@passflow/node 0.0.0-bootstrap.0 → 0.0.0-stage

package/dist/index.d.cts

@@ -1,141 +0,0 @@
-import { a as verifiedBy, i as rolesOf, n as TenantMembership, r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.cjs";
-export declare const ACR_NONE = "0";
-export declare const AAL1 = "1";
-export declare const AAL2 = "2";
-export declare const AAL3 = "3";
-/**
- * Whether a token's `acr` meets the required level. Both sides are compared as exact 64-bit integers,
- * and a required side that parses to level 0 is never satisfied: a wrong configuration string fails
- * closed here as well as at `requireACR` construction.
- */
-export declare function acrSatisfies(acr: unknown, min: string): boolean;
-/**
- * The level as a `number`, for display and logging. It is exact only up to 2^53, and nothing in this
- * library decides with it: use {@link acrSatisfies} to compare.
- */
-export declare function acrLevel(acr: unknown): number;
-/**
- * The token from an `Authorization` header. The scheme is matched case-insensitively (RFC 9110). Any
- * other scheme, an absent header, and a `Bearer` with an empty or whitespace-only remainder all give
- * `undefined`.
- */
-export declare function extractBearer(authorization: string | undefined | null): string | undefined;
-/**
- * The constructor rule for a freshness limit (`freshness.json#max_age_input`): a finite number,
- * truncated toward zero, at least 1 and a safe integer, or a `TypeError`. The bound means `String()`
- * always yields plain decimal, so a challenge can never carry `max_age=1e+21`, which the browser
- * SDK's `Number.parseInt` reads as 1. The returned value is both what is enforced and what the
- * challenge carries.
- */
-export declare function assertMaxAge(value: unknown): number;
-/**
- * The exact RFC 9470 `WWW-Authenticate` bytes the server's `SetInsufficientAuthChallenge` emits. This
- * is a formatter, not a constructor: a `maxAge` that truncates to zero or below is omitted, as the
- * server omits it, and it does not run {@link assertMaxAge}. A non-finite number, a non-number, or a
- * positive value above `Number.MAX_SAFE_INTEGER` is a `TypeError`.
- *
- * `acrValues` is a space-separated list of acr tokens, inserted unescaped exactly as the server does.
- */
-export declare function formatChallenge(c: {
-  acrValues?: string;
-  maxAge?: number;
-}): string;
-export declare const CHALLENGE_HEADER = "WWW-Authenticate";
-export declare const CORS_EXPOSED_HEADERS: readonly string[];
-type PassflowAuthErrorCode = 'missing_token' | 'invalid_token' | 'jwks_unavailable';
-/** Why a token was refused. Only `invalid_token` carries one. */
-type InvalidTokenReason = 'expired' | 'not_yet_valid' | 'exp_missing' | 'issuer' | 'audience' | 'type' | 'signature' | 'alg' | 'kid_missing' | 'key_unknown' | 'crit' | 'malformed';
-/**
- * An authentication failure. The message is fixed per code and carries nothing from the token, the
- * request or the JWKS URL. A jose error is never attached as `cause`: jose's claim errors keep the
- * whole payload on `.payload`.
- */
-export declare class PassflowAuthError extends Error {
-  readonly code: PassflowAuthErrorCode;
-  readonly reason?: string;
-  readonly status: 401 | 503;
-  constructor(code: PassflowAuthErrorCode, reason?: InvalidTokenReason, options?: ErrorOptions);
-}
-/**
- * A programming error, such as reading the claims before any middleware ran. It is deliberately not
- * a `PassflowAuthError`: those mean 401/503, which the browser SDK acts on, and this must reach the
- * framework's error handling as a 500.
- */
-export declare class PassflowUsageError extends Error {
-  constructor(message: string);
-}
-/**
- * True for a `PassflowAuthError`, including one from the other copy of this package when the ESM
- * and CJS builds are both loaded, where `instanceof` alone would say no.
- */
-export declare function isPassflowAuthError(e: unknown): e is PassflowAuthError;
-type Requirement = {
-  kind: 'acr';
-  min: string;
-} | {
-  kind: 'fresh';
-  maxAgeSeconds: number;
-};
-type Decision = {
-  kind: 'allow';
-} | {
-  kind: 'reject';
-  status: 401 | 500 | 503;
-  headers: Record<string, string>;
-};
-/**
- * Decides one requirement against claims. No claims means the middleware was composed wrongly, so the answer
- * is a 500 with no challenge: never a step-up, which the SDK would try to satisfy, and never a 401, because a
- * wiring bug must not be reported as a bad token. Throws `TypeError` on an invalid requirement.
- */
-export declare function evaluate(claims: PassflowClaims | undefined, requirement: Requirement): Decision;
-/**
- * Authenticates a request. `existing` claims are reused only when `verifier` produced that exact object;
- * otherwise the presented header is verified with `verifier`, so a token outside this verifier's trust policy
- * is rejected as not valid here, never as insufficient. Never rejects: a failure is a `{ reject }` value.
- */
-export declare function authenticate(verifier: Verifier, authorization: string | undefined | null, existing?: PassflowClaims): Promise<{
-  claims: PassflowClaims;
-} | {
-  reject: Decision;
-}>;
-type VerifierConfig = {
-  /** Required, exact match against `iss`. */
-  issuer: string;
-  /** Required: the Passflow application IDs that may call this API. A token must name at least one. */
-  audience: string | string[];
-  /** Default: `{issuer}/.well-known/jwks.json`, Passflow's fixed path. OIDC discovery is not fetched. */
-  jwksUrl?: string;
-  /** Permits `http://` on a non-loopback host, for private networks. Default false. */
-  allowInsecureJwksUrl?: boolean;
-  /** Applies to `exp` and `nbf` only; `iat` is not validated. Default 30. */
-  leewaySeconds?: number;
-  /** The accepted `type` claims. Default `['access']`. */
-  tokenTypes?: string[];
-  /** The clock for token checks, `verifiedAt` and the key cache. Default `new Date()`. */
-  now?: () => Date;
-  jwks?: {
-    /**
-     * A set older than this keeps answering while it reloads in the background. `0` starts a reload on every
-     * verification, gated by `minRefreshInterval`. Default 600000 ms.
-     */
-    maxAge?: number;
-    /** At most one network attempt per interval for a background reload, after a failure or for an unknown `kid`. Default 30000 ms. */
-    minRefreshInterval?: number;
-    /** How long after the last successful fetch a stale set is still trusted. Must be `>= maxAge`. Default 3600000 ms. */
-    maxStale?: number;
-    /** Response body cap. Default 1048576. */
-    maxBytes?: number;
-    /** Reload timeout, an integer in `[1, 2147483647]` ms. Default 5000. */
-    timeout?: number;
-    /** Replaces the global `fetch`, for proxies and tests. */
-    fetch?: typeof fetch;
-  };
-};
-/**
- * Builds a verifier from a validated configuration and touches no network: the key set loads on the first
- * `verify`, or on `refresh`. Build one per trust policy, at startup: each owns a key cache, and a verifier
- * built per request would defeat it.
- */
-export declare function createVerifier(config: VerifierConfig): Verifier;
-export { type Decision, type PassflowAuthErrorCode, type PassflowClaims, type Requirement, type TenantMembership, type Verifier, type VerifierConfig, rolesOf, verifiedBy };

package/dist/index.d.mts

@@ -1,141 +0,0 @@
-import { a as verifiedBy, i as rolesOf, n as TenantMembership, r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.mjs";
-export declare const ACR_NONE = "0";
-export declare const AAL1 = "1";
-export declare const AAL2 = "2";
-export declare const AAL3 = "3";
-/**
- * Whether a token's `acr` meets the required level. Both sides are compared as exact 64-bit integers,
- * and a required side that parses to level 0 is never satisfied: a wrong configuration string fails
- * closed here as well as at `requireACR` construction.
- */
-export declare function acrSatisfies(acr: unknown, min: string): boolean;
-/**
- * The level as a `number`, for display and logging. It is exact only up to 2^53, and nothing in this
- * library decides with it: use {@link acrSatisfies} to compare.
- */
-export declare function acrLevel(acr: unknown): number;
-/**
- * The token from an `Authorization` header. The scheme is matched case-insensitively (RFC 9110). Any
- * other scheme, an absent header, and a `Bearer` with an empty or whitespace-only remainder all give
- * `undefined`.
- */
-export declare function extractBearer(authorization: string | undefined | null): string | undefined;
-/**
- * The constructor rule for a freshness limit (`freshness.json#max_age_input`): a finite number,
- * truncated toward zero, at least 1 and a safe integer, or a `TypeError`. The bound means `String()`
- * always yields plain decimal, so a challenge can never carry `max_age=1e+21`, which the browser
- * SDK's `Number.parseInt` reads as 1. The returned value is both what is enforced and what the
- * challenge carries.
- */
-export declare function assertMaxAge(value: unknown): number;
-/**
- * The exact RFC 9470 `WWW-Authenticate` bytes the server's `SetInsufficientAuthChallenge` emits. This
- * is a formatter, not a constructor: a `maxAge` that truncates to zero or below is omitted, as the
- * server omits it, and it does not run {@link assertMaxAge}. A non-finite number, a non-number, or a
- * positive value above `Number.MAX_SAFE_INTEGER` is a `TypeError`.
- *
- * `acrValues` is a space-separated list of acr tokens, inserted unescaped exactly as the server does.
- */
-export declare function formatChallenge(c: {
-  acrValues?: string;
-  maxAge?: number;
-}): string;
-export declare const CHALLENGE_HEADER = "WWW-Authenticate";
-export declare const CORS_EXPOSED_HEADERS: readonly string[];
-type PassflowAuthErrorCode = 'missing_token' | 'invalid_token' | 'jwks_unavailable';
-/** Why a token was refused. Only `invalid_token` carries one. */
-type InvalidTokenReason = 'expired' | 'not_yet_valid' | 'exp_missing' | 'issuer' | 'audience' | 'type' | 'signature' | 'alg' | 'kid_missing' | 'key_unknown' | 'crit' | 'malformed';
-/**
- * An authentication failure. The message is fixed per code and carries nothing from the token, the
- * request or the JWKS URL. A jose error is never attached as `cause`: jose's claim errors keep the
- * whole payload on `.payload`.
- */
-export declare class PassflowAuthError extends Error {
-  readonly code: PassflowAuthErrorCode;
-  readonly reason?: string;
-  readonly status: 401 | 503;
-  constructor(code: PassflowAuthErrorCode, reason?: InvalidTokenReason, options?: ErrorOptions);
-}
-/**
- * A programming error, such as reading the claims before any middleware ran. It is deliberately not
- * a `PassflowAuthError`: those mean 401/503, which the browser SDK acts on, and this must reach the
- * framework's error handling as a 500.
- */
-export declare class PassflowUsageError extends Error {
-  constructor(message: string);
-}
-/**
- * True for a `PassflowAuthError`, including one from the other copy of this package when the ESM
- * and CJS builds are both loaded, where `instanceof` alone would say no.
- */
-export declare function isPassflowAuthError(e: unknown): e is PassflowAuthError;
-type Requirement = {
-  kind: 'acr';
-  min: string;
-} | {
-  kind: 'fresh';
-  maxAgeSeconds: number;
-};
-type Decision = {
-  kind: 'allow';
-} | {
-  kind: 'reject';
-  status: 401 | 500 | 503;
-  headers: Record<string, string>;
-};
-/**
- * Decides one requirement against claims. No claims means the middleware was composed wrongly, so the answer
- * is a 500 with no challenge: never a step-up, which the SDK would try to satisfy, and never a 401, because a
- * wiring bug must not be reported as a bad token. Throws `TypeError` on an invalid requirement.
- */
-export declare function evaluate(claims: PassflowClaims | undefined, requirement: Requirement): Decision;
-/**
- * Authenticates a request. `existing` claims are reused only when `verifier` produced that exact object;
- * otherwise the presented header is verified with `verifier`, so a token outside this verifier's trust policy
- * is rejected as not valid here, never as insufficient. Never rejects: a failure is a `{ reject }` value.
- */
-export declare function authenticate(verifier: Verifier, authorization: string | undefined | null, existing?: PassflowClaims): Promise<{
-  claims: PassflowClaims;
-} | {
-  reject: Decision;
-}>;
-type VerifierConfig = {
-  /** Required, exact match against `iss`. */
-  issuer: string;
-  /** Required: the Passflow application IDs that may call this API. A token must name at least one. */
-  audience: string | string[];
-  /** Default: `{issuer}/.well-known/jwks.json`, Passflow's fixed path. OIDC discovery is not fetched. */
-  jwksUrl?: string;
-  /** Permits `http://` on a non-loopback host, for private networks. Default false. */
-  allowInsecureJwksUrl?: boolean;
-  /** Applies to `exp` and `nbf` only; `iat` is not validated. Default 30. */
-  leewaySeconds?: number;
-  /** The accepted `type` claims. Default `['access']`. */
-  tokenTypes?: string[];
-  /** The clock for token checks, `verifiedAt` and the key cache. Default `new Date()`. */
-  now?: () => Date;
-  jwks?: {
-    /**
-     * A set older than this keeps answering while it reloads in the background. `0` starts a reload on every
-     * verification, gated by `minRefreshInterval`. Default 600000 ms.
-     */
-    maxAge?: number;
-    /** At most one network attempt per interval for a background reload, after a failure or for an unknown `kid`. Default 30000 ms. */
-    minRefreshInterval?: number;
-    /** How long after the last successful fetch a stale set is still trusted. Must be `>= maxAge`. Default 3600000 ms. */
-    maxStale?: number;
-    /** Response body cap. Default 1048576. */
-    maxBytes?: number;
-    /** Reload timeout, an integer in `[1, 2147483647]` ms. Default 5000. */
-    timeout?: number;
-    /** Replaces the global `fetch`, for proxies and tests. */
-    fetch?: typeof fetch;
-  };
-};
-/**
- * Builds a verifier from a validated configuration and touches no network: the key set loads on the first
- * `verify`, or on `refresh`. Build one per trust policy, at startup: each owns a key cache, and a verifier
- * built per request would defeat it.
- */
-export declare function createVerifier(config: VerifierConfig): Verifier;
-export { type Decision, type PassflowAuthErrorCode, type PassflowClaims, type Requirement, type TenantMembership, type Verifier, type VerifierConfig, rolesOf, verifiedBy };