@jsango/auth 1.0.0

package/dist/public/authorization/role.js

@@ -0,0 +1,43 @@
+export class RoleRegistry {
+    roles = new Map();
+    register(role) {
+        if (this.roles.has(role.name)) {
+            throw new Error(`Role "${role.name}" is already registered.`);
+        }
+        this.roles.set(role.name, Object.freeze({
+            ...role,
+            permissions: Object.freeze([...role.permissions]),
+        }));
+        return this;
+    }
+    registerMany(roles) {
+        for (const role of roles) {
+            this.register(role);
+        }
+        return this;
+    }
+    get(name) {
+        return this.roles.get(name);
+    }
+    has(name) {
+        return this.roles.has(name);
+    }
+    getPermissionsForRole(roleName) {
+        const role = this.roles.get(roleName);
+        return role ? role.permissions : [];
+    }
+    getPermissionsForRoles(roleNames) {
+        const permissionsSet = new Set();
+        for (const roleName of roleNames) {
+            const permissions = this.getPermissionsForRole(roleName);
+            for (const p of permissions) {
+                permissionsSet.add(p);
+            }
+        }
+        return Object.freeze(Array.from(permissionsSet));
+    }
+    getAll() {
+        return Object.freeze(Array.from(this.roles.values()));
+    }
+}
+//# sourceMappingURL=role.js.map

package/dist/public/authorization/role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../../src/public/authorization/role.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEpD,QAAQ,CAAC,IAAoB;QAClC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,0BAA0B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CACZ,IAAI,CAAC,IAAI,EACT,MAAM,CAAC,MAAM,CAAC;YACZ,GAAG,IAAI;YACP,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;SAClD,CAAC,CACH,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,YAAY,CAAC,KAAgC;QAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEM,GAAG,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEM,qBAAqB,CAAC,QAAgB;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IAEM,sBAAsB,CAAC,SAA4B;QACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACzD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACnD,CAAC;IAEM,MAAM;QACX,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/public/context/auth-context.d.ts

@@ -0,0 +1,8 @@
+import type { RequestContext } from '@jsango/http';
+import type { AuthContext, Identity } from '../types.js';
+export declare const AUTH_CONTEXT_STATE_KEY = "jsango:auth";
+export declare function setAuthContext(ctx: RequestContext, authContext: AuthContext): void;
+export declare function getAuthContext(ctx: RequestContext): AuthContext | undefined;
+export declare function getIdentity(ctx: RequestContext): Identity;
+export declare function requireIdentity(ctx: RequestContext): Identity;
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/public/context/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../../src/public/context/auth-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEzD,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAUlF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAE3E;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAMzD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,CAM7D"}

package/dist/public/context/auth-context.js

@@ -0,0 +1,33 @@
+import { AnonymousIdentity } from '../identity.js';
+import { UnauthenticatedError } from '../errors.js';
+export const AUTH_CONTEXT_STATE_KEY = 'jsango:auth';
+export function setAuthContext(ctx, authContext) {
+    ctx.state.set(AUTH_CONTEXT_STATE_KEY, authContext);
+    if (ctx.container) {
+        try {
+            ctx.container.register('auth.identity', authContext.identity);
+            ctx.container.register('auth.context', authContext);
+        }
+        catch {
+            // Container may be locked or immutable in certain test scopes; state map is primary
+        }
+    }
+}
+export function getAuthContext(ctx) {
+    return ctx.state.get(AUTH_CONTEXT_STATE_KEY);
+}
+export function getIdentity(ctx) {
+    const authCtx = getAuthContext(ctx);
+    if (authCtx?.identity) {
+        return authCtx.identity;
+    }
+    return new AnonymousIdentity();
+}
+export function requireIdentity(ctx) {
+    const identity = getIdentity(ctx);
+    if (!identity.isAuthenticated) {
+        throw new UnauthenticatedError('Authentication is required to access this resource.');
+    }
+    return identity;
+}
+//# sourceMappingURL=auth-context.js.map

package/dist/public/context/auth-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../../src/public/context/auth-context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAEpD,MAAM,UAAU,cAAc,CAAC,GAAmB,EAAE,WAAwB;IAC1E,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,oFAAoF;QACtF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAmB;IAChD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAA4B,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,iBAAiB,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC9B,MAAM,IAAI,oBAAoB,CAAC,qDAAqD,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/public/errors.d.ts

@@ -0,0 +1,33 @@
+import { JsangoError } from '@jsango/core';
+export interface AuthErrorOptions {
+    readonly code: string;
+    readonly message: string;
+    readonly cause?: unknown;
+    readonly metadata?: Readonly<Record<string, unknown>> | undefined;
+    readonly statusCode?: number | undefined;
+}
+export declare class AuthenticationError extends JsangoError {
+    constructor(options: AuthErrorOptions);
+}
+export declare class UnauthenticatedError extends AuthenticationError {
+    constructor(message?: string);
+}
+export declare class InvalidCredentialsError extends AuthenticationError {
+    constructor(message?: string);
+}
+export declare class TokenExpiredError extends AuthenticationError {
+    constructor(message?: string);
+}
+export declare class SessionExpiredError extends AuthenticationError {
+    constructor(message?: string);
+}
+export declare class AuthorizationError extends JsangoError {
+    constructor(options: AuthErrorOptions);
+}
+export declare class ForbiddenError extends AuthorizationError {
+    constructor(message?: string);
+}
+export declare class PolicyError extends AuthorizationError {
+    constructor(policyName: string, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/public/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/public/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,qBAAa,mBAAoB,SAAQ,WAAW;gBAC/B,OAAO,EAAE,gBAAgB;CAW7C;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBACxC,OAAO,SAA6C;CAQxE;AAED,qBAAa,uBAAwB,SAAQ,mBAAmB;gBAC3C,OAAO,SAAwC;CAQnE;AAED,qBAAa,iBAAkB,SAAQ,mBAAmB;gBACrC,OAAO,SAAsC;CAQjE;AAED,qBAAa,mBAAoB,SAAQ,mBAAmB;gBACvC,OAAO,SAAwC;CAQnE;AAED,qBAAa,kBAAmB,SAAQ,WAAW;gBAC9B,OAAO,EAAE,gBAAgB;CAW7C;AAED,qBAAa,cAAe,SAAQ,kBAAkB;gBACjC,OAAO,SAAuD;CAQlF;AAED,qBAAa,WAAY,SAAQ,kBAAkB;gBAC9B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CASxD"}

package/dist/public/errors.js

@@ -0,0 +1,89 @@
+import { JsangoError } from '@jsango/core';
+export class AuthenticationError extends JsangoError {
+    constructor(options) {
+        super({
+            code: options.code,
+            message: options.message,
+            cause: options.cause,
+            metadata: options.metadata,
+            statusCode: options.statusCode ?? 401,
+        });
+        this.name = 'AuthenticationError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class UnauthenticatedError extends AuthenticationError {
+    constructor(message = 'Authentication credentials are required.') {
+        super({
+            code: 'ERR_AUTH_UNAUTHENTICATED',
+            message,
+            statusCode: 401,
+        });
+        this.name = 'UnauthenticatedError';
+    }
+}
+export class InvalidCredentialsError extends AuthenticationError {
+    constructor(message = 'Invalid authentication credentials.') {
+        super({
+            code: 'ERR_AUTH_INVALID_CREDENTIALS',
+            message,
+            statusCode: 401,
+        });
+        this.name = 'InvalidCredentialsError';
+    }
+}
+export class TokenExpiredError extends AuthenticationError {
+    constructor(message = 'Authentication token has expired.') {
+        super({
+            code: 'ERR_AUTH_TOKEN_EXPIRED',
+            message,
+            statusCode: 401,
+        });
+        this.name = 'TokenExpiredError';
+    }
+}
+export class SessionExpiredError extends AuthenticationError {
+    constructor(message = 'Authentication session has expired.') {
+        super({
+            code: 'ERR_AUTH_SESSION_EXPIRED',
+            message,
+            statusCode: 401,
+        });
+        this.name = 'SessionExpiredError';
+    }
+}
+export class AuthorizationError extends JsangoError {
+    constructor(options) {
+        super({
+            code: options.code,
+            message: options.message,
+            cause: options.cause,
+            metadata: options.metadata,
+            statusCode: options.statusCode ?? 403,
+        });
+        this.name = 'AuthorizationError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+export class ForbiddenError extends AuthorizationError {
+    constructor(message = 'You do not have permission to perform this action.') {
+        super({
+            code: 'ERR_AUTH_FORBIDDEN',
+            message,
+            statusCode: 403,
+        });
+        this.name = 'ForbiddenError';
+    }
+}
+export class PolicyError extends AuthorizationError {
+    constructor(policyName, message) {
+        super({
+            code: 'ERR_AUTH_POLICY_VIOLATION',
+            message: message ?? `Access denied by policy "${policyName}".`,
+            metadata: { policy: policyName },
+            statusCode: 403,
+        });
+        this.name = 'PolicyError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/public/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/public/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAU3C,MAAM,OAAO,mBAAoB,SAAQ,WAAW;IAClD,YAAmB,OAAyB;QAC1C,KAAK,CAAC;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAC3D,YAAmB,OAAO,GAAG,0CAA0C;QACrE,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,OAAO;YACP,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAmB,OAAO,GAAG,qCAAqC;QAChE,KAAK,CAAC;YACJ,IAAI,EAAE,8BAA8B;YACpC,OAAO;YACP,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,mBAAmB;IACxD,YAAmB,OAAO,GAAG,mCAAmC;QAC9D,KAAK,CAAC;YACJ,IAAI,EAAE,wBAAwB;YAC9B,OAAO;YACP,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,mBAAmB;IAC1D,YAAmB,OAAO,GAAG,qCAAqC;QAChE,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,OAAO;YACP,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD,YAAmB,OAAyB;QAC1C,KAAK,CAAC;YACJ,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,kBAAkB;IACpD,YAAmB,OAAO,GAAG,oDAAoD;QAC/E,KAAK,CAAC;YACJ,IAAI,EAAE,oBAAoB;YAC1B,OAAO;YACP,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,WAAY,SAAQ,kBAAkB;IACjD,YAAmB,UAAkB,EAAE,OAAgB;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,OAAO,IAAI,4BAA4B,UAAU,IAAI;YAC9D,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;YAChC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/public/identity.d.ts

@@ -0,0 +1,40 @@
+import type { Identity, IdentityType } from './types.js';
+export interface IdentityOptions {
+    readonly id: string;
+    readonly type?: IdentityType | undefined;
+    readonly isAuthenticated?: boolean | undefined;
+    readonly isSuperuser?: boolean | undefined;
+    readonly roles?: readonly string[] | undefined;
+    readonly permissions?: readonly string[] | undefined;
+    readonly tenantId?: string | undefined;
+    readonly metadata?: Readonly<Record<string, unknown>> | undefined;
+}
+export declare abstract class BaseIdentity implements Identity {
+    readonly id: string;
+    readonly type: IdentityType;
+    readonly isAuthenticated: boolean;
+    readonly isSuperuser: boolean;
+    readonly roles: readonly string[];
+    readonly permissions: readonly string[];
+    readonly tenantId?: string | undefined;
+    readonly metadata: Readonly<Record<string, unknown>>;
+    constructor(options: IdentityOptions);
+    hasRole(role: string): boolean;
+    hasPermission(permission: string): boolean;
+    toJSON(): Record<string, unknown>;
+}
+export declare class UserIdentity extends BaseIdentity {
+    constructor(options: Omit<IdentityOptions, 'isAuthenticated' | 'type'> & {
+        type?: IdentityType;
+    });
+}
+export declare class AnonymousIdentity extends BaseIdentity {
+    constructor();
+}
+export declare class SystemIdentity extends BaseIdentity {
+    constructor(options?: Partial<Omit<IdentityOptions, 'id' | 'type' | 'isAuthenticated' | 'isSuperuser'>>);
+}
+export declare class ServiceAccountIdentity extends BaseIdentity {
+    constructor(options: Omit<IdentityOptions, 'isAuthenticated' | 'type'>);
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/public/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/public/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACnE;AAED,8BAAsB,YAAa,YAAW,QAAQ;IACpD,SAAgB,EAAE,EAAE,MAAM,CAAC;IAC3B,SAAgB,IAAI,EAAE,YAAY,CAAC;IACnC,SAAgB,eAAe,EAAE,OAAO,CAAC;IACzC,SAAgB,WAAW,EAAE,OAAO,CAAC;IACrC,SAAgB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,SAAgB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,SAAgB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,SAAgB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBAEzC,OAAO,EAAE,eAAe;IAWpC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO9B,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAuB1C,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAYzC;AAED,qBAAa,YAAa,SAAQ,YAAY;gBAE1C,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,MAAM,CAAC,GAAG;QAAE,IAAI,CAAC,EAAE,YAAY,CAAA;KAAE;CAQvF;AAED,qBAAa,iBAAkB,SAAQ,YAAY;;CAWlD;AAED,qBAAa,cAAe,SAAQ,YAAY;gBAE5C,OAAO,GAAE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,GAAG,MAAM,GAAG,iBAAiB,GAAG,aAAa,CAAC,CAAM;CAYlG;AAED,qBAAa,sBAAuB,SAAQ,YAAY;gBACnC,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,MAAM,CAAC;CAO9E"}

package/dist/public/identity.js

@@ -0,0 +1,102 @@
+export class BaseIdentity {
+    id;
+    type;
+    isAuthenticated;
+    isSuperuser;
+    roles;
+    permissions;
+    tenantId;
+    metadata;
+    constructor(options) {
+        this.id = options.id;
+        this.type = options.type ?? 'user';
+        this.isAuthenticated = options.isAuthenticated ?? false;
+        this.isSuperuser = options.isSuperuser ?? false;
+        this.roles = Object.freeze([...(options.roles ?? [])]);
+        this.permissions = Object.freeze([...(options.permissions ?? [])]);
+        this.tenantId = options.tenantId;
+        this.metadata = Object.freeze({ ...(options.metadata ?? {}) });
+    }
+    hasRole(role) {
+        if (this.isSuperuser) {
+            return true;
+        }
+        return this.roles.includes(role);
+    }
+    hasPermission(permission) {
+        if (this.isSuperuser) {
+            return true;
+        }
+        if (this.permissions.includes('*')) {
+            return true;
+        }
+        if (this.permissions.includes(permission)) {
+            return true;
+        }
+        // Wildcard matching: e.g. "users.*" matches "users.read"
+        const dotIndex = permission.indexOf('.');
+        if (dotIndex !== -1) {
+            const namespace = permission.slice(0, dotIndex);
+            if (this.permissions.includes(`${namespace}.*`)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    toJSON() {
+        return {
+            id: this.id,
+            type: this.type,
+            isAuthenticated: this.isAuthenticated,
+            isSuperuser: this.isSuperuser,
+            roles: this.roles,
+            permissions: this.permissions,
+            tenantId: this.tenantId,
+            metadata: this.metadata,
+        };
+    }
+}
+export class UserIdentity extends BaseIdentity {
+    constructor(options) {
+        super({
+            ...options,
+            type: options.type ?? 'user',
+            isAuthenticated: true,
+        });
+    }
+}
+export class AnonymousIdentity extends BaseIdentity {
+    constructor() {
+        super({
+            id: 'anonymous',
+            type: 'anonymous',
+            isAuthenticated: false,
+            isSuperuser: false,
+            roles: [],
+            permissions: [],
+        });
+    }
+}
+export class SystemIdentity extends BaseIdentity {
+    constructor(options = {}) {
+        super({
+            ...options,
+            id: 'system',
+            type: 'system',
+            isAuthenticated: true,
+            isSuperuser: true,
+            roles: ['system'],
+            permissions: ['*'],
+        });
+    }
+}
+export class ServiceAccountIdentity extends BaseIdentity {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'service_account',
+            isAuthenticated: true,
+        });
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/public/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/public/identity.ts"],"names":[],"mappings":"AAaA,MAAM,OAAgB,YAAY;IAChB,EAAE,CAAS;IACX,IAAI,CAAe;IACnB,eAAe,CAAU;IACzB,WAAW,CAAU;IACrB,KAAK,CAAoB;IACzB,WAAW,CAAoB;IAC/B,QAAQ,CAAsB;IAC9B,QAAQ,CAAoC;IAE5D,YAAmB,OAAwB;QACzC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;QACnC,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,KAAK,CAAC;QACxD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,OAAO,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEM,aAAa,CAAC,UAAkB;QACrC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,MAAM;QACX,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,YAAa,SAAQ,YAAY;IAC5C,YACE,OAAoF;QAEpF,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;YAC5B,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,YAAY;IACjD;QACE,KAAK,CAAC;YACJ,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,KAAK;YAClB,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,YAAY;IAC9C,YACE,UAA6F,EAAE;QAE/F,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,QAAQ;YACd,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,QAAQ,CAAC;YACjB,WAAW,EAAE,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,YAAY;IACtD,YAAmB,OAA0D;QAC3E,KAAK,CAAC;YACJ,GAAG,OAAO;YACV,IAAI,EAAE,iBAAiB;YACvB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/public/index.d.ts

@@ -0,0 +1,23 @@
+export type { Identity, IdentityType, AuthenticationResult, AuthenticationStatus, IAuthenticationStrategy, AuthContext, Session, CreateSessionData, ISessionStore, AuthorizationDecision, PolicyResult, IPolicy, ResourceResolver, } from './types.js';
+export { type AuthErrorOptions, AuthenticationError, UnauthenticatedError, InvalidCredentialsError, TokenExpiredError, SessionExpiredError, AuthorizationError, ForbiddenError, PolicyError, } from './errors.js';
+export { type IdentityOptions, BaseIdentity, UserIdentity, AnonymousIdentity, SystemIdentity, ServiceAccountIdentity, } from './identity.js';
+export { type IPasswordHasher, type ScryptOptions, ScryptPasswordHasher, } from './authentication/password.js';
+export { type JwtAlgorithm, type JwtHeader, type JwtPayload, type JwtSignOptions, type JwtVerifyOptions, type ITokenRevocationStore, MemoryTokenRevocationStore, JwtService, } from './authentication/jwt.js';
+export { type SessionAuthStrategyOptions, MemorySessionStore, SessionAuthenticationStrategy, } from './authentication/session.js';
+export { type TotpSetupOptions, type TotpSecretResult, type TotpVerifyOptions, TotpService, base32Encode, base32Decode, } from './authentication/totp.js';
+export { type ITokenVerifier, type BearerAuthStrategyOptions, JwtTokenVerifier, BearerTokenAuthenticationStrategy, } from './authentication/bearer.js';
+export { type IApiKeyVerifier, type ApiKeyAuthStrategyOptions, ApiKeyAuthenticationStrategy, } from './authentication/api-key.js';
+export { type AuthenticationManagerOptions, AuthenticationManager, } from './authentication/manager.js';
+export { AuthDecision } from './authorization/decision.js';
+export { type PermissionDefinition, PermissionRegistry } from './authorization/permission.js';
+export { type RoleDefinition, RoleRegistry } from './authorization/role.js';
+export { BasePolicy, PolicyRegistry } from './authorization/policy.js';
+export { AndPolicy, OrPolicy, NotPolicy, andPolicy, orPolicy, notPolicy, } from './authorization/composite.js';
+export { type AuthorizationManagerOptions, type AuthorizeOptions, AuthorizationManager, } from './authorization/manager.js';
+export { AUTH_CONTEXT_STATE_KEY, setAuthContext, getAuthContext, getIdentity, requireIdentity, } from './context/auth-context.js';
+export { type AuthenticateOptions, authenticate } from './middleware/authenticate.js';
+export { type AuthorizeMiddlewareOptions, authorize } from './middleware/authorize.js';
+export { timingSafeEqualString } from '../internal/timing.js';
+export { CryptoUtils } from '../internal/crypto-utils.js';
+export { Base64Url } from '../internal/base64url.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/public/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/public/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,WAAW,EACX,OAAO,EACP,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,eAAe,EACpB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,KAAK,0BAA0B,EAC/B,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,WAAW,EACX,YAAY,EACZ,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,KAAK,4BAA4B,EACjC,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,KAAK,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAE9F,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAE,KAAK,0BAA0B,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAGvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/public/index.js

@@ -0,0 +1,29 @@
+// Errors
+export { AuthenticationError, UnauthenticatedError, InvalidCredentialsError, TokenExpiredError, SessionExpiredError, AuthorizationError, ForbiddenError, PolicyError, } from './errors.js';
+// Identity
+export { BaseIdentity, UserIdentity, AnonymousIdentity, SystemIdentity, ServiceAccountIdentity, } from './identity.js';
+// Authentication
+export { ScryptPasswordHasher, } from './authentication/password.js';
+export { MemoryTokenRevocationStore, JwtService, } from './authentication/jwt.js';
+export { MemorySessionStore, SessionAuthenticationStrategy, } from './authentication/session.js';
+export { TotpService, base32Encode, base32Decode, } from './authentication/totp.js';
+export { JwtTokenVerifier, BearerTokenAuthenticationStrategy, } from './authentication/bearer.js';
+export { ApiKeyAuthenticationStrategy, } from './authentication/api-key.js';
+export { AuthenticationManager, } from './authentication/manager.js';
+// Authorization
+export { AuthDecision } from './authorization/decision.js';
+export { PermissionRegistry } from './authorization/permission.js';
+export { RoleRegistry } from './authorization/role.js';
+export { BasePolicy, PolicyRegistry } from './authorization/policy.js';
+export { AndPolicy, OrPolicy, NotPolicy, andPolicy, orPolicy, notPolicy, } from './authorization/composite.js';
+export { AuthorizationManager, } from './authorization/manager.js';
+// Context Helpers
+export { AUTH_CONTEXT_STATE_KEY, setAuthContext, getAuthContext, getIdentity, requireIdentity, } from './context/auth-context.js';
+// Middleware
+export { authenticate } from './middleware/authenticate.js';
+export { authorize } from './middleware/authorize.js';
+// Utilities
+export { timingSafeEqualString } from '../internal/timing.js';
+export { CryptoUtils } from '../internal/crypto-utils.js';
+export { Base64Url } from '../internal/base64url.js';
+//# sourceMappingURL=index.js.map

package/dist/public/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/public/index.ts"],"names":[],"mappings":"AAiBA,SAAS;AACT,OAAO,EAEL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,WAAW;AACX,OAAO,EAEL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EAGL,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAOL,0BAA0B,EAC1B,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAEL,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAIL,WAAW,EACX,YAAY,EACZ,YAAY,GACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,gBAAgB,EAChB,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAGL,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAA6B,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAE9F,OAAO,EAAuB,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,GACV,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAEnC,aAAa;AACb,OAAO,EAA4B,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEtF,OAAO,EAAmC,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEvF,YAAY;AACZ,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/public/middleware/authenticate.d.ts

@@ -0,0 +1,10 @@
+import type { MiddlewareHandler } from '@jsango/middleware';
+import { AuthenticationManager } from '../authentication/manager.js';
+import type { IAuthenticationStrategy } from '../types.js';
+export interface AuthenticateOptions {
+    readonly manager?: AuthenticationManager | undefined;
+    readonly strategies?: readonly IAuthenticationStrategy[] | undefined;
+    readonly required?: boolean | undefined;
+}
+export declare function authenticate(optionsOrManager?: AuthenticationManager | AuthenticateOptions): MiddlewareHandler;
+//# sourceMappingURL=authenticate.d.ts.map

package/dist/public/middleware/authenticate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/public/middleware/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAS5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,KAAK,EAAE,uBAAuB,EAAe,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,uBAAuB,EAAE,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,wBAAgB,YAAY,CAC1B,gBAAgB,CAAC,EAAE,qBAAqB,GAAG,mBAAmB,GAC7D,iBAAiB,CAkEnB"}

package/dist/public/middleware/authenticate.js

@@ -0,0 +1,65 @@
+import { AuthenticationError, UnauthenticatedError, InvalidCredentialsError, TokenExpiredError, SessionExpiredError, } from '../errors.js';
+import { AuthenticationManager } from '../authentication/manager.js';
+import { setAuthContext } from '../context/auth-context.js';
+export function authenticate(optionsOrManager) {
+    let manager;
+    let required = true;
+    if (optionsOrManager instanceof AuthenticationManager) {
+        manager = optionsOrManager;
+    }
+    else if (optionsOrManager) {
+        if (optionsOrManager.manager) {
+            manager = optionsOrManager.manager;
+        }
+        else {
+            manager = new AuthenticationManager({
+                strategies: optionsOrManager.strategies,
+            });
+        }
+        if (optionsOrManager.required !== undefined) {
+            required = optionsOrManager.required;
+        }
+    }
+    else {
+        manager = new AuthenticationManager();
+    }
+    return async (ctx, next) => {
+        const result = await manager.authenticate(ctx.request, ctx);
+        const authContext = {
+            identity: result.identity,
+            result,
+            strategyUsed: result.strategy,
+            tenantId: result.identity.tenantId,
+            metadata: result.metadata ?? {},
+        };
+        setAuthContext(ctx, authContext);
+        if (result.status === 'authenticated') {
+            return (await next());
+        }
+        // If authentication is optional (required === false), allow anonymous request to proceed
+        if (!required) {
+            return (await next());
+        }
+        // Required authentication failed - throw appropriate structured 401 error
+        switch (result.status) {
+            case 'unauthenticated':
+                throw new UnauthenticatedError('Authentication credentials were not provided.');
+            case 'invalid_credentials':
+                throw new InvalidCredentialsError(result.error?.message ?? 'Invalid authentication credentials provided.');
+            case 'expired_credentials':
+                if (result.strategy === 'session') {
+                    throw new SessionExpiredError();
+                }
+                throw new TokenExpiredError();
+            case 'malformed_credentials':
+                throw new AuthenticationError({
+                    code: 'ERR_AUTH_MALFORMED_CREDENTIALS',
+                    message: 'Malformed or invalid authentication credentials format.',
+                    statusCode: 401,
+                });
+            default:
+                throw new UnauthenticatedError('Authentication failed.');
+        }
+    };
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/public/middleware/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/public/middleware/authenticate.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAS5D,MAAM,UAAU,YAAY,CAC1B,gBAA8D;IAE9D,IAAI,OAA8B,CAAC;IACnC,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,IAAI,gBAAgB,YAAY,qBAAqB,EAAE,CAAC;QACtD,OAAO,GAAG,gBAAgB,CAAC;IAC7B,CAAC;SAAM,IAAI,gBAAgB,EAAE,CAAC;QAC5B,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7B,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,qBAAqB,CAAC;gBAClC,UAAU,EAAE,gBAAgB,CAAC,UAAU;aACxC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5C,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,KAAK,EAAE,GAAmB,EAAE,IAAiC,EAAyB,EAAE;QAC7F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAgB;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;YACN,YAAY,EAAE,MAAM,CAAC,QAAQ;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;SAChC,CAAC;QAEF,cAAc,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEjC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACxC,CAAC;QAED,yFAAyF;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;QACxC,CAAC;QAED,0EAA0E;QAC1E,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,iBAAiB;gBACpB,MAAM,IAAI,oBAAoB,CAAC,+CAA+C,CAAC,CAAC;YAClF,KAAK,qBAAqB;gBACxB,MAAM,IAAI,uBAAuB,CAC/B,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,8CAA8C,CACxE,CAAC;YACJ,KAAK,qBAAqB;gBACxB,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,mBAAmB,EAAE,CAAC;gBAClC,CAAC;gBACD,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,KAAK,uBAAuB;gBAC1B,MAAM,IAAI,mBAAmB,CAAC;oBAC5B,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,yDAAyD;oBAClE,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;YACL;gBACE,MAAM,IAAI,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/public/middleware/authorize.d.ts

@@ -0,0 +1,11 @@
+import type { MiddlewareHandler } from '@jsango/middleware';
+import { AuthorizationManager } from '../authorization/manager.js';
+import type { ResourceResolver, IPolicy } from '../types.js';
+export interface AuthorizeMiddlewareOptions<TResource = unknown> {
+    readonly action?: string | undefined;
+    readonly resource?: TResource | ResourceResolver<TResource> | undefined;
+    readonly policy?: string | IPolicy<TResource> | undefined;
+    readonly manager?: AuthorizationManager | undefined;
+}
+export declare function authorize<TResource = unknown>(action: string, optionsOrResolver?: AuthorizeMiddlewareOptions<TResource> | ResourceResolver<TResource>): MiddlewareHandler;
+//# sourceMappingURL=authorize.d.ts.map

package/dist/public/middleware/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../src/public/middleware/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,0BAA0B,CAAC,SAAS,GAAG,OAAO;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACrD;AAED,wBAAgB,SAAS,CAAC,SAAS,GAAG,OAAO,EAC3C,MAAM,EAAE,MAAM,EACd,iBAAiB,CAAC,EAAE,0BAA0B,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,GACtF,iBAAiB,CA8CnB"}

package/dist/public/middleware/authorize.js

@@ -0,0 +1,42 @@
+import { UnauthenticatedError, ForbiddenError } from '../errors.js';
+import { AuthorizationManager } from '../authorization/manager.js';
+import { getAuthContext, getIdentity } from '../context/auth-context.js';
+export function authorize(action, optionsOrResolver) {
+    let manager;
+    let resourceOrResolver;
+    let policyOverride;
+    if (typeof optionsOrResolver === 'function') {
+        resourceOrResolver = optionsOrResolver;
+        manager = new AuthorizationManager();
+    }
+    else if (optionsOrResolver) {
+        manager = optionsOrResolver.manager ?? new AuthorizationManager();
+        resourceOrResolver = optionsOrResolver.resource;
+        policyOverride = optionsOrResolver.policy;
+    }
+    else {
+        manager = new AuthorizationManager();
+    }
+    return async (ctx, next) => {
+        const identity = getIdentity(ctx);
+        // If request has not been authenticated, must return 401 Unauthorized, NOT 403 Forbidden
+        if (!identity.isAuthenticated) {
+            throw new UnauthenticatedError('Authentication is required before accessing this protected resource.');
+        }
+        // Resolve resource if resolver function provided
+        let resolvedResource = resourceOrResolver;
+        if (typeof resourceOrResolver === 'function') {
+            resolvedResource = await resourceOrResolver(ctx);
+        }
+        const authContext = getAuthContext(ctx);
+        const decision = await manager.authorize(identity, action, resolvedResource, {
+            context: authContext,
+            policy: policyOverride,
+        });
+        if (!decision.allowed) {
+            throw new ForbiddenError(decision.reason ?? `Access forbidden: not authorized for action "${action}".`);
+        }
+        return (await next());
+    };
+}
+//# sourceMappingURL=authorize.js.map

package/dist/public/middleware/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/public/middleware/authorize.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAUzE,MAAM,UAAU,SAAS,CACvB,MAAc,EACd,iBAAuF;IAEvF,IAAI,OAA6B,CAAC;IAClC,IAAI,kBAAuE,CAAC;IAC5E,IAAI,cAAuD,CAAC;IAE5D,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC5C,kBAAkB,GAAG,iBAAgD,CAAC;QACtE,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,iBAAiB,EAAE,CAAC;QAC7B,OAAO,GAAG,iBAAiB,CAAC,OAAO,IAAI,IAAI,oBAAoB,EAAE,CAAC;QAClE,kBAAkB,GAAG,iBAAiB,CAAC,QAAQ,CAAC;QAChD,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACvC,CAAC;IAED,OAAO,KAAK,EAAE,GAAmB,EAAE,IAAiC,EAAyB,EAAE;QAC7F,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAElC,yFAAyF;QACzF,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,oBAAoB,CAC5B,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,gBAAgB,GAAY,kBAAkB,CAAC;QACnD,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC7C,gBAAgB,GAAG,MAAO,kBAAkD,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAC3E,OAAO,EAAE,WAAW;YACpB,MAAM,EAAE,cAA8C;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,QAAQ,CAAC,MAAM,IAAI,gDAAgD,MAAM,IAAI,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,EAAE,CAAiB,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}