@passport-agent/middleware 0.0.1

package/dist/__tests__/middleware.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=middleware.test.d.ts.map

package/dist/__tests__/middleware.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/middleware.test.js

@@ -0,0 +1,128 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { PassportIssuer } from '@passport-agent/core';
+import { expressPassport } from '../express.js';
+import { fastifyPassport } from '../fastify.js';
+import { nextjsPassport } from '../nextjs.js';
+import { createMiddlewareHandler } from '../core.js';
+describe('Framework Middleware', () => {
+    let issuer;
+    let passportHeader;
+    beforeEach(() => {
+        issuer = new PassportIssuer();
+        const signed = issuer.issue({
+            principal: 'user:alice',
+            agent: 'agent:bot',
+            permissions: ['api:*'],
+        });
+        passportHeader = JSON.stringify(signed);
+    });
+    describe('core handler', () => {
+        it('allows valid passport with matching permission', () => {
+            const handle = createMiddlewareHandler({ issuer });
+            const result = handle('GET', '/api/data', { 'x-agent-passport': passportHeader });
+            expect(result.allowed).toBe(true);
+        });
+        it('returns 401 without passport header', () => {
+            const handle = createMiddlewareHandler({ issuer });
+            const result = handle('GET', '/api/data', {});
+            expect(result.allowed).toBe(false);
+            if (!result.allowed)
+                expect(result.status).toBe(401);
+        });
+        it('returns 403 for denied action', () => {
+            const denied = issuer.issue({
+                principal: 'user:alice',
+                agent: 'agent:bot',
+                permissions: ['other:action'],
+            });
+            const handle = createMiddlewareHandler({ issuer });
+            const result = handle('GET', '/api/data', {
+                'x-agent-passport': JSON.stringify(denied),
+            });
+            expect(result.allowed).toBe(false);
+            if (!result.allowed)
+                expect(result.status).toBe(403);
+        });
+        it('uses custom header name', () => {
+            const handle = createMiddlewareHandler({ issuer, headerName: 'authorization' });
+            const result = handle('GET', '/api', { 'authorization': passportHeader });
+            expect(result.allowed).toBe(true);
+        });
+        it('calls onDenied callback', () => {
+            const onDenied = vi.fn();
+            const handle = createMiddlewareHandler({ issuer, onDenied });
+            handle('DELETE', '/admin/users', { 'x-agent-passport': passportHeader });
+            expect(onDenied).toHaveBeenCalled();
+        });
+        it('calls onAllowed callback', () => {
+            const onAllowed = vi.fn();
+            const handle = createMiddlewareHandler({ issuer, onAllowed });
+            handle('GET', '/api/data', { 'x-agent-passport': passportHeader });
+            expect(onAllowed).toHaveBeenCalled();
+        });
+    });
+    describe('Express middleware', () => {
+        it('calls next() on allowed request', () => {
+            const mw = expressPassport({ issuer });
+            const req = { method: 'GET', path: '/api/data', headers: { 'x-agent-passport': passportHeader } };
+            const res = { status: vi.fn().mockReturnThis(), json: vi.fn() };
+            const next = vi.fn();
+            mw(req, res, next);
+            expect(next).toHaveBeenCalled();
+            expect(req.passportContext).toBeDefined();
+        });
+        it('returns 401 without passport', () => {
+            const mw = expressPassport({ issuer });
+            const req = { method: 'GET', path: '/api', headers: {} };
+            const res = { status: vi.fn().mockReturnThis(), json: vi.fn() };
+            const next = vi.fn();
+            mw(req, res, next);
+            expect(next).not.toHaveBeenCalled();
+            expect(res.status).toHaveBeenCalledWith(401);
+        });
+    });
+    describe('Fastify hook', () => {
+        it('sets passport context on allowed request', async () => {
+            const hook = fastifyPassport({ issuer });
+            const req = { method: 'GET', url: '/api/data?q=1', headers: { 'x-agent-passport': passportHeader } };
+            const reply = { status: vi.fn().mockReturnThis(), send: vi.fn() };
+            await hook(req, reply);
+            expect(reply.send).not.toHaveBeenCalled();
+            expect(req.passportContext).toBeDefined();
+        });
+        it('sends 401 without passport', async () => {
+            const hook = fastifyPassport({ issuer });
+            const req = { method: 'GET', url: '/api', headers: {} };
+            const reply = { status: vi.fn().mockReturnThis(), send: vi.fn() };
+            await hook(req, reply);
+            expect(reply.status).toHaveBeenCalledWith(401);
+            expect(reply.send).toHaveBeenCalled();
+        });
+    });
+    describe('Next.js middleware', () => {
+        it('returns null on allowed request', () => {
+            const MockNextResponse = { json: vi.fn().mockReturnValue('response') };
+            const mw = nextjsPassport({ issuer }, MockNextResponse);
+            const req = {
+                method: 'GET',
+                nextUrl: { pathname: '/api/data' },
+                headers: { get: (name) => name === 'x-agent-passport' ? passportHeader : null },
+            };
+            const result = mw(req);
+            expect(result).toBeNull();
+        });
+        it('returns JSON response on denied request', () => {
+            const MockNextResponse = { json: vi.fn().mockReturnValue('response') };
+            const mw = nextjsPassport({ issuer }, MockNextResponse);
+            const req = {
+                method: 'GET',
+                nextUrl: { pathname: '/api/data' },
+                headers: { get: () => null },
+            };
+            const result = mw(req);
+            expect(result).toBe('response');
+            expect(MockNextResponse.json).toHaveBeenCalledWith(expect.objectContaining({ error: expect.any(String) }), expect.objectContaining({ status: 401 }));
+        });
+    });
+});
+//# sourceMappingURL=middleware.test.js.map

package/dist/__tests__/middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../src/__tests__/middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,MAAsB,CAAC;IAC3B,IAAI,cAAsB,CAAC;IAE3B,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;YAC1B,SAAS,EAAE,YAAY;YACvB,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAC;QACH,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC1B,SAAS,EAAE,YAAY;gBACvB,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,CAAC,cAAc,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE;gBACxC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;aAC3C,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,EAAE,CAAC;YAC3H,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAErB,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAE1B,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAErB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAEnB,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,MAAM,GAAG,GAA4B,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,EAAE,CAAC;YAC9H,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YAElE,MAAM,IAAI,CAAC,GAAU,EAAE,KAAK,CAAC,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;YAElE,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAEvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG;gBACV,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;gBAClC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE;aACxF,CAAC;YAEF,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,gBAAgB,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG;gBACV,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;gBAClC,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;aAC7B,CAAC;YAEF,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YACvB,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAChD,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EACtD,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACzC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,23 @@
+import { PassportIssuer, type SignedPassport, type AuthorizeResult } from '@passport-agent/core';
+export interface MiddlewareConfig {
+    issuer: PassportIssuer;
+    headerName?: string;
+    extractAction?: (method: string, path: string) => string;
+    onDenied?: (result: AuthorizeResult, action: string) => void;
+    onAllowed?: (result: AuthorizeResult, action: string) => void;
+}
+export interface PassportContext {
+    passport: SignedPassport;
+    result: AuthorizeResult;
+}
+export declare function parsePassportHeader(header: string | undefined | null, issuer: PassportIssuer): SignedPassport | null;
+export declare function defaultActionExtractor(method: string, path: string): string;
+export declare function createMiddlewareHandler(config: MiddlewareConfig): (method: string, path: string, headers: Record<string, string | string[] | undefined>) => {
+    allowed: true;
+    context: PassportContext;
+} | {
+    allowed: false;
+    status: number;
+    body: object;
+};
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEjG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACzD,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,eAAe,CAAC;CACzB;AAID,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACjC,MAAM,EAAE,cAAc,GACrB,cAAc,GAAG,IAAI,CAavB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI3E;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,IAK5D,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,KACrD;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoClG"}

package/dist/core.js

@@ -0,0 +1,59 @@
+const DEFAULT_HEADER = 'x-agent-passport';
+export function parsePassportHeader(header, issuer) {
+    if (!header)
+        return null;
+    try {
+        const parsed = JSON.parse(header);
+        if (parsed.payload && parsed.signature && parsed.publicKey) {
+            if (issuer.verifySignature(parsed)) {
+                return parsed;
+            }
+        }
+    }
+    catch {
+        // not valid JSON passport
+    }
+    return null;
+}
+export function defaultActionExtractor(method, path) {
+    const verb = method.toLowerCase();
+    const resource = path.split('/').filter(Boolean).slice(0, 2).join(':') || 'root';
+    return `${resource}:${verb}`;
+}
+export function createMiddlewareHandler(config) {
+    const headerName = config.headerName ?? DEFAULT_HEADER;
+    const extractAction = config.extractAction ?? defaultActionExtractor;
+    return function handle(method, path, headers) {
+        const raw = headers[headerName];
+        const headerValue = Array.isArray(raw) ? raw[0] : raw;
+        const passport = parsePassportHeader(headerValue, config.issuer);
+        if (!passport) {
+            return {
+                allowed: false,
+                status: 401,
+                body: {
+                    error: 'Missing or invalid agent passport',
+                    hint: `Provide a signed passport in the "${headerName}" header`,
+                },
+            };
+        }
+        const action = extractAction(method, path);
+        const result = config.issuer.authorize(passport, action);
+        if (!result.allowed) {
+            config.onDenied?.(result, action);
+            return {
+                allowed: false,
+                status: 403,
+                body: {
+                    error: 'Agent passport denied',
+                    action,
+                    reason: result.reason,
+                    passportId: result.passportId,
+                },
+            };
+        }
+        config.onAllowed?.(result, action);
+        return { allowed: true, context: { passport, result } };
+    };
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAeA,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,MAAM,UAAU,mBAAmB,CACjC,MAAiC,EACjC,MAAsB;IAEtB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3D,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,IAAY;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IACjF,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAwB;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAErE,OAAO,SAAS,MAAM,CACpB,MAAc,EACd,IAAY,EACZ,OAAsD;QAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACtD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAEjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,KAAK,EAAE,mCAAmC;oBAC1C,IAAI,EAAE,qCAAqC,UAAU,UAAU;iBAChE;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACJ,KAAK,EAAE,uBAAuB;oBAC9B,MAAM;oBACN,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC"}

package/dist/express.d.ts

@@ -0,0 +1,14 @@
+import { type MiddlewareConfig, type PassportContext } from './core.js';
+export interface ExpressRequest {
+    method: string;
+    path: string;
+    headers: Record<string, string | string[] | undefined>;
+    passportContext?: PassportContext;
+}
+export interface ExpressResponse {
+    status(code: number): ExpressResponse;
+    json(body: unknown): void;
+}
+export type ExpressNextFunction = (err?: unknown) => void;
+export declare function expressPassport(config: MiddlewareConfig): (req: ExpressRequest, res: ExpressResponse, next: ExpressNextFunction) => void;
+//# sourceMappingURL=express.d.ts.map

package/dist/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAE1D,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,IAIpD,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,mBAAmB,UAY5B"}

package/dist/express.js

@@ -0,0 +1,14 @@
+import { createMiddlewareHandler } from './core.js';
+export function expressPassport(config) {
+    const handle = createMiddlewareHandler(config);
+    return function passportMiddleware(req, res, next) {
+        const result = handle(req.method, req.path, req.headers);
+        if (!result.allowed) {
+            res.status(result.status).json(result.body);
+            return;
+        }
+        req.passportContext = result.context;
+        next();
+    };
+}
+//# sourceMappingURL=express.js.map

package/dist/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAA+C,MAAM,WAAW,CAAC;AAgBjG,MAAM,UAAU,eAAe,CAAC,MAAwB;IACtD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAE/C,OAAO,SAAS,kBAAkB,CAChC,GAAmB,EACnB,GAAoB,EACpB,IAAyB;QAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;QACrC,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/fastify.d.ts

@@ -0,0 +1,13 @@
+import { type MiddlewareConfig, type PassportContext } from './core.js';
+export interface FastifyRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    passportContext?: PassportContext;
+}
+export interface FastifyReply {
+    status(code: number): FastifyReply;
+    send(body: unknown): void;
+}
+export declare function fastifyPassport(config: MiddlewareConfig): (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+//# sourceMappingURL=fastify.d.ts.map

package/dist/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,gBAAgB,IAGnB,KAAK,cAAc,EAAE,OAAO,YAAY,mBAW5E"}

package/dist/fastify.js

@@ -0,0 +1,14 @@
+import { createMiddlewareHandler } from './core.js';
+export function fastifyPassport(config) {
+    const handle = createMiddlewareHandler(config);
+    return async function passportHook(req, reply) {
+        const path = req.url.split('?')[0] ?? req.url;
+        const result = handle(req.method, path, req.headers);
+        if (!result.allowed) {
+            reply.status(result.status).send(result.body);
+            return;
+        }
+        req.passportContext = result.context;
+    };
+}
+//# sourceMappingURL=fastify.js.map

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAA+C,MAAM,WAAW,CAAC;AAcjG,MAAM,UAAU,eAAe,CAAC,MAAwB;IACtD,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAE/C,OAAO,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,KAAmB;QACzE,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createMiddlewareHandler, parsePassportHeader, defaultActionExtractor, type MiddlewareConfig, type PassportContext, } from './core.js';
+export { expressPassport } from './express.js';
+export { fastifyPassport } from './fastify.js';
+export { nextjsPassport } from './nextjs.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { createMiddlewareHandler, parsePassportHeader, defaultActionExtractor, } from './core.js';
+export { expressPassport } from './express.js';
+export { fastifyPassport } from './fastify.js';
+export { nextjsPassport } from './nextjs.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/nextjs.d.ts

@@ -0,0 +1,21 @@
+import { type MiddlewareConfig } from './core.js';
+export interface NextRequest {
+    method: string;
+    nextUrl: {
+        pathname: string;
+    };
+    headers: {
+        get(name: string): string | null;
+    };
+}
+export interface NextResponse {
+    json(body: unknown, init?: {
+        status?: number;
+    }): NextResponse;
+}
+export declare function nextjsPassport(config: MiddlewareConfig, NextResponseClass: {
+    json(body: unknown, init?: {
+        status?: number;
+    }): unknown;
+}): (req: NextRequest) => unknown;
+//# sourceMappingURL=nextjs.d.ts.map

package/dist/nextjs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.d.ts","sourceRoot":"","sources":["../src/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,CAAC;CAC/D;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,gBAAgB,EACxB,iBAAiB,EAAE;IAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAA;CAAE,IAK5C,KAAK,WAAW,aAiBpD"}

package/dist/nextjs.js

@@ -0,0 +1,17 @@
+import { createMiddlewareHandler } from './core.js';
+export function nextjsPassport(config, NextResponseClass) {
+    const handle = createMiddlewareHandler(config);
+    const headerName = config.headerName ?? 'x-agent-passport';
+    return function passportMiddleware(req) {
+        const headers = {};
+        const val = req.headers.get(headerName);
+        if (val)
+            headers[headerName] = val;
+        const result = handle(req.method, req.nextUrl.pathname, headers);
+        if (!result.allowed) {
+            return NextResponseClass.json(result.body, { status: result.status });
+        }
+        return null;
+    };
+}
+//# sourceMappingURL=nextjs.js.map

package/dist/nextjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["../src/nextjs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAyB,MAAM,WAAW,CAAC;AAY3E,MAAM,UAAU,cAAc,CAC5B,MAAwB,EACxB,iBAA+E;IAE/E,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAE3D,OAAO,SAAS,kBAAkB,CAAC,GAAgB;QACjD,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,GAAG;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC;QAEnC,MAAM,MAAM,GAAG,MAAM,CACnB,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,OAAO,CAAC,QAAQ,EACpB,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@passport-agent/middleware",
+  "version": "0.0.1",
+  "description": "Express, Fastify, and Next.js middleware for passport-agent",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "lint": "tsc --noEmit"
+  },
+  "files": ["dist"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/priyansh-x/passport-agent",
+    "directory": "packages/middleware"
+  },
+  "dependencies": {
+    "@passport-agent/core": "workspace:*"
+  },
+  "devDependencies": {
+    "vitest": "^3.0.0"
+  }
+}