@openstax/ts-utils 1.21.11 → 1.23.0

package/dist/esm/services/accountsGateway/index.d.ts

@@ -0,0 +1,85 @@
+import { ConfigProviderForConfig } from '../../config';
+import { GenericFetch } from '../../fetch';
+import { JsonCompatibleStruct } from '../../routing';
+import { ApiUser, ConsentPreferences } from '../authProvider';
+import { Logger } from '../logger';
+export declare type Config = {
+    accountsBase: string;
+    accountsAuthToken: string;
+};
+interface Initializer<C> {
+    configSpace?: C;
+    fetch: GenericFetch;
+}
+export declare type FindUserPayload = ({
+    external_id: string;
+} | {
+    uuid: string;
+}) & {
+    sso?: string;
+};
+export declare type FindOrCreateUserPayload = {
+    external_id: string;
+    email?: string;
+    already_verified?: boolean;
+    first_name?: string;
+    last_name?: string;
+    full_name?: string;
+    salesforce_contact_id?: string;
+    faculty_status?: string;
+    role?: string;
+    school_type?: string;
+    is_test?: boolean;
+    sso?: string;
+};
+export declare type FindOrCreateUserResponse = {
+    id: number;
+    uuid: string;
+    external_ids: string[];
+    is_test: boolean;
+    sso: string;
+};
+export declare type FindUserResponse = (FindOrCreateUserResponse & {
+    external_ids: string[];
+}) | undefined;
+export declare type LinkUserPayload = {
+    userId: number;
+    externalId: string;
+};
+export declare type LinkUserResponse = {
+    user_id: number;
+    external_id: string;
+};
+export declare type SearchUsersPayload = {
+    q: string;
+    order_by?: string;
+};
+export declare type SearchUsersResponse = {
+    items: Array<ApiUser & {
+        external_ids: string[];
+    } & JsonCompatibleStruct>;
+    total_count: number;
+};
+export declare type UpdateUserPayload = ConsentPreferences;
+export declare type MappedUserInfo<T> = {
+    data: T;
+    fullName: string;
+    platformUserId?: string;
+    uuid: string;
+};
+export declare const accountsGateway: <C extends string = "accounts">(initializer: Initializer<C>) => (configProvider: { [key in C]: {
+    accountsBase: import("../../config").ConfigValueProvider<string>;
+    accountsAuthToken: import("../../config").ConfigValueProvider<string>;
+}; }) => {
+    findOrCreateUser: (body: FindOrCreateUserPayload) => Promise<FindOrCreateUserResponse>;
+    findUser: (body: FindUserPayload) => Promise<FindUserResponse>;
+    getUser: (token: string) => Promise<ApiUser & JsonCompatibleStruct>;
+    linkUser: (body: LinkUserPayload) => Promise<LinkUserResponse>;
+    mapUserUuids: <T>(userUuidsMap: {
+        [uuid: string]: T;
+    }, logger: Logger, platformId?: string | undefined) => Promise<MappedUserInfo<T>[]>;
+    searchUsers: (payload: SearchUsersPayload) => Promise<SearchUsersResponse>;
+    updateUser: (token: string, body: UpdateUserPayload) => Promise<ApiUser & JsonCompatibleStruct>;
+};
+export declare type AccountsGateway = ReturnType<ReturnType<typeof accountsGateway>>;
+export {};

package/dist/esm/services/accountsGateway/index.js

@@ -0,0 +1,111 @@
+import { chunk, isEqual } from 'lodash';
+import queryString from 'query-string';
+import { resolveConfigValue } from '../../config';
+import { ifDefined } from '../../guards';
+import { METHOD } from '../../routing';
+import { Level } from '../logger';
+class ApiError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+export const accountsGateway = (initializer) => (configProvider) => {
+    const config = configProvider[ifDefined(initializer.configSpace, 'accounts')];
+    const accountsBase = resolveConfigValue(config.accountsBase);
+    const accountsAuthToken = resolveConfigValue(config.accountsAuthToken);
+    const request = async (method, path, options, statuses = [200, 201]) => {
+        const host = (await accountsBase).replace(/\/+$/, '');
+        const url = `${host}/api/${path}`;
+        const config = {
+            headers: {
+                Authorization: `Bearer ${options.token || await accountsAuthToken}`,
+            },
+            method,
+        };
+        if (options.body) {
+            config.body = JSON.stringify(options.body);
+        }
+        const response = await initializer.fetch(url, config);
+        if (!statuses.includes(response.status)) {
+            throw new ApiError(`Received unexpected status code ${response.status} for Accounts API call: ${method} ${url}`, response.status);
+        }
+        return response.json();
+    };
+    const findOrCreateUser = async (body) => request(METHOD.POST, 'user/find-or-create', { body });
+    const findUser = async (body) => {
+        try {
+            return await request(METHOD.POST, 'user/find', { body });
+        }
+        catch (error) {
+            if (error instanceof ApiError && error.status === 404) {
+                return undefined;
+            }
+            else {
+                throw error;
+            }
+        }
+    };
+    const getUser = async (token) => request(METHOD.GET, 'user', { token });
+    const linkUser = async (body) => request(METHOD.POST, 'user/external-ids', {
+        body: {
+            external_id: body.externalId,
+            user_id: body.userId,
+        }
+    });
+    const searchUsers = async (payload) => request(METHOD.GET, `users?${queryString.stringify(payload)}`, {});
+    const updateUser = async (token, body) => request(METHOD.PUT, 'user', { body, token });
+    const getPlatformUserId = (externalIds, platformId) => {
+        for (const externalId of externalIds) {
+            const [userPlatformId, userId] = externalId.split('/', 2);
+            if (userPlatformId === platformId) {
+                return userId;
+            }
+        }
+    };
+    /*
+     * If a platformId is given, returns an array where
+     * the first element is the user id from the platform
+     * and the second is the value from the map
+     * Otherwise, returns an array where
+     * the first element is the user's full_name
+     * and the second is the value from the map
+     */
+    const mapUserUuids = async (userUuidsMap, logger, platformId) => {
+        const results = [];
+        // Accounts will not return any results if this search returns more than 10 users
+        const chunkedUuids = chunk(Object.keys(userUuidsMap), 10);
+        await Promise.all(chunkedUuids.map(async (uuids) => {
+            const { items } = await searchUsers({ q: uuids.map((uuid) => `uuid:${uuid}`).join(' ') });
+            const accountsUuids = items.map((user) => user.uuid);
+            if (!isEqual(accountsUuids.sort(), uuids.sort())) {
+                logger.logEvent(Level.Warn, {
+                    message: 'Unexpected Accounts user search results',
+                    uuids,
+                    accountsUuids,
+                });
+            }
+            items.forEach((user) => {
+                const platformUserId = platformId ? getPlatformUserId(user.external_ids, platformId) : undefined;
+                if (platformId && !platformUserId) {
+                    logger.logEvent(Level.Warn, {
+                        message: 'Accounts user has no external_id matching the given platformId',
+                        accountsUuid: user.uuid,
+                        platformId,
+                    });
+                }
+                if (!user.full_name) {
+                    logger.logEvent(Level.Warn, {
+                        message: 'Accounts user has no full_name',
+                        accountsUuid: user.uuid,
+                    });
+                }
+                results.push({
+                    data: userUuidsMap[user.uuid], fullName: user.full_name, platformUserId, uuid: user.uuid,
+                });
+            });
+        }));
+        return results;
+    };
+    return { findOrCreateUser, findUser, getUser, linkUser, mapUserUuids, searchUsers, updateUser };
+};

package/dist/esm/services/apiGateway/index.d.ts

@@ -0,0 +1,63 @@
+import { Headers } from 'node-fetch';
+import { ConfigProviderForConfig } from '../../config';
+import { ConfigForFetch, GenericFetch, Response } from '../../fetch';
+import { AnyRoute, ApiResponse, OutputForRoute, ParamsForRoute, PayloadForRoute, QueryParams } from '../../routing';
+import { UnwrapPromise } from '../../types';
+import { Logger } from '../logger';
+declare type TResponsePayload<R> = R extends ApiResponse<any, infer P> ? P : never;
+declare type TResponseStatus<R> = R extends ApiResponse<infer S, any> ? S : never;
+declare type RouteClient<R> = {
+    (config: {
+        fetchConfig?: any;
+        query?: QueryParams;
+    } & (ParamsForRoute<R> extends undefined ? {} : {
+        params: ParamsForRoute<R>;
+    }) & (PayloadForRoute<R> extends undefined ? {} : {
+        payload: PayloadForRoute<R>;
+    })): Promise<UnsafeApiClientResponse<UnwrapPromise<OutputForRoute<R>>>>;
+    renderUrl: (config: {
+        query?: QueryParams;
+    } & (ParamsForRoute<R> extends undefined ? {} : {
+        params: ParamsForRoute<R>;
+    })) => Promise<string>;
+};
+interface AcceptStatus<Ro> {
+    <S extends TResponseStatus<Ro>[]>(...args: S): Promise<ApiClientResponse<Extract<Ro, Record<'statusCode', S[number]>>>>;
+    <S extends number[]>(...args: S): Promise<ApiClientResponse<any>>;
+}
+declare type UnsafeApiClientResponse<Ro> = {
+    headers: Headers;
+    load: () => Promise<any>;
+    status: number;
+    acceptStatus: AcceptStatus<Ro>;
+};
+declare type ApiClientResponse<Ro> = Ro extends any ? {
+    headers: Headers;
+    status: TResponseStatus<Ro>;
+    load: () => Promise<TResponsePayload<Ro>>;
+} : never;
+declare type MapRoutesToClient<Ru> = [Ru] extends [AnyRoute<Ru>] ? {
+    [N in Ru['name']]: RouteClient<Extract<Ru, Record<'name', N>>>;
+} : never;
+declare type MapRoutesToConfig<Ru> = [Ru] extends [AnyRoute<Ru>] ? {
+    [N in Ru['name']]: {
+        path: string;
+        method: string;
+    };
+} : never;
+/** Pulls the content out of a response based on the content type */
+export declare const loadResponse: (response: Response) => () => Promise<any>;
+interface MakeApiGateway<F> {
+    <Ru>(config: ConfigProviderForConfig<{
+        apiBase: string;
+    }>, routes: MapRoutesToConfig<Ru>, appProvider?: {
+        authProvider?: {
+            getAuthorizedFetchConfig: () => Promise<ConfigForFetch<F>>;
+        };
+        logger?: Logger;
+    }): MapRoutesToClient<Ru>;
+}
+export declare const createApiGateway: <F extends GenericFetch<import("../../fetch").FetchConfig, Response>>(initializer: {
+    fetch: F;
+}) => MakeApiGateway<F>;
+export {};

package/dist/esm/services/apiGateway/index.js

@@ -0,0 +1,77 @@
+import * as pathToRegexp from 'path-to-regexp';
+import queryString from 'query-string';
+import { v4 as uuid } from 'uuid';
+import { merge } from '../..';
+import { resolveConfigValue } from '../../config';
+import { ForbiddenError, SessionExpiredError, UnauthorizedError } from '../../errors';
+import { fetchStatusRetry } from '../../fetch/fetchStatusRetry';
+import { Level } from '../logger';
+/** Pulls the content out of a response based on the content type */
+export const loadResponse = (response) => () => {
+    const [contentType] = (response.headers.get('content-type') || '').split(';');
+    switch (contentType) {
+        case 'text/plain':
+            return response.text();
+        case 'application/json':
+            return response.json();
+        default:
+            throw new Error(`unknown content type ${contentType}`);
+    }
+};
+const makeRouteClient = (initializer, config, route, appProvider) => {
+    /* TODO this duplicates code with makeRenderRouteUrl, reuse that */
+    const renderUrl = async ({ params, query }) => {
+        const apiBase = await resolveConfigValue(config.apiBase);
+        const getPathForParams = pathToRegexp.compile(route.path, { encode: encodeURIComponent });
+        const search = query && queryString.stringify(query);
+        return apiBase.replace(/\/+$/, '') + getPathForParams(params || {}) + (search ? `?${search}` : '');
+    };
+    const routeClient = async ({ params, payload, query, fetchConfig }) => {
+        var _a, _b;
+        const { fetch } = initializer;
+        const url = await renderUrl({ params, query });
+        const body = payload ? JSON.stringify(payload) : undefined;
+        const baseOptions = merge((await ((_a = appProvider === null || appProvider === void 0 ? void 0 : appProvider.authProvider) === null || _a === void 0 ? void 0 : _a.getAuthorizedFetchConfig())) || {}, fetchConfig || {});
+        const requestId = uuid();
+        const requestLogger = (_b = appProvider === null || appProvider === void 0 ? void 0 : appProvider.logger) === null || _b === void 0 ? void 0 : _b.createSubContext();
+        requestLogger === null || requestLogger === void 0 ? void 0 : requestLogger.setContext({ requestId, url, timeStamp: new Date().getTime() });
+        const fetcher = fetchStatusRetry(fetch, { retries: 1, status: [502], logger: requestLogger });
+        requestLogger === null || requestLogger === void 0 ? void 0 : requestLogger.log('Request Initiated', Level.Info);
+        return fetcher(url, merge(baseOptions, {
+            method: route.method,
+            body,
+            headers: {
+                ...fetchConfig === null || fetchConfig === void 0 ? void 0 : fetchConfig.headers,
+                ...(body ? { 'content-type': 'application/json' } : {}),
+                'X-Request-ID': requestId,
+            }
+        })).then(response => {
+            if (response.status === 401) {
+                throw new UnauthorizedError();
+            }
+            if (response.status === 403) {
+                throw new ForbiddenError();
+            }
+            if (response.status === 440) {
+                throw new SessionExpiredError();
+            }
+            return {
+                status: response.status,
+                acceptStatus: async (...status) => {
+                    if (!status.includes(response.status)) {
+                        throw new Error(`unexpected HTTP ${response.status} response from api: ${await response.text()}`);
+                    }
+                    return { status: response.status, headers: response.headers, load: loadResponse(response) };
+                },
+                headers: response.headers,
+                load: loadResponse(response),
+            };
+        });
+    };
+    routeClient.renderUrl = renderUrl;
+    return routeClient;
+};
+export const createApiGateway = (initializer) => (config, routes, appProvider) => {
+    return Object.fromEntries(Object.entries(routes)
+        .map(([key, routeConfig]) => ([key, makeRouteClient(initializer, config, routeConfig, appProvider)])));
+};

package/dist/esm/services/authProvider/browser.d.ts

@@ -0,0 +1,74 @@
+import { ConfigProviderForConfig } from '../../config';
+import { FetchConfig, GenericFetch } from '../../fetch';
+import { User } from '.';
+declare type Config = {
+    accountsBase: string;
+};
+interface Initializer<C> {
+    configSpace?: C;
+    window: Window;
+}
+export declare type EventHandler = (e: {
+    data: any;
+    origin: string;
+    source: Pick<Window, 'postMessage'>;
+}) => void;
+export interface Window {
+    fetch: GenericFetch;
+    parent: Pick<Window, 'postMessage'>;
+    location: {
+        search: string;
+    };
+    document: {
+        referrer: string;
+    };
+    postMessage: (data: any, origin: string) => void;
+    addEventListener: (event: 'message', callback: EventHandler) => void;
+    removeEventListener: (event: 'message', callback: EventHandler) => void;
+}
+export declare type UpdatableUserFields = Partial<Pick<User, 'consent_preferences' | 'first_name' | 'last_name'>>;
+export declare const browserAuthProvider: <C extends string = "auth">({ window, configSpace }: Initializer<C>) => (configProvider: { [key in C]: {
+    accountsBase: import("../../config").ConfigValueProvider<string>;
+}; }) => {
+    /**
+     * gets the authentication token
+     */
+    getAuthToken: () => Promise<string | null>;
+    /**
+     * adds auth parameters to the url. this is only safe to use when using javascript to navigate
+     * within the current window, eg `window.location = 'https://my.otherservice.com';` anchors
+     * should use getAuthorizedLinkUrl for their href.
+     *
+     * result unreliable unless `getUser` is resolved first.
+     */
+    getAuthorizedUrl: (urlString: string) => string;
+    /**
+     * all link href-s must be rendered with auth tokens so that they work when opened in a new tab
+     *
+     * result unreliable unless `getUser` is resolved first.
+     */
+    getAuthorizedLinkUrl: (urlString: string) => string;
+    /**
+     * gets an authorized url for an iframe src. sets params on the url and saves its
+     * origin to trust releasing user identity to it
+     */
+    getAuthorizedEmbedUrl: (urlString: string, extraParams?: {
+        [key: string]: string;
+    } | undefined) => string;
+    /**
+     * gets second argument for `fetch` that has authentication token or cookie
+     */
+    getAuthorizedFetchConfig: () => Promise<FetchConfig>;
+    /**
+     * loads current user identity. does not reflect changes in identity after being called the first time.
+     */
+    getUser: () => Promise<User | undefined>;
+    /**
+     * updates user settings, for example the cookie consent preferences
+     */
+    updateUser: (updates: UpdatableUserFields) => Promise<{
+        user: User;
+        token: string | null;
+    }>;
+};
+export {};

package/dist/esm/services/authProvider/browser.js

@@ -0,0 +1,150 @@
+import { once } from '../..';
+import { resolveConfigValue } from '../../config';
+import { ifDefined } from '../../guards';
+import { METHOD, unsafePayloadValidator } from '../../routing';
+import { embeddedAuthProvider, PostMessageTypes } from './utils/embeddedAuthProvider';
+const isUserData = unsafePayloadValidator();
+export const browserAuthProvider = ({ window, configSpace }) => (configProvider) => {
+    const config = configProvider[ifDefined(configSpace, 'auth')];
+    const accountsBase = once(() => resolveConfigValue(config.accountsBase));
+    const queryString = window.location.search;
+    const queryKey = 'auth';
+    const urlSearchParams = new URLSearchParams(queryString);
+    const authQuery = urlSearchParams.get(queryKey);
+    const referrer = window.document.referrer ? new URL(window.document.referrer) : undefined;
+    const isEmbedded = window.parent !== window;
+    const trustedParent = isEmbedded && referrer && referrer.hostname.match(/^(openstax\.org|((.*)(\.openstax\.org|local|localhost)))$/) ? referrer : undefined;
+    const { embeddedQueryKey, embeddedQueryValue, getAuthorizedEmbedUrl } = embeddedAuthProvider(() => getUserData(), { authQuery: { key: queryKey, value: authQuery }, window });
+    const embeddedQuery = urlSearchParams.get(embeddedQueryKey);
+    let userData = { token: authQuery };
+    const getAuthToken = async () => {
+        return (await getUserData()).token;
+    };
+    const getAuthorizedLinkUrl = (urlString) => {
+        const url = new URL(urlString);
+        if (userData.token) {
+            url.searchParams.set(queryKey, userData.token);
+        }
+        return url.href;
+    };
+    const getAuthorizedUrl = (urlString) => {
+        const url = new URL(urlString);
+        if (authQuery) {
+            url.searchParams.set(queryKey, authQuery);
+        }
+        else if (embeddedQuery) {
+            url.searchParams.set(queryKey, 'embedded');
+        }
+        if (embeddedQuery) {
+            url.searchParams.set(embeddedQueryKey, embeddedQuery);
+        }
+        return url.href;
+    };
+    // *note* that this does not actually prevent cookies from being sent on same-origin
+    // requests, i'm not sure if its possible to stop browsers from sending cookies in
+    // that case
+    const getAuthorizedFetchConfigFromData = (data) => {
+        const { token } = data;
+        return token ? {
+            headers: { Authorization: `Bearer ${token}` },
+        } : {
+            credentials: 'include',
+        };
+    };
+    const getAuthorizedFetchConfig = async () => {
+        return getAuthorizedFetchConfigFromData(userData.token ? userData : await getUserData());
+    };
+    /*
+     * requests user identity from parent window via postMessage
+     */
+    const getParentWindowUser = () => new Promise((resolve, reject) => {
+        if (!window.parent || !trustedParent) {
+            return reject(new Error('parent window is undefined or not trusted'));
+        }
+        const handler = (event) => {
+            if (event.data.type === PostMessageTypes.ReceiveUser && event.origin === trustedParent.origin) {
+                clearTimeout(timeout);
+                window.removeEventListener('message', handler);
+                resolve(event.data.userData);
+            }
+        };
+        window.addEventListener('message', handler);
+        window.parent.postMessage({ type: PostMessageTypes.RequestUser }, trustedParent.origin);
+        const timeout = setTimeout(() => {
+            window.removeEventListener('message', handler);
+            reject(new Error('loading user identity timed out'));
+        }, 5000);
+    });
+    /*
+     * requests user identity from accounts api using given token or cookie
+     */
+    const getFetchUser = async () => {
+        const response = await window.fetch((await accountsBase()).replace(/\/+$/, '') + '/api/user?always_200=true', getAuthorizedFetchConfigFromData(userData));
+        if (response.status === 200) {
+            const body = await response.json();
+            const user = isUserData(body) ? body : undefined;
+            return { ...userData, user };
+        }
+        const message = await response.text();
+        throw new Error(`Error response from Accounts ${response.status}: ${message}`);
+    };
+    const getUserData = once(async () => {
+        // For backwards compatibility
+        if (authQuery === 'embedded') {
+            return getParentWindowUser();
+        }
+        // getFetchUser() will throw here if authQuery is not set
+        return await (embeddedQuery === embeddedQueryValue ? getParentWindowUser() : getFetchUser());
+    });
+    const getUser = async () => {
+        return (await getUserData()).user;
+    };
+    const updateUser = async (updates) => {
+        const response = await window.fetch((await accountsBase()).replace(/\/+$/, '') + '/api/user', { ...getAuthorizedFetchConfigFromData(userData), method: METHOD.PUT, body: JSON.stringify(updates) });
+        if (response.status === 200) {
+            const user = await response.json();
+            if (isUserData(user)) {
+                return { ...userData, user };
+            }
+        }
+        const message = await response.text();
+        throw new Error(`Error response from Accounts ${response.status}: ${message}`);
+    };
+    return {
+        /**
+         * gets the authentication token
+         */
+        getAuthToken,
+        /**
+         * adds auth parameters to the url. this is only safe to use when using javascript to navigate
+         * within the current window, eg `window.location = 'https://my.otherservice.com';` anchors
+         * should use getAuthorizedLinkUrl for their href.
+         *
+         * result unreliable unless `getUser` is resolved first.
+         */
+        getAuthorizedUrl,
+        /**
+         * all link href-s must be rendered with auth tokens so that they work when opened in a new tab
+         *
+         * result unreliable unless `getUser` is resolved first.
+         */
+        getAuthorizedLinkUrl,
+        /**
+         * gets an authorized url for an iframe src. sets params on the url and saves its
+         * origin to trust releasing user identity to it
+         */
+        getAuthorizedEmbedUrl,
+        /**
+         * gets second argument for `fetch` that has authentication token or cookie
+         */
+        getAuthorizedFetchConfig,
+        /**
+         * loads current user identity. does not reflect changes in identity after being called the first time.
+         */
+        getUser,
+        /**
+         * updates user settings, for example the cookie consent preferences
+         */
+        updateUser,
+    };
+};

package/dist/esm/services/authProvider/decryption.d.ts

@@ -0,0 +1,19 @@
+import type { ConfigProviderForConfig } from '../../config';
+import { AuthProvider, CookieAuthProvider } from '.';
+declare type Config = {
+    cookieName: string;
+    encryptionPrivateKey: string;
+    signaturePublicKey: string;
+};
+interface Initializer<C> {
+    configSpace?: C;
+}
+export declare type DecryptionAuthProvider = AuthProvider & {
+    getTokenExpiration: (tokenString?: string) => Promise<number | null | undefined>;
+};
+export declare const decryptionAuthProvider: <C extends string = "decryption">(initializer: Initializer<C>) => (configProvider: { [key in C]: {
+    cookieName: import("../../config").ConfigValueProvider<string>;
+    encryptionPrivateKey: import("../../config").ConfigValueProvider<string>;
+    signaturePublicKey: import("../../config").ConfigValueProvider<string>;
+}; }) => CookieAuthProvider<DecryptionAuthProvider>;
+export {};

package/dist/esm/services/authProvider/decryption.js

@@ -0,0 +1,57 @@
+import { resolveConfigValue } from '../../config/resolveConfigValue';
+import { SessionExpiredError } from '../../errors';
+import { ifDefined } from '../../guards';
+import { once } from '../../misc/helpers';
+import { decryptAndVerify } from './utils/decryptAndVerify';
+import { getAuthTokenOrCookie } from '.';
+export const decryptionAuthProvider = (initializer) => (configProvider) => {
+    const config = configProvider[ifDefined(initializer.configSpace, 'decryption')];
+    const cookieName = once(() => resolveConfigValue(config.cookieName));
+    const encryptionPrivateKey = once(() => resolveConfigValue(config.encryptionPrivateKey));
+    const signaturePublicKey = once(() => resolveConfigValue(config.signaturePublicKey));
+    return ({ request, logger }) => {
+        let user;
+        const getAuthorizedFetchConfig = async () => {
+            const [token, headers] = getAuthTokenOrCookie(request, await cookieName());
+            if (!token) {
+                return {};
+            }
+            return { headers };
+        };
+        const getPayload = async (tokenString) => {
+            const token = tokenString !== null && tokenString !== void 0 ? tokenString : getAuthTokenOrCookie(request, await cookieName())[0];
+            if (!token) {
+                return undefined;
+            }
+            return decryptAndVerify(token, await encryptionPrivateKey(), await signaturePublicKey());
+        };
+        const loadUser = async () => {
+            const result = await getPayload();
+            if (!result) {
+                return undefined;
+            }
+            if ('error' in result && result.error == 'expired token') {
+                throw new SessionExpiredError();
+            }
+            if ('user' in result) {
+                logger.setContext({ user: result.user.uuid });
+                return result.user;
+            }
+            return undefined;
+        };
+        return {
+            getAuthorizedFetchConfig,
+            getTokenExpiration: async (tokenString) => {
+                var _a;
+                const payload = await getPayload(tokenString);
+                return payload ? ((_a = payload.exp) !== null && _a !== void 0 ? _a : null) : undefined;
+            },
+            getUser: async () => {
+                if (!user) {
+                    user = await loadUser();
+                }
+                return user;
+            },
+        };
+    };
+};