@relyper/sp-auth 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jonas Esser
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,146 @@
+# @relyper/sp-auth
+
+Service-provider side of Relyper identity: turn gateway headers into a typed
+principal, gate access by role, and keep the identity layer out of your
+application code.
+
+Built for services that sit behind the Relyper auth gateway. The package covers
+the parts every service provider repeats — header parsing, role gating, the
+`/me` contract, dev login — and leaves persistence to you.
+
+```bash
+npm install @relyper/sp-auth
+```
+
+Requires Node 20+. ESM only.
+
+## Quick start (Fastify)
+
+```ts
+import Fastify from 'fastify';
+import { relyperAuth } from '@relyper/sp-auth/fastify';
+
+const app = Fastify();
+
+await app.register(relyperAuth, {
+  requiredRole: 'my_service_user',
+  protect: (request) => request.url.startsWith('/api/'),
+  meRoute: '/api/me',
+  // Turn the IdP identity into your own user record.
+  resolveUser: async (identity) => prisma.user.upsert({
+    where: { idpSubject: identity.subject },
+    create: { idpSubject: identity.subject, email: identity.email, displayName: identity.displayName, roles: identity.roles },
+    update: { email: identity.email, displayName: identity.displayName, roles: identity.roles, lastSeenAt: new Date() }
+  })
+});
+
+app.get('/api/cases', async (request) => {
+  request.relyperIdentity; // { subject, email, displayName, roles }
+  request.principal;       // whatever resolveUser returned
+});
+```
+
+Declare the type of your own principal once:
+
+```ts
+declare module 'fastify' {
+  interface FastifyRequest {
+    principal: { id: string; email: string };
+  }
+}
+```
+
+## Without Fastify
+
+The core is a pure function over headers — no framework, no I/O:
+
+```ts
+import { createRelyperAuth } from '@relyper/sp-auth';
+
+const auth = createRelyperAuth({ requiredRole: 'my_service_user' });
+const result = auth.authenticate(request.headers); // Node headers or a fetch Headers object
+
+if (!result.ok) {
+  return new Response(JSON.stringify({ error: result.message }), { status: result.status });
+}
+result.identity.subject;
+```
+
+`authenticate` never throws and never does I/O, which makes it easy to unit test
+and safe to call on every request.
+
+## Browser client
+
+```ts
+import { fetchRelyperSession } from '@relyper/sp-auth/client';
+
+const session = await fetchRelyperSession<{ id: string; email: string }>();
+
+switch (session.status) {
+  case 'authenticated': return session.user;
+  case 'unauthenticated': return redirectToLogin();
+  case 'forbidden': return showNoAccessScreen();
+  case 'error': return showError();
+}
+```
+
+No framework dependency. A Vue composable or React hook around it is a few lines.
+
+## Options
+
+| Option | Default | Purpose |
+| --- | --- | --- |
+| `requiredRole` | – | Role(s) required for this service. Omit to only require an identity. |
+| `roleMatch` | `'any'` | With several required roles: one is enough, or all are needed. |
+| `requireEmail` | `true` | Set to `false` if your IdP does not send an address. |
+| `headerNames` | Relyper headers | Override individual header names for another gateway. |
+| `acceptForwardedHeaders` | `false` | Also accept `x-forwarded-*`. Off by default on purpose. |
+| `devAuth` | `false` | Local login without a gateway. Never enable in production. |
+| `unauthenticatedStatus` | `401` | Status when no identity arrives. |
+| `forbiddenStatus` | `403` | Status when the role is missing. |
+| `message` | per code | Fixed string or a function for the error message. |
+| `parseRoles` | comma-separated | Custom splitting of the roles header. |
+
+Fastify adapter additions: `protect`, `hook`, `resolveUser`, `principalKey`,
+`meRoute`, `meResponse`, `errorBody`, `onAuthFailure`, `warnOnDevAuth`.
+
+## Headers
+
+| Header | Meaning |
+| --- | --- |
+| `x-relyper-subject` | Stable user ID at the IdP |
+| `x-relyper-email` | E-mail address |
+| `x-relyper-name` | Display name |
+| `x-relyper-roles` | Comma-separated roles |
+
+Fallbacks when `acceptForwardedHeaders` is on: `x-forwarded-user`,
+`x-forwarded-email`, `x-forwarded-preferred-username`, `x-forwarded-groups`.
+
+## Security model — read this
+
+This package trusts headers. It does **not** verify a token or a signature. That
+is only safe when your service is unreachable except through a gateway that
+strips client-supplied `x-relyper-*` headers and sets them itself.
+
+If your service can be reached directly, anyone can send
+`x-relyper-roles: my_service_user` and be admitted. Two rules follow:
+
+- Never expose the service port publicly without the gateway in front of it.
+- Never enable `devAuth` in production. It is off by default, and the Fastify
+  adapter logs a warning the first time it is used.
+
+Token verification against the Relyper IdP (JWT/JWKS) is planned for a later
+version behind the same API, so switching should not require changes in calling
+code.
+
+## Design
+
+- `authenticate` is pure: headers in, result out. No database, no fetch, no throw.
+- Identity and application user stay separate. The package hands you a
+  `RelyperIdentity`; `resolveUser` maps it to your own record. That boundary is
+  what makes the package reusable across service providers.
+- `subject` is the IdP ID and never the primary key of your database.
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,38 @@
+import type { RelyperIdentity } from './types.js';
+/**
+ * Framework-free browser client for a service provider's /me route.
+ * Deliberately without a Vue/React dependency: a composable or hook wrapping
+ * it is a ten-liner in the application.
+ */
+export type RelyperSession<TUser = RelyperIdentity> = {
+    status: 'authenticated';
+    user: TUser;
+}
+/** No identity passed through the gateway. Typically: login required. */
+ | {
+    status: 'unauthenticated';
+    response: Response;
+}
+/** Signed in, but without the role required for this service provider. */
+ | {
+    status: 'forbidden';
+    response: Response;
+} | {
+    status: 'error';
+    response: Response;
+};
+export type FetchSessionOptions = {
+    /** Default: '/api/me'. */
+    path?: string;
+    /** Custom fetch implementation, e.g. for tests or SSR. */
+    fetch?: typeof globalThis.fetch;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+    /** Default: 'same-origin'. */
+    credentials?: RequestCredentials;
+};
+export declare function fetchRelyperSession<TUser = RelyperIdentity>(options?: FetchSessionOptions): Promise<RelyperSession<TUser>>;
+/** true if the identity has at least one of the given roles. */
+export declare function hasAnyRole(identity: Pick<RelyperIdentity, 'roles'>, roles: string[]): boolean;
+export type { RelyperIdentity };
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;GAIG;AAEH,MAAM,MAAM,cAAc,CAAC,KAAK,GAAG,eAAe,IAC9C;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE;AAC1C,yEAAyE;GACvE;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE;AACnD,0EAA0E;GACxE;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8BAA8B;IAC9B,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,wBAAsB,mBAAmB,CAAC,KAAK,GAAG,eAAe,EAC/D,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAkBhC;AAED,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAE7F;AAED,YAAY,EAAE,eAAe,EAAE,CAAC"}

package/dist/client.js

@@ -0,0 +1,25 @@
+export async function fetchRelyperSession(options = {}) {
+    const doFetch = options.fetch ?? globalThis.fetch;
+    if (!doFetch)
+        throw new Error('@relyper/sp-auth/client: no fetch implementation available.');
+    const response = await doFetch(options.path ?? '/api/me', {
+        method: 'GET',
+        credentials: options.credentials ?? 'same-origin',
+        headers: { accept: 'application/json', ...(options.headers ?? {}) },
+        signal: options.signal
+    });
+    if (response.status === 401)
+        return { status: 'unauthenticated', response };
+    if (response.status === 403)
+        return { status: 'forbidden', response };
+    if (!response.ok)
+        return { status: 'error', response };
+    const body = (await response.json());
+    const user = body.user ?? body;
+    return { status: 'authenticated', user };
+}
+/** true if the identity has at least one of the given roles. */
+export function hasAnyRole(identity, roles) {
+    return roles.some((role) => identity.roles.includes(role));
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AA2BA,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAO,GAAwB,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAE7F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE;QACxD,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,aAAa;QACjD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACnE,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAEvD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;IACjE,MAAM,IAAI,GAAI,IAAyB,CAAC,IAAI,IAAK,IAAc,CAAC;IAChE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,QAAwC,EAAE,KAAe;IAClF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,15 @@
+import type { RelyperAuthOptions, RelyperAuthResult, RelyperHeaderNames, RelyperHeaderSource, RelyperIdentity, ResolvedRelyperAuthOptions } from './types.js';
+export declare const DEFAULT_HEADER_NAMES: RelyperHeaderNames;
+/** Common headers of a generic auth proxy, only active on explicit request. */
+export declare const FORWARDED_HEADER_NAMES: RelyperHeaderNames;
+export declare function parseRoleList(raw: string): string[];
+export declare function readHeader(source: RelyperHeaderSource, name: string): string;
+export type RelyperAuth = {
+    readonly options: ResolvedRelyperAuthOptions;
+    /** Checks headers and returns either an identity or a failure with an HTTP status. */
+    authenticate(headers: RelyperHeaderSource): RelyperAuthResult;
+    /** Role check for additional gates inside the application. */
+    hasRole(identity: RelyperIdentity, role: string | string[], match?: 'any' | 'all'): boolean;
+};
+export declare function createRelyperAuth(options?: RelyperAuthOptions): RelyperAuth;
+//# sourceMappingURL=core.d.ts.map

package/dist/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,oBAAoB,EAAE,kBAKlC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAE,kBAKpC,CAAC;AAQF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAKnD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5E;AAkCD,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;IAC7C,sFAAsF;IACtF,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,iBAAiB,CAAC;IAC9D,8DAA8D;IAC9D,OAAO,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;CAC7F,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,WAAW,CAgD/E"}

package/dist/core.js

@@ -0,0 +1,123 @@
+export const DEFAULT_HEADER_NAMES = {
+    subject: 'x-relyper-subject',
+    email: 'x-relyper-email',
+    displayName: 'x-relyper-name',
+    roles: 'x-relyper-roles'
+};
+/** Common headers of a generic auth proxy, only active on explicit request. */
+export const FORWARDED_HEADER_NAMES = {
+    subject: 'x-forwarded-user',
+    email: 'x-forwarded-email',
+    displayName: 'x-forwarded-preferred-username',
+    roles: 'x-forwarded-groups'
+};
+const DEV_AUTH_DEFAULTS = {
+    subject: 'dev-user',
+    email: 'dev@relyper.local',
+    displayName: 'Relyper Dev User'
+};
+export function parseRoleList(raw) {
+    return raw
+        .split(',')
+        .map((role) => role.trim())
+        .filter(Boolean);
+}
+export function readHeader(source, name) {
+    if (typeof source.get === 'function') {
+        const value = source.get(name);
+        return typeof value === 'string' ? value.trim() : '';
+    }
+    const record = source;
+    const value = record[name] ?? record[name.toLowerCase()];
+    if (Array.isArray(value))
+        return (value[0] ?? '').trim();
+    return typeof value === 'string' ? value.trim() : '';
+}
+function resolveOptions(options) {
+    const requiredRoles = options.requiredRole === undefined
+        ? []
+        : (Array.isArray(options.requiredRole) ? options.requiredRole : [options.requiredRole]).filter(Boolean);
+    const forwarded = options.acceptForwardedHeaders;
+    const forwardedHeaderNames = forwarded
+        ? { ...FORWARDED_HEADER_NAMES, ...(typeof forwarded === 'object' ? forwarded : {}) }
+        : null;
+    const devAuthOption = options.devAuth;
+    const devAuthEnabled = Boolean(devAuthOption) && devAuthOption.enabled !== false;
+    return {
+        requiredRoles,
+        roleMatch: options.roleMatch ?? 'any',
+        requireEmail: options.requireEmail ?? true,
+        headerNames: { ...DEFAULT_HEADER_NAMES, ...(options.headerNames ?? {}) },
+        forwardedHeaderNames,
+        devAuth: devAuthEnabled
+            ? {
+                subject: devAuthOption.subject ?? DEV_AUTH_DEFAULTS.subject,
+                email: devAuthOption.email ?? DEV_AUTH_DEFAULTS.email,
+                displayName: devAuthOption.displayName ?? DEV_AUTH_DEFAULTS.displayName,
+                roles: devAuthOption.roles ?? requiredRoles
+            }
+            : null,
+        unauthenticatedStatus: options.unauthenticatedStatus ?? 401,
+        forbiddenStatus: options.forbiddenStatus ?? 403
+    };
+}
+export function createRelyperAuth(options = {}) {
+    const resolved = resolveOptions(options);
+    const parseRoles = options.parseRoles ?? parseRoleList;
+    function fail(code, status, presentedRoles) {
+        const base = { ok: false, status, code, presentedRoles };
+        const message = typeof options.message === 'function'
+            ? options.message(base)
+            : options.message ?? defaultMessage(code);
+        return { ...base, message };
+    }
+    return {
+        options: resolved,
+        authenticate(headers) {
+            const pick = (key) => {
+                const primary = readHeader(headers, resolved.headerNames[key]);
+                if (primary)
+                    return primary;
+                if (!resolved.forwardedHeaderNames)
+                    return '';
+                return readHeader(headers, resolved.forwardedHeaderNames[key]);
+            };
+            const presentedRoles = parseRoles(pick('roles'));
+            const dev = resolved.devAuth;
+            const subject = pick('subject') || (dev ? dev.subject : '');
+            const email = pick('email') || (dev ? dev.email : '');
+            const roles = presentedRoles.length ? presentedRoles : dev ? [...dev.roles] : [];
+            const displayName = pick('displayName') || email || (dev ? dev.displayName : '') || 'Relyper User';
+            if (!subject)
+                return fail('missing_subject', resolved.unauthenticatedStatus, presentedRoles);
+            if (resolved.requireEmail && !email)
+                return fail('missing_email', resolved.unauthenticatedStatus, presentedRoles);
+            if (resolved.requiredRoles.length && !matchesRoles(roles, resolved.requiredRoles, resolved.roleMatch)) {
+                return fail('missing_role', resolved.forbiddenStatus, presentedRoles);
+            }
+            const identity = { subject, email, displayName, roles };
+            const viaDevAuth = Boolean(dev) && !readHeader(headers, resolved.headerNames.subject);
+            return { ok: true, identity, viaDevAuth };
+        },
+        hasRole(identity, role, match = 'any') {
+            const wanted = Array.isArray(role) ? role : [role];
+            return matchesRoles(identity.roles, wanted, match);
+        }
+    };
+}
+function matchesRoles(actual, required, match) {
+    return match === 'all'
+        ? required.every((role) => actual.includes(role))
+        : required.some((role) => actual.includes(role));
+}
+function defaultMessage(code) {
+    switch (code) {
+        case 'missing_subject':
+            return 'Authentication required.';
+        case 'missing_email':
+            return 'Authentication required: the identity provider did not supply an e-mail address.';
+        case 'missing_role':
+            return 'Access requires an authenticated user with the required role.';
+    }
+}
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAUA,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,OAAO,EAAE,mBAAmB;IAC5B,KAAK,EAAE,iBAAiB;IACxB,WAAW,EAAE,gBAAgB;IAC7B,KAAK,EAAE,iBAAiB;CACzB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,gCAAgC;IAC7C,KAAK,EAAE,oBAAoB;CAC5B,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,OAAO,EAAE,UAAU;IACnB,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,kBAAkB;CAChC,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA2B,EAAE,IAAY;IAClE,IAAI,OAAQ,MAA4B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAI,MAA0D,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpF,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAAG,MAAuD,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY,KAAK,SAAS;QACtD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE1G,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,CAAC;IACjD,MAAM,oBAAoB,GAAG,SAAS;QACpC,CAAC,CAAC,EAAE,GAAG,sBAAsB,EAAE,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpF,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IACtC,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,IAAK,aAAuC,CAAC,OAAO,KAAK,KAAK,CAAC;IAE5G,OAAO;QACL,aAAa;QACb,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK;QACrC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,WAAW,EAAE,EAAE,GAAG,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;QACxE,oBAAoB;QACpB,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC;gBACE,OAAO,EAAG,aAAsC,CAAC,OAAO,IAAI,iBAAiB,CAAC,OAAO;gBACrF,KAAK,EAAG,aAAoC,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK;gBAC7E,WAAW,EAAG,aAA0C,CAAC,WAAW,IAAI,iBAAiB,CAAC,WAAW;gBACrG,KAAK,EAAG,aAAsC,CAAC,KAAK,IAAI,aAAa;aACtE;YACH,CAAC,CAAC,IAAI;QACR,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,GAAG;QAC3D,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,GAAG;KAChD,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,iBAAiB,CAAC,OAAO,GAAuB,EAAE;IAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IAEvD,SAAS,IAAI,CAAC,IAAgC,EAAE,MAAc,EAAE,cAAwB;QACtF,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;YACnD,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ;QAEjB,YAAY,CAAC,OAA4B;YACvC,MAAM,IAAI,GAAG,CAAC,GAA6B,EAAU,EAAE;gBACrD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/D,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,IAAI,CAAC,QAAQ,CAAC,oBAAoB;oBAAE,OAAO,EAAE,CAAC;gBAC9C,OAAO,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC,CAAC;YAEF,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC;YAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,cAAc,CAAC;YAEnG,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;YAC7F,IAAI,QAAQ,CAAC,YAAY,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;YAElH,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtG,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,QAAQ,GAAoB,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;YACzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,CAAC,QAAyB,EAAE,IAAuB,EAAE,KAAK,GAAkB,KAAK;YACtF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,QAAkB,EAAE,KAAoB;IAC9E,OAAO,KAAK,KAAK,KAAK;QACpB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,IAAgC;IACtD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,0BAA0B,CAAC;QACpC,KAAK,eAAe;YAClB,OAAO,kFAAkF,CAAC;QAC5F,KAAK,cAAc;YACjB,OAAO,+DAA+D,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/fastify.d.ts

@@ -0,0 +1,43 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type RelyperAuth } from './core.js';
+import type { RelyperAuthFailure, RelyperAuthOptions, RelyperIdentity } from './types.js';
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Identity from the Relyper IdP. Set by the plugin once the request is protected. */
+        relyperIdentity: RelyperIdentity;
+    }
+    interface FastifyInstance {
+        relyperAuth: RelyperAuth;
+    }
+}
+export type RelyperFastifyOptions = RelyperAuthOptions & {
+    /**
+     * Decides which requests are protected. Default: all.
+     * Typical: `(request) => request.url.startsWith('/api/')`.
+     */
+    protect?: (request: FastifyRequest) => boolean;
+    /** Hook the check runs in. Default: onRequest, i.e. before the body is parsed. */
+    hook?: 'onRequest' | 'preHandler';
+    /**
+     * Translates the IdP identity into the application's own user object,
+     * typically an upsert into its own database.
+     * Without this hook, the IdP identity lands on the request unchanged.
+     */
+    resolveUser?: (identity: RelyperIdentity, request: FastifyRequest) => unknown | Promise<unknown>;
+    /** Property on the request that holds the result. Default: 'principal'. */
+    principalKey?: string;
+    /** Path for a /me route. Default: false, the plugin does not register a route on its own. */
+    meRoute?: string | false;
+    /** Response of the /me route. Default: `{ user: request[principalKey] }`. */
+    meResponse?: (request: FastifyRequest) => unknown;
+    /** Error body. Default: `{ error: failure.message }`. */
+    errorBody?: (failure: RelyperAuthFailure, request: FastifyRequest) => unknown;
+    /** Hook for audit-logging failed access attempts. */
+    onAuthFailure?: (failure: RelyperAuthFailure, request: FastifyRequest) => void | Promise<void>;
+    /** Warns once in the log when dev auth kicks in. Default: true. */
+    warnOnDevAuth?: boolean;
+};
+declare function plugin(app: FastifyInstance, options: RelyperFastifyOptions): Promise<void>;
+export declare const relyperAuth: typeof plugin;
+export default relyperAuth;
+//# sourceMappingURL=fastify.d.ts.map

package/dist/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,sFAAsF;QACtF,eAAe,EAAE,eAAe,CAAC;KAClC;IACD,UAAU,eAAe;QACvB,WAAW,EAAE,WAAW,CAAC;KAC1B;CACF;AAED,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG;IACvD;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAC/C,kFAAkF;IAClF,IAAI,CAAC,EAAE,WAAW,GAAG,YAAY,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAClD,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC;IAC9E,qDAAqD;IACrD,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/F,mEAAmE;IACnE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,iBAAe,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDzF;AAED,eAAO,MAAM,WAAW,eAGtB,CAAC;eAEY,WAAW"}

package/dist/fastify.js

@@ -0,0 +1,51 @@
+import fp from 'fastify-plugin';
+import { createRelyperAuth } from './core.js';
+async function plugin(app, options) {
+    const auth = createRelyperAuth(options);
+    const principalKey = options.principalKey ?? 'principal';
+    const hook = options.hook ?? 'onRequest';
+    const protect = options.protect ?? (() => true);
+    const errorBody = options.errorBody ?? ((failure) => ({ error: failure.message }));
+    const warnOnDevAuth = options.warnOnDevAuth ?? true;
+    let devAuthWarned = false;
+    if (!app.hasRequestDecorator('relyperIdentity')) {
+        // Fastify recommends reserving the slot on the request upfront. The value stays
+        // empty until the hook runs; the declared type is deliberately non-nullable
+        // because a protected route always has an identity by the time it runs.
+        app.decorateRequest('relyperIdentity', null);
+    }
+    if (!app.hasRequestDecorator(principalKey)) {
+        app.decorateRequest(principalKey, null);
+    }
+    if (!app.hasDecorator('relyperAuth')) {
+        app.decorate('relyperAuth', auth);
+    }
+    app.addHook(hook, async (request, reply) => {
+        if (!protect(request))
+            return;
+        const result = auth.authenticate(request.headers);
+        if (!result.ok) {
+            if (options.onAuthFailure)
+                await options.onAuthFailure(result, request);
+            return reply.code(result.status).send(errorBody(result, request));
+        }
+        if (result.viaDevAuth && warnOnDevAuth && !devAuthWarned) {
+            devAuthWarned = true;
+            app.log.warn('@relyper/sp-auth: dev auth is active, requests without gateway headers are treated as an authenticated user. Never enable this in production.');
+        }
+        request.relyperIdentity = result.identity;
+        const principal = options.resolveUser ? await options.resolveUser(result.identity, request) : result.identity;
+        request[principalKey] = principal;
+    });
+    if (options.meRoute) {
+        const meResponse = options.meResponse
+            ?? ((request) => ({ user: request[principalKey] }));
+        app.get(options.meRoute, async (request) => meResponse(request));
+    }
+}
+export const relyperAuth = fp(plugin, {
+    name: '@relyper/sp-auth',
+    fastify: '5.x'
+});
+export default relyperAuth;
+//# sourceMappingURL=fastify.js.map

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../src/fastify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEhC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,WAAW,CAAC;AAyChE,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,OAA8B;IACxE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,OAA2B,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvG,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC;IACpD,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChD,gFAAgF;QAChF,4EAA4E;QAC5E,wEAAwE;QACxE,GAAG,CAAC,eAAe,CAAC,iBAAiB,EAAE,IAAkC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAElD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACzD,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,IAAI,CACV,+IAA+I,CAChJ,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7G,OAA8C,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU;eAChC,CAAC,CAAC,OAAuB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAG,OAA8C,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9G,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,EAAE;IACpC,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createRelyperAuth, parseRoleList, readHeader, DEFAULT_HEADER_NAMES, FORWARDED_HEADER_NAMES, type RelyperAuth } from './core.js';
+export type { RelyperAuthFailure, RelyperAuthFailureCode, RelyperAuthOptions, RelyperAuthResult, RelyperAuthSuccess, RelyperDevAuthOptions, RelyperHeaderNames, RelyperHeaderSource, RelyperIdentity, ResolvedRelyperAuthOptions } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC3B,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { createRelyperAuth, parseRoleList, readHeader, DEFAULT_HEADER_NAMES, FORWARDED_HEADER_NAMES } from './core.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,sBAAsB,EAEvB,MAAM,WAAW,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,88 @@
+/** Identity that the Relyper IdP passes to a service provider via the gateway. */
+export type RelyperIdentity = {
+    /** Stable, unique identifier of the user at the IdP. Never the local database ID. */
+    subject: string;
+    email: string;
+    displayName: string;
+    roles: string[];
+};
+export type RelyperAuthFailureCode = 'missing_subject' | 'missing_email' | 'missing_role';
+export type RelyperAuthFailure = {
+    ok: false;
+    /** HTTP status the adapter should send. */
+    status: number;
+    code: RelyperAuthFailureCode;
+    message: string;
+    /**
+     * Roles the gateway sent along. Intended solely for logging and
+     * debugging, never as a basis for authorization.
+     */
+    presentedRoles: string[];
+};
+export type RelyperAuthSuccess = {
+    ok: true;
+    identity: RelyperIdentity;
+    /** true if the identity came from dev auth rather than the gateway. */
+    viaDevAuth: boolean;
+};
+export type RelyperAuthResult = RelyperAuthSuccess | RelyperAuthFailure;
+export type RelyperHeaderNames = {
+    subject: string;
+    email: string;
+    displayName: string;
+    roles: string;
+};
+/**
+ * Header source. Supports both the plain object from Node/Fastify and
+ * anything with a `get` method, such as the Fetch API's Headers.
+ */
+export type RelyperHeaderSource = Record<string, string | string[] | undefined> | {
+    get(name: string): string | null | undefined;
+};
+export type RelyperDevAuthOptions = {
+    /** Default: true, as soon as an object is passed. */
+    enabled?: boolean;
+    subject?: string;
+    email?: string;
+    displayName?: string;
+    roles?: string[];
+};
+export type RelyperAuthOptions = {
+    /** Role(s) the user needs for this service provider. Empty means: no role check. */
+    requiredRole?: string | string[];
+    /** With multiple required roles: one is enough ('any', default) or all are needed ('all'). */
+    roleMatch?: 'any' | 'all';
+    /** Default: true. Set to false if the IdP does not supply an email address. */
+    requireEmail?: boolean;
+    /** Custom header names, e.g. for a different gateway prefix. */
+    headerNames?: Partial<RelyperHeaderNames>;
+    /**
+     * Accept `x-forwarded-*` as a fallback. Default: false.
+     * Deliberately off because these headers can come from generic proxies.
+     */
+    acceptForwardedHeaders?: boolean | Partial<RelyperHeaderNames>;
+    /**
+     * Development login without a gateway. Default: off.
+     * Must stay off in production, otherwise any caller authenticates itself.
+     */
+    devAuth?: RelyperDevAuthOptions | false;
+    /** Status when no identity arrives at all. Default: 401. */
+    unauthenticatedStatus?: number;
+    /** Status when the identity is valid but the role is missing. Default: 403. */
+    forbiddenStatus?: number;
+    /** Fixed text or function for the error message. */
+    message?: string | ((failure: Omit<RelyperAuthFailure, 'message'>) => string);
+    /** Custom parsing of the roles header, in case the gateway does not use a comma. */
+    parseRoles?: (raw: string) => string[];
+};
+export type ResolvedRelyperAuthOptions = {
+    requiredRoles: string[];
+    roleMatch: 'any' | 'all';
+    requireEmail: boolean;
+    headerNames: RelyperHeaderNames;
+    forwardedHeaderNames: RelyperHeaderNames | null;
+    devAuth: Required<Omit<RelyperDevAuthOptions, 'enabled'>> | null;
+    unauthenticatedStatus: number;
+    forbiddenStatus: number;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG;IAC5B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,eAAe,GAAG,cAAc,CAAC;AAE1F,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,eAAe,CAAC;IAC1B,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7C;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC;AAErD,MAAM,MAAM,qBAAqB,GAAG;IAClC,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D;;;OAGG;IACH,OAAO,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAC;IACxC,4DAA4D;IAC5D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC;IAC9E,oFAAoF;IACpF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,KAAK,GAAG,KAAK,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,oBAAoB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChD,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC;IACjE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@relyper/sp-auth",
+  "version": "0.1.0",
+  "description": "Service-provider side of Relyper identity: principal resolution from gateway headers, role gating, a Fastify adapter, and a framework-free browser client.",
+  "license": "MIT",
+  "author": "Jonas Esser",
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "relyper",
+    "identity",
+    "authentication",
+    "authorization",
+    "service-provider",
+    "fastify",
+    "rbac"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jonasesser/relyper-sp-auth.git"
+  },
+  "bugs": {
+    "url": "https://github.com/jonasesser/relyper-sp-auth/issues"
+  },
+  "homepage": "https://github.com/jonasesser/relyper-sp-auth#readme",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./fastify": {
+      "types": "./dist/fastify.d.ts",
+      "import": "./dist/fastify.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "fastify-plugin": "^5.1.0"
+  },
+  "peerDependencies": {
+    "fastify": ">=5"
+  },
+  "peerDependenciesMeta": {
+    "fastify": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^26.3.0",
+    "fastify": "^5.12.1",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}