@passflow/node 0.0.0-bootstrap.0 → 0.0.0-stage

package/dist/evaluate-BTuol-Oa.mjs

@@ -1,348 +0,0 @@
-// src/acr.ts
-const ACR_NONE = "0";
-const AAL1 = "1";
-const AAL2 = "2";
-const AAL3 = "3";
-const ACR_LEXICAL = /^[+-]?[0-9]+$/;
-const INT64_MAX = 9223372036854775807n;
-/**
-* The ordinal level of an `acr` value, by the rule the server's `strconv.Atoi` applies on a 64-bit
-* platform (`server_level` in the corpus): optional sign and any number of ASCII digits, the value
-* must fit a signed 64-bit integer; a lexical failure, an out-of-range value, a negative value or a
-* non-string is level 0.
-*
-* Internal. It returns `bigint` so that nothing on the decision path goes through a `Number`.
-*/
-function parseACRLevel(acr) {
-	if (typeof acr !== "string" || !ACR_LEXICAL.test(acr)) return 0n;
-	const level = BigInt(acr);
-	return level < 0n || level > INT64_MAX ? 0n : level;
-}
-/**
-* Whether a token's `acr` meets the required level. Both sides are compared as exact 64-bit integers,
-* and a required side that parses to level 0 is never satisfied: a wrong configuration string fails
-* closed here as well as at `requireACR` construction.
-*/
-function acrSatisfies(acr, min) {
-	const required = parseACRLevel(min);
-	return required !== 0n && parseACRLevel(acr) >= required;
-}
-/**
-* The level as a `number`, for display and logging. It is exact only up to 2^53, and nothing in this
-* library decides with it: use {@link acrSatisfies} to compare.
-*/
-function acrLevel(acr) {
-	return Number(parseACRLevel(acr));
-}
-// src/bearer.ts
-const BEARER_PREFIX = /^bearer(?:[ \t]+|$)/i;
-/**
-* The token from an `Authorization` header. The scheme is matched case-insensitively (RFC 9110). Any
-* other scheme, an absent header, and a `Bearer` with an empty or whitespace-only remainder all give
-* `undefined`.
-*/
-function extractBearer(authorization) {
-	if (typeof authorization !== "string") return;
-	const header = authorization.trim();
-	const prefix = BEARER_PREFIX.exec(header);
-	if (prefix === null) return;
-	const token = header.slice(prefix[0].length);
-	return token === "" ? void 0 : token;
-}
-// src/challenge.ts
-const MAX_AGE_ERROR = "[passflow] maxAgeSeconds must be a finite integer between 1 and Number.MAX_SAFE_INTEGER";
-const FORMAT_MAX_AGE_ERROR = "[passflow] maxAge must be undefined or a finite number no greater than Number.MAX_SAFE_INTEGER";
-const FORMAT_ACR_ERROR = "[passflow] acrValues must be undefined or a string";
-/**
-* The constructor rule for a freshness limit (`freshness.json#max_age_input`): a finite number,
-* truncated toward zero, at least 1 and a safe integer, or a `TypeError`. The bound means `String()`
-* always yields plain decimal, so a challenge can never carry `max_age=1e+21`, which the browser
-* SDK's `Number.parseInt` reads as 1. The returned value is both what is enforced and what the
-* challenge carries.
-*/
-function assertMaxAge(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new TypeError(MAX_AGE_ERROR);
-	const seconds = Math.trunc(value);
-	if (seconds < 1 || !Number.isSafeInteger(seconds)) throw new TypeError(MAX_AGE_ERROR);
-	return seconds;
-}
-/**
-* The exact RFC 9470 `WWW-Authenticate` bytes the server's `SetInsufficientAuthChallenge` emits. This
-* is a formatter, not a constructor: a `maxAge` that truncates to zero or below is omitted, as the
-* server omits it, and it does not run {@link assertMaxAge}. A non-finite number, a non-number, or a
-* positive value above `Number.MAX_SAFE_INTEGER` is a `TypeError`.
-*
-* `acrValues` is a space-separated list of acr tokens, inserted unescaped exactly as the server does.
-*/
-function formatChallenge(c) {
-	let header = "Bearer error=\"insufficient_user_authentication\"";
-	if (c.acrValues !== void 0) {
-		if (typeof c.acrValues !== "string") throw new TypeError(FORMAT_ACR_ERROR);
-		if (c.acrValues !== "") header += `, acr_values="${c.acrValues}"`;
-	}
-	if (c.maxAge !== void 0) {
-		if (typeof c.maxAge !== "number" || !Number.isFinite(c.maxAge)) throw new TypeError(FORMAT_MAX_AGE_ERROR);
-		const seconds = Math.trunc(c.maxAge);
-		if (seconds > 0) {
-			if (!Number.isSafeInteger(seconds)) throw new TypeError(FORMAT_MAX_AGE_ERROR);
-			header += `, max_age=${String(seconds)}`;
-		}
-	}
-	return header;
-}
-// src/claims.ts
-const MAX_EXACT_SECONDS = 2 ** 53;
-const provenance = /* @__PURE__ */ new WeakMap();
-/** Internal: records that `verifier.verify` produced exactly this object. */
-function recordProvenance(claims, verifier) {
-	provenance.set(claims, verifier);
-}
-/**
-* True only for the exact object `verifier.verify` returned. A spread or clone loses provenance, which
-* costs one more verification and never a bypass. So does any wrapper or decorator object that delegates
-* to `verifier.verify`: it is a different identity, and this verifier's adapter re-verifies claims it
-* returns. Two verifiers built from the same configuration are different identities too.
-*/
-function verifiedBy(claims, verifier) {
-	return provenance.get(claims) === verifier && verifier !== void 0;
-}
-/**
-* Internal: a numeric date within ±2^53, the rule Go's `numericDate` applies. Beyond it a JSON number is no
-* longer an exact count of seconds, so the claim reads as absent.
-*/
-function isExactSeconds(value) {
-	return typeof value === "number" && Math.abs(value) <= MAX_EXACT_SECONDS;
-}
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isStringArray(value) {
-	return Array.isArray(value) && value.every((entry) => typeof entry === "string");
-}
-function stringsOf(value) {
-	return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-}
-/** A wrong JSON type means the membership cannot be read. `null` reads as absent, as Go's decoder does. */
-function decodeMembership(value) {
-	if (!isPlainObject(value)) return;
-	const { tenant_id, tenant_name, tenant_roles, root_group_id, groups, group_names } = value;
-	const membership = { tenantId: "" };
-	if (tenant_id !== void 0 && tenant_id !== null) {
-		if (typeof tenant_id !== "string") return void 0;
-		membership.tenantId = tenant_id;
-	}
-	if (tenant_name !== void 0 && tenant_name !== null) {
-		if (typeof tenant_name !== "string") return void 0;
-		membership.tenantName = tenant_name;
-	}
-	if (tenant_roles !== void 0 && tenant_roles !== null) {
-		if (!isStringArray(tenant_roles)) return void 0;
-		membership.tenantRoles = tenant_roles;
-	}
-	if (root_group_id !== void 0 && root_group_id !== null) {
-		if (typeof root_group_id !== "string") return void 0;
-		membership.rootGroupId = root_group_id;
-	}
-	if (groups !== void 0 && groups !== null) {
-		if (!isPlainObject(groups)) return void 0;
-		const entries = Object.entries(groups).filter(([, roles]) => roles !== null);
-		if (!entries.every(([, roles]) => isStringArray(roles))) return void 0;
-		membership.groups = Object.fromEntries(entries);
-	}
-	if (group_names !== void 0 && group_names !== null) {
-		if (!isPlainObject(group_names)) return void 0;
-		const entries = Object.entries(group_names).filter(([, name]) => name !== null);
-		if (!entries.every(([, name]) => typeof name === "string")) return void 0;
-		membership.groupNames = Object.fromEntries(entries);
-	}
-	return membership;
-}
-/** A membership that fails to decode drops that tenant only: the shape is informational, the token stays valid. */
-function decodeTenants(value) {
-	if (!isPlainObject(value)) return {};
-	const tenants = [];
-	for (const [tenantId, raw] of Object.entries(value)) {
-		const membership = decodeMembership(raw);
-		if (membership !== void 0) tenants.push([tenantId, membership]);
-	}
-	return Object.fromEntries(tenants);
-}
-/** Fail-closed claim extraction from a payload whose signature and registered claims already passed. */
-function extractClaims(payload, verifiedAt) {
-	const { sub, iss, aud, exp, iat, auth_time: authTime, acr, amr, scopes, sid, type, passflow_tm: tenants } = payload;
-	const claims = {
-		sub: typeof sub === "string" ? sub : "",
-		iss: typeof iss === "string" ? iss : "",
-		aud: typeof aud === "string" ? [aud] : stringsOf(aud),
-		exp,
-		acr: typeof acr === "string" ? acr : "0",
-		amr: stringsOf(amr),
-		scopes: stringsOf(scopes),
-		type: typeof type === "string" ? type : "",
-		tenants: decodeTenants(tenants),
-		verifiedAt,
-		raw: payload
-	};
-	if (isExactSeconds(iat)) claims.iat = iat;
-	if (isExactSeconds(authTime)) claims.authTime = Math.trunc(authTime);
-	if (typeof sid === "string") claims.sid = sid;
-	return claims;
-}
-/**
-* The roles a user holds in a tenant: `groups[rootGroupId]`, the rule the server's `CalcTenantRoles` and
-* `@passflow/core`'s `parseMembership` apply. A missing tenant, root group or map gives an empty list.
-* So does an empty `rootGroupId`, unlike the server: no role is granted from a group keyed by "".
-* `tenantRoles` is a copy the server derives from the same root group, and is not consulted.
-*/
-function rolesOf(claims, tenantId) {
-	const { tenants } = claims;
-	if (!isPlainObject(tenants) || !Object.hasOwn(tenants, tenantId)) return [];
-	const { groups, rootGroupId } = tenants[tenantId];
-	if (!isPlainObject(groups) || !rootGroupId || !Object.hasOwn(groups, rootGroupId)) return [];
-	return [...groups[rootGroupId]];
-}
-// src/cors.ts
-const CHALLENGE_HEADER = "WWW-Authenticate";
-const CORS_EXPOSED_HEADERS = Object.freeze([CHALLENGE_HEADER]);
-/**
-* Appends `WWW-Authenticate` to an expose list unless it is already there, compared case-insensitively.
-* Everything else is kept as given, `*` and duplicates included: `*` is not a wildcard on a
-* credentialed request, so the explicit entry is what matters. This guarantees exactly one thing, that
-* the header appears as an explicit entry.
-*
-* Internal. Each adapter wraps it under the option name its CORS middleware uses.
-*/
-function withChallengeHeader(existing) {
-	const entries = typeof existing === "string" ? existing.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "") : [...existing ?? []];
-	return entries.some((entry) => entry.toLowerCase() === "WWW-Authenticate".toLowerCase()) ? entries : [...entries, CHALLENGE_HEADER];
-}
-// src/errors.ts
-const MESSAGES = {
-	missing_token: "[passflow] no bearer token presented",
-	invalid_token: "[passflow] invalid token",
-	jwks_unavailable: "[passflow] key set unavailable"
-};
-/**
-* An authentication failure. The message is fixed per code and carries nothing from the token, the
-* request or the JWKS URL. A jose error is never attached as `cause`: jose's claim errors keep the
-* whole payload on `.payload`.
-*/
-var PassflowAuthError = class extends Error {
-	code;
-	reason;
-	status;
-	constructor(code, reason, options) {
-		super(reason === void 0 ? MESSAGES[code] : `${MESSAGES[code]}: ${reason}`, options);
-		this.name = "PassflowAuthError";
-		this.code = code;
-		this.status = code === "jwks_unavailable" ? 503 : 401;
-		if (reason !== void 0) this.reason = reason;
-	}
-};
-/**
-* A programming error, such as reading the claims before any middleware ran. It is deliberately not
-* a `PassflowAuthError`: those mean 401/503, which the browser SDK acts on, and this must reach the
-* framework's error handling as a 500.
-*/
-var PassflowUsageError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "PassflowUsageError";
-	}
-};
-/**
-* True for a `PassflowAuthError`, including one from the other copy of this package when the ESM
-* and CJS builds are both loaded, where `instanceof` alone would say no.
-*/
-function isPassflowAuthError(e) {
-	if (e instanceof PassflowAuthError) return true;
-	if (!(e instanceof Error) || e.name !== "PassflowAuthError") return false;
-	const { code } = e;
-	return code === "missing_token" || code === "invalid_token" || code === "jwks_unavailable";
-}
-// src/evaluate.ts
-const CACHE_CONTROL = "Cache-Control";
-const NO_STORE = "no-store";
-const reject = (status, wwwAuthenticate) => ({
-	kind: "reject",
-	status,
-	headers: wwwAuthenticate === void 0 ? { [CACHE_CONTROL]: NO_STORE } : {
-		[CHALLENGE_HEADER]: wwwAuthenticate,
-		[CACHE_CONTROL]: NO_STORE
-	}
-});
-/**
-* Authentication failures never carry the step-up error: the browser SDK acts only on the step-up challenge,
-* and every other response, a plain 401 or a 503 included, reaches the caller's code unchanged.
-*/
-function rejectAuthentication(code) {
-	switch (code) {
-		case "missing_token": return reject(401, "Bearer");
-		case "invalid_token": return reject(401, "Bearer error=\"invalid_token\"");
-		case "jwks_unavailable": return reject(503);
-	}
-}
-/**
-* Validates a requirement and returns it with the effective freshness limit. Throws `TypeError`: this is a
-* programming error that should stop the process at route registration, not become a `Decision`.
-*
-* Internal: `requireACR` and `requireFresh` call it at construction.
-*/
-function assertRequirement(requirement) {
-	if (typeof requirement === "object" && requirement !== null) {
-		if (requirement.kind === "acr") {
-			if (parseACRLevel(requirement.min) === 0n) throw new TypeError("[passflow] the required ACR must parse to a level above 0");
-			return requirement;
-		}
-		if (requirement.kind === "fresh") return {
-			kind: "fresh",
-			maxAgeSeconds: assertMaxAge(requirement.maxAgeSeconds)
-		};
-	}
-	throw new TypeError("[passflow] a requirement is { kind: \"acr\", min } or { kind: \"fresh\", maxAgeSeconds }");
-}
-function isFresh(claims, maxAgeSeconds) {
-	const { authTime, verifiedAt } = claims;
-	if (!isExactSeconds(authTime)) return false;
-	return (typeof verifiedAt === "number" && Number.isFinite(verifiedAt) && verifiedAt > 0 ? Math.floor(verifiedAt) : Math.floor(Date.now() / 1e3)) - Math.trunc(authTime) <= maxAgeSeconds;
-}
-/**
-* Decides one requirement against claims. No claims means the middleware was composed wrongly, so the answer
-* is a 500 with no challenge: never a step-up, which the SDK would try to satisfy, and never a 401, because a
-* wiring bug must not be reported as a bad token. Throws `TypeError` on an invalid requirement.
-*/
-function evaluate(claims, requirement) {
-	const checked = assertRequirement(requirement);
-	if (claims === void 0 || claims === null) return reject(500);
-	if (checked.kind === "acr") return acrSatisfies(claims.acr, checked.min) ? { kind: "allow" } : reject(401, formatChallenge({ acrValues: checked.min }));
-	return isFresh(claims, checked.maxAgeSeconds) ? { kind: "allow" } : reject(401, formatChallenge({ maxAge: checked.maxAgeSeconds }));
-}
-/**
-* Authenticates a request. `existing` claims are reused only when `verifier` produced that exact object;
-* otherwise the presented header is verified with `verifier`, so a token outside this verifier's trust policy
-* is rejected as not valid here, never as insufficient. Never rejects: a failure is a `{ reject }` value.
-*/
-async function authenticate(verifier, authorization, existing) {
-	if (existing !== void 0 && existing !== null && verifiedBy(existing, verifier)) return { claims: existing };
-	const token = extractBearer(authorization);
-	if (token === void 0) return { reject: rejectAuthentication("missing_token") };
-	try {
-		return { claims: await verifier.verify(token) };
-	} catch (error) {
-		return { reject: isPassflowAuthError(error) ? rejectAuthentication(error.code) : reject(500) };
-	}
-}
-/**
-* Internal: one adapter step. Authenticates, then applies the requirement if there is one.
-*/
-async function guard(verifier, authorization, existing, requirement) {
-	const result = await authenticate(verifier, authorization, existing);
-	if ("reject" in result || requirement === void 0) return result;
-	const decision = evaluate(result.claims, requirement);
-	return decision.kind === "reject" ? { reject: decision } : result;
-}
-/** Internal: the adapters fail at construction when handed something that cannot verify. */
-function assertVerifier(verifier) {
-	if (typeof verifier !== "object" || verifier === null || typeof verifier.verify !== "function") throw new TypeError("[passflow] an adapter needs a verifier from createVerifier");
-}
-export { acrLevel as C, ACR_NONE as S, formatChallenge as _, guard as a, AAL2 as b, isPassflowAuthError as c, withChallengeHeader as d, extractClaims as f, assertMaxAge as g, verifiedBy as h, evaluate as i, CHALLENGE_HEADER as l, rolesOf as m, assertVerifier as n, PassflowAuthError as o, recordProvenance as p, authenticate as r, PassflowUsageError as s, assertRequirement as t, CORS_EXPOSED_HEADERS as u, extractBearer as v, acrSatisfies as w, AAL3 as x, AAL1 as y };