@north-light/plugin 0.3.486 → 0.3.487

package/dist/verify.js

@@ -1 +1 @@
-var f=Object.defineProperty;var n=(e,r)=>f(e,"name",{value:r,configurable:!0});import{JwksCache as h,verifyOutboundToken as l}from"@north-light/identity";import{kitLeafError as d}from"./errors.js";const b=/^[A-Za-z0-9_-]{1,64}$/;function w(e){if(e.providerId===void 0)return;const r=typeof e.providerId=="string"&&e.providerId.startsWith("app:")?e.providerId.slice(4):e.providerId;if(typeof r!="string"||!b.test(r))throw new Error("createFetchHandler auth.providerId must be a provider id (1-64 characters of A-Z a-z 0-9 _ -), bare or as app:<id>");return r}n(w,"normalizeProviderId");function v(e){if(typeof e!="object"||e===null)throw new Error("createFetchHandler auth must be {issuer, audience}");if(typeof e.issuer!="string"||e.issuer==="")throw new Error("createFetchHandler auth.issuer must be a non-empty string");if(typeof e.audience!="string"||e.audience==="")throw new Error("createFetchHandler auth.audience must be a non-empty string");w(e);const{issuer:r,audience:c}=e,u=new h(r,(s,i)=>fetch(s,i),`${r.replace(/\/+$/,"")}/.well-known/jwks.json`);return async s=>{const i=/^Bearer ([^\s]+)$/.exec(s.headers.get("authorization")??"");if(i===null)throw a("The request carries no bearer token.");let t;try{t=await l({token:i[1],jwks:u,issuer:r,audience:c})}catch{throw a("The bearer token is not a valid outbound token for this provider.")}const o=t.payer;if(o!==void 0&&!/^(user|app):[A-Za-z0-9_-]{1,64}$/.test(String(o)))throw a("The bearer token is not a valid outbound token for this provider.");return Object.freeze({sub:t.sub,grantee:t.grantee,payer:o===void 0?t.sub:String(o),clientId:t.client_id,scope:Object.freeze(t.scope.split(" ").filter(p=>p.length>0)),initiatingApp:t.initiating_app,act:t.act,jti:t.jti})}}n(v,"createCallerVerifier");function y(e,r){return d({code:"scope_missing",status:403,message:`The token does not carry ${e}, which this command needs.`,field:e,received:e,...r!==void 0?{next:`Set auth.providerId to your app's client id (${r}).`}:{}})}n(y,"scopeMissing");function a(e){return d({code:"unauthorized",status:401,message:e,next:"Send a current outbound token for this provider as Authorization: Bearer <token>."})}n(a,"unauthorized");export{v as createCallerVerifier,w as normalizeProviderId,y as scopeMissing};
+var I=Object.defineProperty;var t=(e,r)=>I(e,"name",{value:r,configurable:!0});import{JwksCache as z,verifyCallToken as A}from"@north-light/identity";import{kitLeafError as b}from"./errors.js";const j=/^[A-Za-z0-9_-]{1,64}$/,_=/^(app|user):[A-Za-z0-9_-]{1,64}$/,w=t(e=>typeof e=="string"&&_.test(e),"isAppOrUser"),y=t(e=>typeof e=="string"&&e!=="","isNonEmpty");function $(e){if(e.providerId===void 0)return;const r=typeof e.providerId=="string"&&e.providerId.startsWith("app:")?e.providerId.slice(4):e.providerId;if(typeof r!="string"||!j.test(r))throw new Error("createFetchHandler auth.providerId must be a provider id (1-64 characters of A-Z a-z 0-9 _ -), bare or as app:<id>");return r}t($,"normalizeProviderId");function C(e){if(typeof e!="object"||e===null)throw new Error("createFetchHandler auth must be {issuer, audience}");if(typeof e.issuer!="string"||e.issuer==="")throw new Error("createFetchHandler auth.issuer must be a non-empty string");if(typeof e.audience!="string"||e.audience==="")throw new Error("createFetchHandler auth.audience must be a non-empty string");$(e);const{issuer:r,audience:g}=e,m=new z(r,(d,n)=>fetch(d,n),`${r.replace(/\/+$/,"")}/.well-known/jwks.json`);return async d=>{const n=/^Bearer ([^\s]+)$/.exec(d.headers.get("authorization")??"");if(n===null)throw a("The request carries no bearer token.");let i;try{i=await A({token:n[1],jwks:m,issuer:r,audience:g})}catch{throw a("The bearer token is not a valid outbound token for this provider.")}const{claims:c,chain:k,scope:p}=i,{grantee:u,initiating_app:f,jti:h,act:l}=c,o=l;if(p===void 0||!w(u)||!w(f)||!y(h)||k.length===0||typeof o!="object"||o===null||Array.isArray(o)||!y(o.sub))throw a("The bearer token is not a valid outbound token for this provider.");const s=c.payer;if(s!==void 0&&!/^(user|app):[A-Za-z0-9_-]{1,64}$/.test(String(s)))throw a("The bearer token is not a valid outbound token for this provider.");return Object.freeze({sub:i.sub,grantee:u,payer:s===void 0?i.sub:String(s),clientId:c.client_id,scope:Object.freeze(p.split(" ").filter(v=>v.length>0)),initiatingApp:f,act:l,jti:h})}}t(C,"createCallerVerifier");function F(e,r){return b({code:"scope_missing",status:403,message:`The token does not carry ${e}, which this command needs.`,field:e,received:e,...r!==void 0?{next:`Set auth.providerId to your app's client id (${r}).`}:{}})}t(F,"scopeMissing");function a(e){return b({code:"unauthorized",status:401,message:e,next:"Send a current outbound token for this provider as Authorization: Bearer <token>."})}t(a,"unauthorized");export{C as createCallerVerifier,$ as normalizeProviderId,F as scopeMissing};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/plugin",
-  "version": "0.3.486",
+  "version": "0.3.487",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,8 +23,8 @@
     "postpack": "node ../../scripts/pack-minify.mjs postpack packages/crouter-plugin"
   },
   "dependencies": {
-    "@north-light/api": "0.3.486",
-    "@north-light/identity": "0.3.486"
+    "@north-light/api": "0.3.487",
+    "@north-light/identity": "0.3.487"
   },
   "license": "UNLICENSED",
   "publishConfig": {