeps the full path.\n  const path = (req as { originalUrl?: string }).originalUrl ?? req.url ?? \"/\";\n  const url = `${proto}://${host}${path}`;\n\n  const headers = new Headers();\n  for (let i = 0; i < req.rawHeaders.length; i += 2) {\n    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);\n  }\n\n  const method = req.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    const chunks: Buffer[] = [];\n    for await (const chunk of req) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    if (chunks.length) {\n      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.length;\n      }\n      body = bytes;\n    }\n  }\n\n  return new Request(url, { method, headers, body });\n}\n\nexport async function sendWebResponse(\n  res: ServerResponse,\n  response: Response,\n): Promise<void> {\n  res.statusCode = response.status;\n  response.headers.forEach((value, name) => {\n    if (name.toLowerCase() === \"set-cookie\") return; // handled below, needs the un-joined list\n    res.setHeader(name, value);\n  });\n  const setCookies = response.headers.getSetCookie();\n  if (setCookies.length) res.setHeader(\"set-cookie\", setCookies);\n\n  if (response.body) {\n    const buffer = Buffer.from(await response.arrayBuffer());\n    res.end(buffer);\n  } else {\n    res.end();\n  }\n}\n\n/**\n * Adapts the auth handler to a plain Node `(req, res)` listener:\n *\n * ```ts\n * import http from \"node:http\";\n * const authListener = toNodeHandler(auth);\n * http.createServer((req, res) => {\n *   if (req.url?.startsWith(\"/auth\")) return authListener(req, res);\n *   // ... your app\n * });\n * ```\n */\nexport function toNodeHandler(auth: IncortaAuth) {\n  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const request = await toWebRequest(req);\n    const response = await auth.handler(request);\n    await sendWebResponse(res, response);\n  };\n}\n\n/** Reads the current session from a Node request (returns null when signed out). */\nexport async function getNodeSession(auth: IncortaAuth, req: IncomingMessage) {\n  return auth.getSession(await toWebRequest(req));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSA,eAAsB,aAAa,KAAwC;AACzE,QAAM,QACH,IAAI,QAAQ,mBAAmB,GAA0B,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAC5E,IAAI,OAAmC,YAAY,UAAU;AACjE,QAAM,OAAO,IAAI,QAAQ,QAAQ;AAEjC,QAAM,OAAQ,IAAiC,eAAe,IAAI,OAAO;AACzE,QAAM,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI;AAErC,QAAM,UAAU,IAAI,QAAQ;AAC5B,WAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK,GAAG;AACjD,YAAQ,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,EACzD;AAEA,QAAM,SAAS,IAAI,UAAU;AAC7B,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,UAAM,SAAmB,CAAC;AAC1B,qBAAiB,SAAS,KAAK;AAC7B,aAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACjE;AACA,QAAI,OAAO,QAAQ;AACjB,YAAM,QAAQ,IAAI,WAAW,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AACnD;AAEA,eAAsB,gBACpB,KACA,UACe;AACf,MAAI,aAAa,SAAS;AAC1B,WAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,QAAI,KAAK,YAAY,MAAM,aAAc;AACzC,QAAI,UAAU,MAAM,KAAK;AAAA,EAC3B,CAAC;AACD,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,OAAQ,KAAI,UAAU,cAAc,UAAU;AAE7D,MAAI,SAAS,MAAM;AACjB,UAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI,IAAI,MAAM;AAAA,EAChB,OAAO;AACL,QAAI,IAAI;AAAA,EACV;AACF;AAcO,SAAS,cAAc,MAAmB;AAC/C,SAAO,OAAO,KAAsB,QAAuC;AACzE,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;AAC3C,UAAM,gBAAgB,KAAK,QAAQ;AAAA,EACrC;AACF;;;ADjDO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAcO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,aAAK;AACL;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/express.ts","../src/core/app-access.ts","../src/node.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { AppAccessTokenRejectedError } from \"./core/app-access.js\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { sendWebResponse, toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AppAccess, AppAccessPolicy, AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/**\n * Guards a route: only signed-in Incorta users get through — regardless of\n * the app's `appAccess` policy (an explicit `requireAuth` is the author's\n * promise that this route needs a user, so `\"public\"` mode does not neuter\n * it). Under the `\"catalog\"` policy the signed-in user must additionally\n * hold at least VIEW access to this app; the resolved verdict is attached as\n * `req.incortaAuth.appAccess`.\n */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        if (auth.config.appAccess !== \"catalog\") {\n          next();\n          return;\n        }\n        const session = req.incortaAuth;\n        try {\n          const verdict = await auth.getAppAccess(session);\n          if (verdict.allowed) {\n            session.appAccess = verdict;\n            next();\n            return;\n          }\n          res.statusCode = 403;\n          res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n          res.end(JSON.stringify({ error: \"app_access_denied\" }));\n          return;\n        } catch (error) {\n          if (!(error instanceof AppAccessTokenRejectedError)) {\n            // Verdicts unavailable — NEVER fail open.\n            res.statusCode = 503;\n            res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n            res.setHeader(\"retry-after\", \"30\");\n            res.end(JSON.stringify({ error: \"app_access_unavailable\" }));\n            return;\n          }\n          // Incorta rejected the session's token — treat as signed out.\n          req.incortaAuth = null;\n        }\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\n/**\n * Whole-app gate middleware: `auth.gate` as Express/Connect middleware.\n * Mount it FIRST (before your routes, instead of `incortaAuth()` — it also\n * serves the auth routes) to give the entire app the platform-stamped\n * `appAccess` policy: `\"public\"` apps let everyone through, `\"authenticated\"`\n * apps require login, `\"catalog\"` apps require catalog VIEW access (with the\n * SDK's deny/unavailable pages). Requests that pass get `req.incortaAuth`\n * populated like `incortaAuth()` does.\n */\nexport function appGate(auth: IncortaAuth): Middleware {\n  return async (req, res, next) => {\n    try {\n      const request = await toWebRequest(req);\n      const response = await auth.gate(request);\n      if (response) {\n        await sendWebResponse(res, response);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(request);\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n","import type { ResolvedConfig } from \"./config.js\";\n\n/**\n * Platform-stamped access policy for the app (`INCORTA_APP_ACCESS`):\n *\n * - `\"public\"`       — anyone with the URL; the whole-app gate is inert\n *                      (login routes stay mounted, sessions are optional);\n * - `\"authenticated\"`— any signed-in Incorta user (the pre-policy behavior,\n *                      and the default when the platform stamped nothing);\n * - `\"catalog\"`      — signed-in AND at least VIEW access to this app in the\n *                      Incorta catalog (`/apps-catalog/check`).\n */\nexport type AppAccessPolicy = \"public\" | \"authenticated\" | \"catalog\";\n\n/** Incorta permission bits (com.incorta.api.Action). */\nexport const VIEW_BIT = 1;\nexport const SHARE_BIT = 2;\nexport const EDIT_BIT = 4;\n\n/** The catalog's verdict about the session user's access to THIS app. */\nexport interface AppAccess {\n  /**\n   * The app is registered in the Incorta catalog. `false` means it predates\n   * the catalog integration — the gate treats it as legacy-open (any\n   * authenticated tenant user may enter).\n   */\n  registered: boolean;\n  /** Effective Incorta permission bitmask (VIEW=1, SHARE=2, EDIT=4). */\n  access: number;\n  canView: boolean;\n  canEdit: boolean;\n  /** What the runtime gate enforces: unregistered (legacy-open) or ≥ VIEW. */\n  allowed: boolean;\n}\n\n/** Incorta could not answer (unreachable, 5xx, disabled) — gates fail CLOSED. */\nexport class AppAccessUnavailableError extends Error {\n  constructor(cause: string) {\n    super(`[incorta-auth] App access check unavailable: ${cause}`);\n    this.name = \"AppAccessUnavailableError\";\n  }\n}\n\n/** Incorta rejected the session's access token (expired/revoked) — re-login. */\nexport class AppAccessTokenRejectedError extends Error {\n  constructor() {\n    super(\"[incorta-auth] Incorta rejected the session token during the app access check\");\n    this.name = \"AppAccessTokenRejectedError\";\n  }\n}\n\n/** Verdicts are cached (allow AND deny) this long per user. */\nexport const APP_ACCESS_CACHE_TTL_MS = 30_000;\nconst CHECK_TIMEOUT_MS = 5_000;\n/** Lazy prune threshold — entries are (user × 30s), so this is generous. */\nconst CACHE_MAX_ENTRIES = 5_000;\n\ninterface CacheEntry {\n  verdict: AppAccess;\n  expiresAt: number;\n}\n\nexport interface AppAccessChecker {\n  /**\n   * The catalog verdict for the user behind `accessToken`, served from the\n   * per-user cache when fresh. Throws {@link AppAccessUnavailableError} when\n   * Incorta cannot answer and {@link AppAccessTokenRejectedError} when it\n   * rejects the token itself.\n   */\n  check(accessToken: string, userKey: string): Promise<AppAccess>;\n  /** Test hook: drops all cached verdicts. */\n  clearCache(): void;\n}\n\nfunction toVerdict(registered: boolean, access: number): AppAccess {\n  const canView = (access & VIEW_BIT) === VIEW_BIT;\n  return {\n    registered,\n    access,\n    canView,\n    canEdit: (access & EDIT_BIT) === EDIT_BIT,\n    allowed: !registered || canView,\n  };\n}\n\n/**\n * Client for `GET {incortaUrl}/apps-catalog/check` — the backend resolves\n * which app the token belongs to from its OAuth client (`software_id`), so\n * the request carries nothing but the user's own Bearer token. Server-side\n * call, so the split-horizon `internalIncortaUrl` wins when set.\n *\n * Verdicts (allow and deny alike) are cached per user for\n * {@link APP_ACCESS_CACHE_TTL_MS}; failures are NOT cached — the next\n * request retries, and callers fail closed in the meantime. Concurrent\n * checks for the same user share one in-flight request.\n */\nexport function createAppAccessChecker(config: ResolvedConfig): AppAccessChecker {\n  const base = config.internalIncortaUrl ?? config.incortaUrl;\n  const checkUrl = `${base}/apps-catalog/check`;\n  const cache = new Map<string, CacheEntry>();\n  const inFlight = new Map<string, Promise<AppAccess>>();\n\n  function prune(now: number): void {\n    if (cache.size < CACHE_MAX_ENTRIES) return;\n    for (const [key, entry] of cache) {\n      if (entry.expiresAt <= now) cache.delete(key);\n    }\n  }\n\n  async function fetchVerdict(accessToken: string): Promise<AppAccess> {\n    let response: Response;\n    try {\n      response = await config.fetch(checkUrl, {\n        headers: {\n          accept: \"application/json\",\n          authorization: `Bearer ${accessToken}`,\n        },\n        signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n      });\n    } catch (error) {\n      throw new AppAccessUnavailableError((error as Error).message);\n    }\n\n    if (response.status === 401) throw new AppAccessTokenRejectedError();\n    if (!response.ok) {\n      // 404 covers both \"Incorta Apps disabled for the tenant\" and an older\n      // Incorta without the /check command — verdicts are unavailable either\n      // way, and gates never fail open.\n      throw new AppAccessUnavailableError(`HTTP ${response.status}`);\n    }\n\n    let body: { registered?: unknown; access?: unknown };\n    try {\n      body = (await response.json()) as { registered?: unknown; access?: unknown };\n    } catch {\n      throw new AppAccessUnavailableError(\"invalid JSON response\");\n    }\n    if (typeof body.registered !== \"boolean\" || typeof body.access !== \"number\") {\n      throw new AppAccessUnavailableError(\"malformed check response\");\n    }\n    return toVerdict(body.registered, body.access);\n  }\n\n  async function check(accessToken: string, userKey: string): Promise<AppAccess> {\n    const now = Date.now();\n    const cached = cache.get(userKey);\n    if (cached && cached.expiresAt > now) return cached.verdict;\n\n    const pending = inFlight.get(userKey);\n    if (pending) return pending;\n\n    const promise = fetchVerdict(accessToken)\n      .then((verdict) => {\n        prune(now);\n        cache.set(userKey, { verdict, expiresAt: Date.now() + APP_ACCESS_CACHE_TTL_MS });\n        return verdict;\n      })\n      .finally(() => {\n        inFlight.delete(userKey);\n      });\n    inFlight.set(userKey, promise);\n    return promise;\n  }\n\n  return {\n    check,\n    clearCache() {\n      cache.clear();\n      inFlight.clear();\n    },\n  };\n}\n","import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { IncortaAuth } from \"./index.js\";\n\nexport type { IncortaAuth } from \"./index.js\";\n\n/**\n * Builds a web-standard `Request` from a Node request. Buffers the body (the\n * auth routes are GET/POST-without-body, so this stays tiny).\n */\nexport async function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const proto =\n    (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n    ((req.socket as { encrypted?: boolean }).encrypted ? \"https\" : \"http\");\n  const host = req.headers.host ?? \"localhost\";\n  // Express rewrites req.url when routers are mounted — originalUrl keeps the full path.\n  const path = (req as { originalUrl?: string }).originalUrl ?? req.url ?? \"/\";\n  const url = `${proto}://${host}${path}`;\n\n  const headers = new Headers();\n  for (let i = 0; i < req.rawHeaders.length; i += 2) {\n    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);\n  }\n\n  const method = req.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    const chunks: Buffer[] = [];\n    for await (const chunk of req) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    if (chunks.length) {\n      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.length;\n      }\n      body = bytes;\n    }\n  }\n\n  return new Request(url, { method, headers, body });\n}\n\nexport async function sendWebResponse(\n  res: ServerResponse,\n  response: Response,\n): Promise<void> {\n  res.statusCode = response.status;\n  response.headers.forEach((value, name) => {\n    if (name.toLowerCase() === \"set-cookie\") return; // handled below, needs the un-joined list\n    res.setHeader(name, value);\n  });\n  const setCookies = response.headers.getSetCookie();\n  if (setCookies.length) res.setHeader(\"set-cookie\", setCookies);\n\n  if (response.body) {\n    const buffer = Buffer.from(await response.arrayBuffer());\n    res.end(buffer);\n  } else {\n    res.end();\n  }\n}\n\n/**\n * Adapts the auth handler to a plain Node `(req, res)` listener:\n *\n * ```ts\n * import http from \"node:http\";\n * const authListener = toNodeHandler(auth);\n * http.createServer((req, res) => {\n *   if (req.url?.startsWith(\"/auth\")) return authListener(req, res);\n *   // ... your app\n * });\n * ```\n */\nexport function toNodeHandler(auth: IncortaAuth) {\n  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const request = await toWebRequest(req);\n    const response = await auth.handler(request);\n    await sendWebResponse(res, response);\n  };\n}\n\n/** Reads the current session from a Node request (returns null when signed out). */\nexport async function getNodeSession(auth: IncortaAuth, req: IncomingMessage) {\n  return auth.getSession(await toWebRequest(req));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC4CO,IAAM,8BAAN,cAA0C,MAAM;AAAA,EACrD,cAAc;AACZ,UAAM,+EAA+E;AACrF,SAAK,OAAO;AAAA,EACd;AACF;;;ACxCA,eAAsB,aAAa,KAAwC;AACzE,QAAM,QACH,IAAI,QAAQ,mBAAmB,GAA0B,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAC5E,IAAI,OAAmC,YAAY,UAAU;AACjE,QAAM,OAAO,IAAI,QAAQ,QAAQ;AAEjC,QAAM,OAAQ,IAAiC,eAAe,IAAI,OAAO;AACzE,QAAM,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI;AAErC,QAAM,UAAU,IAAI,QAAQ;AAC5B,WAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK,GAAG;AACjD,YAAQ,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,EACzD;AAEA,QAAM,SAAS,IAAI,UAAU;AAC7B,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,UAAM,SAAmB,CAAC;AAC1B,qBAAiB,SAAS,KAAK;AAC7B,aAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACjE;AACA,QAAI,OAAO,QAAQ;AACjB,YAAM,QAAQ,IAAI,WAAW,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AACnD;AAEA,eAAsB,gBACpB,KACA,UACe;AACf,MAAI,aAAa,SAAS;AAC1B,WAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,QAAI,KAAK,YAAY,MAAM,aAAc;AACzC,QAAI,UAAU,MAAM,KAAK;AAAA,EAC3B,CAAC;AACD,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,OAAQ,KAAI,UAAU,cAAc,UAAU;AAE7D,MAAI,SAAS,MAAM;AACjB,UAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI,IAAI,MAAM;AAAA,EAChB,OAAO;AACL,QAAI,IAAI;AAAA,EACV;AACF;AAcO,SAAS,cAAc,MAAmB;AAC/C,SAAO,OAAO,KAAsB,QAAuC;AACzE,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;AAC3C,UAAM,gBAAgB,KAAK,QAAQ;AAAA,EACrC;AACF;;;AFhDO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAqBO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,YAAI,KAAK,OAAO,cAAc,WAAW;AACvC,eAAK;AACL;AAAA,QACF;AACA,cAAM,UAAU,IAAI;AACpB,YAAI;AACF,gBAAM,UAAU,MAAM,KAAK,aAAa,OAAO;AAC/C,cAAI,QAAQ,SAAS;AACnB,oBAAQ,YAAY;AACpB,iBAAK;AACL;AAAA,UACF;AACA,cAAI,aAAa;AACjB,cAAI,UAAU,gBAAgB,iCAAiC;AAC/D,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,oBAAoB,CAAC,CAAC;AACtD;AAAA,QACF,SAAS,OAAO;AACd,cAAI,EAAE,iBAAiB,8BAA8B;AAEnD,gBAAI,aAAa;AACjB,gBAAI,UAAU,gBAAgB,iCAAiC;AAC/D,gBAAI,UAAU,eAAe,IAAI;AACjC,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yBAAyB,CAAC,CAAC;AAC3D;AAAA,UACF;AAEA,cAAI,cAAc;AAAA,QACpB;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAWO,SAAS,QAAQ,MAA+B;AACrD,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,UAAU,MAAM,aAAa,GAAG;AACtC,YAAM,WAAW,MAAM,KAAK,KAAK,OAAO;AACxC,UAAI,UAAU;AACZ,cAAM,gBAAgB,KAAK,QAAQ;AACnC;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,OAAO;AAC/C,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}

package/dist/express.d.cts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.cjs';
-import './config-DmeXKgtO.cjs';
+export { A as AppAccess, a as AppAccessPolicy } from './app-access-BSsKtvbi.cjs';
 import 'jose';
 
 /**
@@ -36,7 +36,24 @@ interface RequireAuthOptions {
      */
     unauthenticated?: "redirect" | "json" | "auto";
 }
-/** Guards a route: only signed-in Incorta users get through. */
+/**
+ * Guards a route: only signed-in Incorta users get through — regardless of
+ * the app's `appAccess` policy (an explicit `requireAuth` is the author's
+ * promise that this route needs a user, so `"public"` mode does not neuter
+ * it). Under the `"catalog"` policy the signed-in user must additionally
+ * hold at least VIEW access to this app; the resolved verdict is attached as
+ * `req.incortaAuth.appAccess`.
+ */
 declare function requireAuth(auth: IncortaAuth, options?: RequireAuthOptions): Middleware;
+/**
+ * Whole-app gate middleware: `auth.gate` as Express/Connect middleware.
+ * Mount it FIRST (before your routes, instead of `incortaAuth()` — it also
+ * serves the auth routes) to give the entire app the platform-stamped
+ * `appAccess` policy: `"public"` apps let everyone through, `"authenticated"`
+ * apps require login, `"catalog"` apps require catalog VIEW access (with the
+ * SDK's deny/unavailable pages). Requests that pass get `req.incortaAuth`
+ * populated like `incortaAuth()` does.
+ */
+declare function appGate(auth: IncortaAuth): Middleware;
 
-export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, incortaAuth, requireAuth };
+export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, appGate, incortaAuth, requireAuth };

package/dist/express.d.ts

@@ -1,6 +1,6 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { AuthSession, IncortaAuth } from './index.js';
-import './config-DmeXKgtO.js';
+export { A as AppAccess, a as AppAccessPolicy } from './app-access-BSsKtvbi.js';
 import 'jose';
 
 /**
@@ -36,7 +36,24 @@ interface RequireAuthOptions {
      */
     unauthenticated?: "redirect" | "json" | "auto";
 }
-/** Guards a route: only signed-in Incorta users get through. */
+/**
+ * Guards a route: only signed-in Incorta users get through — regardless of
+ * the app's `appAccess` policy (an explicit `requireAuth` is the author's
+ * promise that this route needs a user, so `"public"` mode does not neuter
+ * it). Under the `"catalog"` policy the signed-in user must additionally
+ * hold at least VIEW access to this app; the resolved verdict is attached as
+ * `req.incortaAuth.appAccess`.
+ */
 declare function requireAuth(auth: IncortaAuth, options?: RequireAuthOptions): Middleware;
+/**
+ * Whole-app gate middleware: `auth.gate` as Express/Connect middleware.
+ * Mount it FIRST (before your routes, instead of `incortaAuth()` — it also
+ * serves the auth routes) to give the entire app the platform-stamped
+ * `appAccess` policy: `"public"` apps let everyone through, `"authenticated"`
+ * apps require login, `"catalog"` apps require catalog VIEW access (with the
+ * SDK's deny/unavailable pages). Requests that pass get `req.incortaAuth`
+ * populated like `incortaAuth()` does.
+ */
+declare function appGate(auth: IncortaAuth): Middleware;
 
-export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, incortaAuth, requireAuth };
+export { AuthSession, type AuthedRequest, IncortaAuth, type RequireAuthOptions, appGate, incortaAuth, requireAuth };

package/dist/express.js

@@ -1,4 +1,8 @@
 import {
+  AppAccessTokenRejectedError
+} from "./chunk-TMXOEIA2.js";
+import {
+  sendWebResponse,
   toNodeHandler,
   toWebRequest
 } from "./chunk-LNPECE7W.js";
@@ -30,8 +34,32 @@ function requireAuth(auth, options = {}) {
         req.incortaAuth = await auth.getSession(await toWebRequest(req));
       }
       if (req.incortaAuth) {
-        next();
-        return;
+        if (auth.config.appAccess !== "catalog") {
+          next();
+          return;
+        }
+        const session = req.incortaAuth;
+        try {
+          const verdict = await auth.getAppAccess(session);
+          if (verdict.allowed) {
+            session.appAccess = verdict;
+            next();
+            return;
+          }
+          res.statusCode = 403;
+          res.setHeader("content-type", "application/json; charset=utf-8");
+          res.end(JSON.stringify({ error: "app_access_denied" }));
+          return;
+        } catch (error) {
+          if (!(error instanceof AppAccessTokenRejectedError)) {
+            res.statusCode = 503;
+            res.setHeader("content-type", "application/json; charset=utf-8");
+            res.setHeader("retry-after", "30");
+            res.end(JSON.stringify({ error: "app_access_unavailable" }));
+            return;
+          }
+          req.incortaAuth = null;
+        }
       }
       const wantsHtml = (req.headers.accept ?? "").includes("text/html");
       if (mode === "redirect" || mode === "auto" && wantsHtml) {
@@ -52,7 +80,24 @@ function requireAuth(auth, options = {}) {
     }
   };
 }
+function appGate(auth) {
+  return async (req, res, next) => {
+    try {
+      const request = await toWebRequest(req);
+      const response = await auth.gate(request);
+      if (response) {
+        await sendWebResponse(res, response);
+        return;
+      }
+      req.incortaAuth = await auth.getSession(request);
+      next();
+    } catch (error) {
+      next(error);
+    }
+  };
+}
 export {
+  appGate,
   incortaAuth,
   requireAuth
 };

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/express.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/** Guards a route: only signed-in Incorta users get through. */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        next();\n        return;\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n"],"mappings":";;;;;;AAiCO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAcO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,aAAK;AACL;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/express.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { AppAccessTokenRejectedError } from \"./core/app-access.js\";\nimport type { AuthSession, IncortaAuth } from \"./index.js\";\nimport { sendWebResponse, toNodeHandler, toWebRequest } from \"./node.js\";\n\nexport type { AppAccess, AppAccessPolicy, AuthSession, IncortaAuth } from \"./index.js\";\n\n/**\n * Minimal structural types so this adapter works with Express 4/5 (and\n * anything Connect-compatible) without depending on Express itself.\n */\nexport interface AuthedRequest extends IncomingMessage {\n  originalUrl?: string;\n  /** Populated by `incortaAuth()`: the current session, or null when signed out. */\n  incortaAuth?: AuthSession | null;\n}\ntype NextFunction = (err?: unknown) => void;\ntype Middleware = (\n  req: AuthedRequest,\n  res: ServerResponse,\n  next: NextFunction,\n) => void | Promise<void>;\n\n/**\n * Express/Connect middleware that serves the auth routes (under\n * `auth.config.basePath`) and attaches the current session to every other\n * request as `req.incortaAuth`.\n *\n * ```ts\n * const auth = createIncortaAuth();\n * app.use(incortaAuth(auth));\n * app.get(\"/api/me\", requireAuth(auth), (req, res) => res.json(req.incortaAuth.user));\n * ```\n */\nexport function incortaAuth(auth: IncortaAuth): Middleware {\n  const nodeHandler = toNodeHandler(auth);\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      const path = (req.originalUrl ?? req.url ?? \"/\").split(\"?\")[0];\n      if (path === basePath || path.startsWith(`${basePath}/`)) {\n        await nodeHandler(req, res);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\nexport interface RequireAuthOptions {\n  /**\n   * How to reject unauthenticated requests:\n   * - `\"redirect\"`: 302 to the login route (which bounces through Incorta login\n   *   and back to the original URL) — right for page routes.\n   * - `\"json\"`: 401 `{ error: \"unauthenticated\" }` — right for API routes.\n   * - `\"auto\"` (default): redirect when the request accepts text/html, 401 otherwise.\n   */\n  unauthenticated?: \"redirect\" | \"json\" | \"auto\";\n}\n\n/**\n * Guards a route: only signed-in Incorta users get through — regardless of\n * the app's `appAccess` policy (an explicit `requireAuth` is the author's\n * promise that this route needs a user, so `\"public\"` mode does not neuter\n * it). Under the `\"catalog\"` policy the signed-in user must additionally\n * hold at least VIEW access to this app; the resolved verdict is attached as\n * `req.incortaAuth.appAccess`.\n */\nexport function requireAuth(auth: IncortaAuth, options: RequireAuthOptions = {}): Middleware {\n  const mode = options.unauthenticated ?? \"auto\";\n  const { basePath } = auth.config;\n\n  return async (req, res, next) => {\n    try {\n      if (req.incortaAuth === undefined) {\n        req.incortaAuth = await auth.getSession(await toWebRequest(req));\n      }\n      if (req.incortaAuth) {\n        if (auth.config.appAccess !== \"catalog\") {\n          next();\n          return;\n        }\n        const session = req.incortaAuth;\n        try {\n          const verdict = await auth.getAppAccess(session);\n          if (verdict.allowed) {\n            session.appAccess = verdict;\n            next();\n            return;\n          }\n          res.statusCode = 403;\n          res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n          res.end(JSON.stringify({ error: \"app_access_denied\" }));\n          return;\n        } catch (error) {\n          if (!(error instanceof AppAccessTokenRejectedError)) {\n            // Verdicts unavailable — NEVER fail open.\n            res.statusCode = 503;\n            res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n            res.setHeader(\"retry-after\", \"30\");\n            res.end(JSON.stringify({ error: \"app_access_unavailable\" }));\n            return;\n          }\n          // Incorta rejected the session's token — treat as signed out.\n          req.incortaAuth = null;\n        }\n      }\n\n      const wantsHtml = (req.headers.accept ?? \"\").includes(\"text/html\");\n      if (mode === \"redirect\" || (mode === \"auto\" && wantsHtml)) {\n        const returnTo = req.originalUrl ?? req.url ?? \"/\";\n        res.statusCode = 302;\n        res.setHeader(\n          \"location\",\n          `${basePath}/login?redirect_to=${encodeURIComponent(returnTo)}`,\n        );\n        res.end();\n        return;\n      }\n\n      res.statusCode = 401;\n      res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n      res.end(JSON.stringify({ error: \"unauthenticated\" }));\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n\n/**\n * Whole-app gate middleware: `auth.gate` as Express/Connect middleware.\n * Mount it FIRST (before your routes, instead of `incortaAuth()` — it also\n * serves the auth routes) to give the entire app the platform-stamped\n * `appAccess` policy: `\"public\"` apps let everyone through, `\"authenticated\"`\n * apps require login, `\"catalog\"` apps require catalog VIEW access (with the\n * SDK's deny/unavailable pages). Requests that pass get `req.incortaAuth`\n * populated like `incortaAuth()` does.\n */\nexport function appGate(auth: IncortaAuth): Middleware {\n  return async (req, res, next) => {\n    try {\n      const request = await toWebRequest(req);\n      const response = await auth.gate(request);\n      if (response) {\n        await sendWebResponse(res, response);\n        return;\n      }\n      req.incortaAuth = await auth.getSession(request);\n      next();\n    } catch (error) {\n      next(error);\n    }\n  };\n}\n"],"mappings":";;;;;;;;;;AAkCO,SAAS,YAAY,MAA+B;AACzD,QAAM,cAAc,cAAc,IAAI;AACtC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,QAAQ,IAAI,eAAe,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7D,UAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,GAAG;AACxD,cAAM,YAAY,KAAK,GAAG;AAC1B;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAC/D,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAqBO,SAAS,YAAY,MAAmB,UAA8B,CAAC,GAAe;AAC3F,QAAM,OAAO,QAAQ,mBAAmB;AACxC,QAAM,EAAE,SAAS,IAAI,KAAK;AAE1B,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,UAAI,IAAI,gBAAgB,QAAW;AACjC,YAAI,cAAc,MAAM,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAAA,MACjE;AACA,UAAI,IAAI,aAAa;AACnB,YAAI,KAAK,OAAO,cAAc,WAAW;AACvC,eAAK;AACL;AAAA,QACF;AACA,cAAM,UAAU,IAAI;AACpB,YAAI;AACF,gBAAM,UAAU,MAAM,KAAK,aAAa,OAAO;AAC/C,cAAI,QAAQ,SAAS;AACnB,oBAAQ,YAAY;AACpB,iBAAK;AACL;AAAA,UACF;AACA,cAAI,aAAa;AACjB,cAAI,UAAU,gBAAgB,iCAAiC;AAC/D,cAAI,IAAI,KAAK,UAAU,EAAE,OAAO,oBAAoB,CAAC,CAAC;AACtD;AAAA,QACF,SAAS,OAAO;AACd,cAAI,EAAE,iBAAiB,8BAA8B;AAEnD,gBAAI,aAAa;AACjB,gBAAI,UAAU,gBAAgB,iCAAiC;AAC/D,gBAAI,UAAU,eAAe,IAAI;AACjC,gBAAI,IAAI,KAAK,UAAU,EAAE,OAAO,yBAAyB,CAAC,CAAC;AAC3D;AAAA,UACF;AAEA,cAAI,cAAc;AAAA,QACpB;AAAA,MACF;AAEA,YAAM,aAAa,IAAI,QAAQ,UAAU,IAAI,SAAS,WAAW;AACjE,UAAI,SAAS,cAAe,SAAS,UAAU,WAAY;AACzD,cAAM,WAAW,IAAI,eAAe,IAAI,OAAO;AAC/C,YAAI,aAAa;AACjB,YAAI;AAAA,UACF;AAAA,UACA,GAAG,QAAQ,sBAAsB,mBAAmB,QAAQ,CAAC;AAAA,QAC/D;AACA,YAAI,IAAI;AACR;AAAA,MACF;AAEA,UAAI,aAAa;AACjB,UAAI,UAAU,gBAAgB,iCAAiC;AAC/D,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,kBAAkB,CAAC,CAAC;AAAA,IACtD,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;AAWO,SAAS,QAAQ,MAA+B;AACrD,SAAO,OAAO,KAAK,KAAK,SAAS;AAC/B,QAAI;AACF,YAAM,UAAU,MAAM,aAAa,GAAG;AACtC,YAAM,WAAW,MAAM,KAAK,KAAK,OAAO;AACxC,UAAI,UAAU;AACZ,cAAM,gBAAgB,KAAK,QAAQ;AACnC;AAAA,MACF;AACA,UAAI,cAAc,MAAM,KAAK,WAAW,OAAO;AAC/C,WAAK;AAAA,IACP,SAAS,OAAO;AACd,WAAK,KAAK;AAAA,IACZ;AAAA,EACF;AACF;","names":[]}