@sphereon/ssi-express-support 0.14.2-next.25

package/dist/static-bearer-auth.js

@@ -0,0 +1,146 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MapBasedStaticBearerUserProvider = exports.StaticBearerAuth = void 0;
+const passport_1 = __importDefault(require("passport"));
+const u8a = __importStar(require("uint8arrays"));
+class StaticBearerAuth {
+    static init(strategy, provider) {
+        return new StaticBearerAuth(strategy !== null && strategy !== void 0 ? strategy : 'bearer', provider !== null && provider !== void 0 ? provider : new MapBasedStaticBearerUserProvider(strategy));
+    }
+    constructor(strategy, provider) {
+        this.hashTokens = false;
+        this.strategy = strategy;
+        if (StaticBearerAuth.providers.has(strategy)) {
+            if (StaticBearerAuth.providers.get(strategy) !== provider) {
+                throw Error('Cannot register another user provider for strategy: ' + strategy);
+            }
+        }
+        else {
+            StaticBearerAuth.providers.set(strategy, provider);
+        }
+    }
+    get provider() {
+        const provider = StaticBearerAuth.providers.get(this.strategy);
+        if (!provider) {
+            throw Error('Could not get user provider for ' + this.strategy);
+        }
+        return provider;
+    }
+    withHashTokens(hashTokens) {
+        this.hashTokens = hashTokens;
+        return this;
+    }
+    withUsers(users) {
+        this.addUser(users);
+        return this;
+    }
+    addUser(user) {
+        this.provider.addUser(user);
+        return this;
+    }
+    withVerifyOptions(options) {
+        StaticBearerAuth.verifyOptions.set(this.strategy, options);
+        return this;
+    }
+    connectPassport() {
+        const _provider = this.provider;
+        function findUser(token, cb) {
+            const user = _provider.getUser(token);
+            if (user) {
+                return cb(null, user);
+            }
+            return cb('bearer token not found or incorrect', false);
+        }
+        Promise.resolve().then(() => __importStar(require('passport-http-bearer'))).then((httpBearer) => {
+            var _a;
+            const hashTokens = (_a = this.hashTokens) !== null && _a !== void 0 ? _a : false;
+            passport_1.default.use(this.strategy, new httpBearer.Strategy({ passReqToCallback: false }, function (token, cb) {
+                if (hashTokens) {
+                    Promise.resolve().then(() => __importStar(require('@noble/hashes/sha256'))).then((hash) => {
+                        findUser(u8a.toString(hash.sha256(token)), cb);
+                    })
+                        .catch((error) => {
+                        console.log(`hash problem: ${error}`);
+                        throw Error('Did you include @noble/hashes in package.json?');
+                    });
+                }
+                else {
+                    findUser(token, cb);
+                }
+            }));
+        })
+            .catch((error) => {
+            console.log(`passport-http-bearer package problem: ${error}`);
+            throw Error('Did you include passport-http-bearer in package.json?');
+        });
+    }
+}
+exports.StaticBearerAuth = StaticBearerAuth;
+StaticBearerAuth.providers = new Map();
+StaticBearerAuth.verifyOptions = new Map();
+class MapBasedStaticBearerUserProvider {
+    constructor(strategy, hashedTokens) {
+        this._users = [];
+        this._strategy = strategy;
+        this._hashedTokens = hashedTokens !== null && hashedTokens !== void 0 ? hashedTokens : false;
+    }
+    get users() {
+        return this._users;
+    }
+    get hashedTokens() {
+        return this._hashedTokens;
+    }
+    get strategy() {
+        return this._strategy;
+    }
+    getUser(token) {
+        return this.users.find((user) => user.token === token);
+    }
+    addUser(user, hashToken) {
+        const users = Array.isArray(user) ? user : [user];
+        if (hashToken) {
+            if (!this.hashedTokens) {
+                throw Error('Cannot hash token, when hashed tokens is not enabled on the user provider for strategy ' + this.strategy);
+            }
+            Promise.resolve().then(() => __importStar(require('@noble/hashes/sha256'))).then((hash) => {
+                users.forEach((user) => (user.token = u8a.toString(hash.sha256(user.token))));
+            })
+                .catch((error) => {
+                console.log(`hash problem: ${error}`);
+                throw Error('Did you include @noble/hashes in package.json?');
+            });
+        }
+        this._users.push(...users);
+    }
+    getUsers() {
+        return this._users;
+    }
+}
+exports.MapBasedStaticBearerUserProvider = MapBasedStaticBearerUserProvider;
+//# sourceMappingURL=static-bearer-auth.js.map

package/dist/static-bearer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-bearer-auth.js","sourceRoot":"","sources":["../src/static-bearer-auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,wDAA+B;AAC/B,iDAAkC;AAElC,MAAa,gBAAgB;IAMpB,MAAM,CAAC,IAAI,CAAC,QAAgB,EAAE,QAAmC;QACtE,OAAO,IAAI,gBAAgB,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,QAAQ,EAAE,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAI,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC/G,CAAC;IAED,YAAoB,QAAgB,EAAE,QAAkC;QANhE,eAAU,GAAa,KAAK,CAAA;QAOlC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;YAC5C,IAAI,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE;gBACzD,MAAM,KAAK,CAAC,sDAAsD,GAAG,QAAQ,CAAC,CAAA;aAC/E;SACF;aAAM;YACL,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;SACnD;IACH,CAAC;IAED,IAAI,QAAQ;QACV,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9D,IAAI,CAAC,QAAQ,EAAE;YACb,MAAM,KAAK,CAAC,kCAAkC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;SAChE;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,cAAc,CAAC,UAAmB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,SAAS,CAAC,KAAgC;QACxC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,CAAC,IAA+B;QACrC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iBAAiB,CAAC,OAA4C;QAC5D,gBAAgB,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC;IAED,eAAe;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC/B,SAAS,QAAQ,CAAC,KAAa,EAAE,EAAkF;YACjH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,IAAI,IAAI,EAAE;gBACR,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;aACtB;YACD,OAAO,EAAE,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAA;QACzD,CAAC;QAED,kDAAO,sBAAsB,IAC1B,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;;YACnB,MAAM,UAAU,GAAG,MAAA,IAAI,CAAC,UAAU,mCAAI,KAAK,CAAA;YAC3C,kBAAQ,CAAC,GAAG,CACV,IAAI,CAAC,QAAQ,EACb,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,UACpD,KAAa,EACb,EAAkF;gBAElF,IAAI,UAAU,EAAE;oBACd,kDAAO,sBAAsB,IAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;wBACb,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;oBAChD,CAAC,CAAC;yBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;wBACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAA;wBACrC,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAA;oBAC/D,CAAC,CAAC,CAAA;iBACL;qBAAM;oBACL,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;iBACpB;YACH,CAAC,CAAC,CACH,CAAA;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAA;YAC7D,MAAM,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;IACN,CAAC;;AAvFH,4CAwFC;AAtFgB,0BAAS,GAA0C,IAAI,GAAG,EAAE,CAAA;AAC5D,8BAAa,GAAqD,IAAI,GAAG,EAAE,CAAA;AAiG5F,MAAa,gCAAgC;IAK3C,YAAY,QAAgB,EAAE,YAAsB;QAHnC,WAAM,GAAiB,EAAE,CAAA;QAIxC,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,aAAa,GAAG,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,KAAK,CAAA;IAC5C,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAA;IAC3B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,CAAC,IAA+B,EAAE,SAAmB;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,SAAS,EAAE;YACb,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;gBACtB,MAAM,KAAK,CAAC,yFAAyF,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAA;aACvH;YACD,kDAAO,sBAAsB,IAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACb,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC/E,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAA;gBACrC,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAA;YAC/D,CAAC,CAAC,CAAA;SACL;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;CACF;AA/CD,4EA+CC"}

package/dist/types.d.ts

@@ -0,0 +1,179 @@
+import { Enforcer } from 'casbin';
+import { Express, RequestHandler } from 'express';
+import { ParamsDictionary } from 'express-serve-static-core';
+import { Strategy } from 'passport';
+import { ParsedQs } from 'qs';
+export interface IExpressServerOpts {
+    port?: number;
+    cookieSigningKey?: string;
+    hostname?: string;
+    basePath?: string;
+    existingExpress?: Express;
+    listenCallback?: () => void;
+    startListening?: boolean;
+}
+export declare function hasEndpointOpts(opts: any): any;
+export type HasEndpointOpts = {
+    endpointOpts?: IEndpointOpts & SingleEndpoints;
+} & Record<string, any>;
+export type SingleEndpoints = Record<string, ISingleEndpointOpts | any>;
+export interface IEndpointOpts {
+    basePath?: string;
+    globalAuth?: GenericAuthArgs;
+}
+export interface ExpressSupport {
+    express: Express;
+    port: number;
+    hostname: string;
+    userIsInRole?: string | string[];
+    startListening: boolean;
+    enforcer?: Enforcer;
+    start: (opts?: {
+        disableErrorHandler?: boolean;
+    }) => Express;
+}
+export interface ISingleEndpointOpts extends GenericAuthArgs {
+    endpoint?: EndpointArgs;
+    enabled?: boolean;
+    path?: string;
+    disableGlobalAuth?: boolean;
+}
+export interface GenericAuthArgs {
+    authentication?: {
+        enabled?: boolean;
+        strategy?: string | string[] | Strategy;
+    };
+    authorization?: {
+        enabled?: boolean;
+        requireUserInRoles?: string | string[];
+        enforcer?: Enforcer;
+    };
+}
+export interface EndpointArgs extends GenericAuthArgs {
+    resource?: string;
+    operation?: string;
+    handlers?: RequestHandler<ParamsDictionary, any, any, ParsedQs, Record<string, any>>[];
+}
+export interface BearerUser extends Express.User {
+    id: string | number;
+    name?: string;
+    token: string;
+}
+export interface IStaticBearerVerifyOptions {
+    message?: string | undefined;
+    scope: string | Array<string>;
+}
+export interface IBaseStrategyOption {
+    identityMetadata: string;
+    clientID: string;
+    isB2C?: boolean | undefined;
+    validateIssuer?: boolean | undefined;
+    issuer?: string | string[] | undefined;
+    loggingLevel?: 'info' | 'warn' | 'error' | undefined;
+    loggingNoPII?: boolean | undefined;
+    clockSkew?: number | undefined;
+}
+export interface ITokenPayload {
+    /** An App ID URI. Identifies the intended recipient of the token. */
+    aud?: string | undefined;
+    /** A security token service(STS) URI. Identifies the STS that constructs and returns the token,
+     * and the Azure AD tenant in which the user was authenticated.*/
+    iss?: string | undefined;
+    /** The identity provider that authenticated the subject of the token*/
+    idp?: string | undefined;
+    /** "Issued At" indicates when the authentication for this token occurred. */
+    iat?: number | undefined;
+    /** The "nbf" (not before) claim identifies the time before which the JWT must not be accepted for processing. */
+    nbf?: number | undefined;
+    /** The "exp" (expiration time) claim identifies the expiration time on or after which the JWT must not be accepted for processing. */
+    exp?: number | undefined;
+    /** An internal claim used by Azure AD to record data for token reuse. */
+    aio?: string | undefined;
+    /** Only present in v1.0 tokens. The "Authentication context class" claim. A value of "0" indicates the end-user authentication did not meet the requirements of ISO/IEC 29115. */
+    acr?: '0' | '1' | undefined;
+    /** Only present in v1.0 tokens. Identifies how the subject of the token was authenticated.  */
+    amr?: string[] | undefined;
+    /** Only present in v1.0 tokens. GUID represents the application ID of the client using the token. */
+    appid?: string | undefined;
+    /** Only present in v2.0 tokens. The application ID of the client using the token. */
+    azp?: string | undefined;
+    /** Only present in v1.0 tokens. Indicates how the client was authenticated. For a public client, the value is "0".
+     * If client ID and client secret are used, the value is "1". If a client certificate was used for authentication, the value is "2". */
+    appidacr?: '0' | '1' | '2' | undefined;
+    /** Only present in v2.0 tokens. Indicates how the client was authenticated.
+     * For a public client, the value is "0". If client ID and client secret are used, the value is "1". If a client certificate was used for authentication, the value is "2". */
+    azpacr?: '0' | '1' | '2' | undefined;
+    /** Only present in v2.0 tokens. The primary username that represents the user. It could be an email address, phone number, or a generic username without a specified format */
+    preferred_username?: string | undefined;
+    /** Provides a human-readable value that identifies the subject of the token.
+     * The value is not guaranteed to be unique, it is mutable, and it's designed to be used only for display purposes. The profile scope is required in order to receive this claim. */
+    name?: string | undefined;
+    /** The set of scopes exposed by your application for which the client application has requested (and received) consent. */
+    scp?: string | undefined;
+    /** The set of permissions exposed by your application that the requesting application has been given permission to call. */
+    roles?: string[] | undefined;
+    /** Provides object IDs that represent the subject's group memberships. */
+    groups?: string | string[] | undefined;
+    /** Denoting the user is in at least one group. */
+    hasgroups?: true | undefined;
+    /** The principal about which the token asserts information, such as the user of an app. This value is immutable and cannot be reassigned or reused.
+     * It can be used to perform authorization checks safely, such as when the token is used to access a resource,
+     * and can be used as a key in database tables. Because the subject is always present in the tokens that Azure AD issues,
+     * we recommend using this value in a general-purpose authorization system. The subject is, however, a pairwise identifier - it is unique to a particular application ID.   */
+    sub?: string | undefined;
+    /** GUID represents a user. This ID uniquely identifies the user across applications. */
+    oid?: string | undefined;
+    /** Represents the Azure AD tenant that the user is from. */
+    tid?: string | undefined;
+    /** Only present in v1.0 tokens. Provides a human readable value that identifies the subject of the token.  */
+    unique_name?: string | undefined;
+    /** An internal claim used by Azure to revalidate tokens. */
+    uti?: string | undefined;
+    /** An internal claim used by Azure to revalidate tokens. */
+    rh?: string | undefined;
+    /** Indicates the version of the access token. */
+    ver?: '1.0' | '2.0' | undefined;
+    /** v1.0 basic claims */
+    /** The IP address the user authenticated from. */
+    ipaddr?: string | undefined;
+    /** In cases where the user has an on-premises authentication, this claim provides their SID. */
+    onprem_sid?: string | undefined;
+    /** Indicates when the user's password expires. */
+    pwd_exp?: number | undefined;
+    /** A URL where users can be sent to reset their password. */
+    pwd_url?: string | undefined;
+    /** Signals if the client is logging in from the corporate network. If they aren't, the claim isn't included. */
+    in_corp?: string | undefined;
+    /** An additional name for the user, separate from first or last name */
+    nickname?: string | undefined;
+    /** Provides the last name, surname, or family name of the user as defined on the user object. */
+    family_name?: string | undefined;
+    /** Provides the first or given name of the user, as set on the user object. */
+    given_name?: string | undefined;
+    /** The username of the user. May be a phone number, email address, or unformatted string. */
+    upn?: string | undefined;
+}
+export interface IBaseStrategyOption {
+    identityMetadata: string;
+    clientID: string;
+    isB2C?: boolean | undefined;
+    validateIssuer?: boolean | undefined;
+    issuer?: string | string[] | undefined;
+    loggingLevel?: 'info' | 'warn' | 'error' | undefined;
+    loggingNoPII?: boolean | undefined;
+    clockSkew?: number | undefined;
+}
+export interface IBearerStrategyOption extends IBaseStrategyOption {
+    audience?: string | string[] | undefined;
+    policyName?: String | undefined;
+    allowMultiAudiencesInToken?: boolean | undefined;
+    scope?: string[] | undefined;
+}
+export interface IBearerStrategyOptionWithRequest extends IBearerStrategyOption {
+    passReqToCallback: boolean;
+}
+export type VerifyBearerFunction = (token: ITokenPayload, done: VerifyCallback) => void;
+export interface VerifyCallback {
+    (error: any, user?: any, info?: any): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AAE7B,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAA;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAA;CAEzB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,GAAG,OAExC;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,YAAY,CAAC,EAAE,aAAa,GAAG,eAAe,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAEtG,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,GAAG,CAAC,CAAA;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,eAAe,CAAA;CAC7B;AACD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAChC,cAAc,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAA;CAC7D;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAA;KACxC,CAAA;IACD,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACtC,QAAQ,CAAC,EAAE,QAAQ,CAAA;KACpB,CAAA;CACF;AAED,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,cAAc,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;CACvF;AAED,MAAM,WAAW,UAAW,SAAQ,OAAO,CAAC,IAAI;IAC9C,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3B,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;IACpD,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB;qEACiE;IACjE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,iHAAiH;IACjH,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,sIAAsI;IACtI,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,kLAAkL;IAClL,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IAC3B,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1B,qGAAqG;IACrG,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB;2IACuI;IACvI,QAAQ,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IACtC;kLAC8K;IAC9K,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;IACpC,+KAA+K;IAC/K,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC;wLACoL;IACpL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,2HAA2H;IAC3H,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC5B,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACtC,kDAAkD;IAClD,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;IAC5B;;;kLAG8K;IAC9K,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,iDAAiD;IACjD,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAA;IAE/B,wBAAwB;IAExB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,gHAAgH;IAChH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,iGAAiG;IACjG,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AACD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3B,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACtC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;IACpD,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAClC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAA;IACxC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAChD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;CAC7B;AAED,MAAM,WAAW,gCAAiC,SAAQ,qBAAqB;IAC7E,iBAAiB,EAAE,OAAO,CAAA;CAC3B;AACD,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,KAAK,IAAI,CAAA;AACvF,MAAM,WAAW,cAAc;IAC7B,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,IAAI,CAAA;CAC3C"}

package/dist/types.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasEndpointOpts = void 0;
+function hasEndpointOpts(opts) {
+    return 'endpointOpts' in opts && opts.endpointOpts;
+}
+exports.hasEndpointOpts = hasEndpointOpts;
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAiBA,SAAgB,eAAe,CAAC,IAAS;IACvC,OAAO,cAAc,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,CAAA;AACpD,CAAC;AAFD,0CAEC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@sphereon/ssi-express-support",
+  "version": "0.14.2-next.25+e1ec641",
+  "source": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc --build",
+    "build:clean": "tsc --build --clean && tsc --build"
+  },
+  "dependencies": {
+    "body-parser": "^1.20.2",
+    "casbin": "^5.26.1",
+    "cors": "^2.8.5",
+    "dotenv-flow": "^3.2.0",
+    "express": "^4.18.2",
+    "express-session": "^1.17.3",
+    "morgan": "^1.10.0",
+    "passport": "^0.6.0",
+    "qs": "^6.11.2",
+    "uint8arrays": "^3.1.1"
+  },
+  "peerDependencies": {
+    "@noble/hashes": "^1.3.1",
+    "passport-azure-ad": "^4.3.5",
+    "passport-http-bearer": "^1.0.1"
+  },
+  "peerDependenciesMeta": {
+    "passport-http-bearer": {
+      "optional": true
+    },
+    "@noble/hashes": {
+      "optional": true
+    },
+    "passport-azure-ad": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/body-parser": "^1.19.2",
+    "@types/cors": "^2.8.13",
+    "@types/dotenv-flow": "^3.2.0",
+    "@types/express": "^4.17.17",
+    "@types/express-serve-static-core": "^4.17.35",
+    "@types/express-session": "^1.17.7",
+    "@types/morgan": "^1.9.4",
+    "@types/passport": "^1.0.12",
+    "@types/passport-azure-ad": "^4.3.1",
+    "@types/passport-http-bearer": "^1.0.37",
+    "@types/qs": "^6.9.7"
+  },
+  "files": [
+    "dist/**/*",
+    "src/**/*",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": "git@github.com:Sphereon-Opensource/SSI-SDK.git",
+  "author": "Sphereon <dev@sphereon.com>",
+  "license": "Apache-2.0",
+  "keywords": [
+    "Sphereon",
+    "SSI",
+    "Agent"
+  ],
+  "gitHead": "e1ec6418e1a4f139970e4c3e87bfbefb4bd0686d"
+}

package/src/auth-utils.ts

@@ -0,0 +1,127 @@
+import express, { NextFunction, RequestHandler } from 'express'
+import { ParamsDictionary } from 'express-serve-static-core'
+import passport from 'passport'
+import { ParsedQs } from 'qs'
+import { EndpointArgs, hasEndpointOpts, HasEndpointOpts } from './types'
+
+export const checkUserIsInRole = (opts: { roles: string | string[] }) => (req: express.Request, res: express.Response, next: NextFunction) => {
+  if (!opts?.roles || opts.roles.length === 0) {
+    return next()
+  }
+  const roles = Array.isArray(opts.roles) ? opts.roles : [opts.roles]
+  if (!req?.user || !('role' in req.user)) {
+    return res.status(401).end()
+  }
+
+  // @ts-ignore
+  const hasRole = roles.find((role) => req.user.role.toLowerCase() === role.toLowerCase())
+  if (!hasRole) {
+    return res.status(403).end()
+  }
+
+  return next()
+}
+
+const checkAuthenticationImpl = (req: express.Request, res: express.Response, next: express.NextFunction, opts?: EndpointArgs) => {
+  if (!opts || !opts.authentication || opts.authentication.enabled === false) {
+    return next()
+  }
+  if (!opts.authentication.strategy) {
+    console.log(`Authentication enabled, but no strategy configured. All auth request will be denied!`)
+    return res.status(401).end()
+  }
+  const options = { authInfo: true, session: false }
+  passport
+    .authenticate(
+      opts.authentication.strategy,
+      options,
+      (
+        err: any,
+        user?: Express.User | false | null,
+        _info?: object | string | Array<string | undefined>,
+        _status?: number | Array<number | undefined>
+      ) => {
+        if (err) {
+          return next({ statusCode: 403, message: err })
+        } else if (!user) {
+          console.log('Authentication failed, no user object present in request')
+          return next({ statusCode: 401, message: 'authentication failed' })
+        }
+        if (options.session) {
+          req.logIn(user, function (err) {
+            if (err) {
+              return next(err)
+            }
+            return res.send(user)
+          })
+        }
+        return next()
+      }
+    )
+    .call(this, req, res, next)
+  // next()
+}
+const checkAuthorizationImpl = (req: express.Request, res: express.Response, next: express.NextFunction, opts?: EndpointArgs) => {
+  if (!opts || !opts.authentication || !opts.authorization || opts.authentication.enabled === false || opts?.authorization.enabled === false) {
+    return next()
+  }
+  /*if (!req.isAuthenticated()) {
+        return sendErrorResponse(res, 403, 'Authorization with an unauthenticated request is not possible')
+    }*/
+  const authorization = opts.authorization
+
+  if (!authorization.enforcer && (!authorization.requireUserInRoles || authorization.requireUserInRoles.length === 0)) {
+    console.log(`Authorization enabled for endpoint, but no enforcer or roles supplied`)
+    return res.status(401).end()
+  }
+  if (authorization.requireUserInRoles && authorization.requireUserInRoles.length > 0) {
+    checkUserIsInRole({ roles: authorization.requireUserInRoles })
+  }
+  if (authorization.enforcer) {
+    const enforcer = authorization.enforcer
+    const permitted = enforcer.enforceSync(req.user, opts.resource, opts.operation)
+    if (!permitted) {
+      console.log(`Access to ${opts.resource} and op ${opts.operation} not allowed for ${req.user}`)
+      return res.status(403).end()
+    }
+  }
+  return next()
+}
+
+export const checkAuthenticationOnly = (opts?: EndpointArgs) => (req: express.Request, res: express.Response, next: express.NextFunction) => {
+  // executeRequestHandlers(req, res, next, opts)
+  return checkAuthenticationImpl(req, res, next, opts)
+}
+
+export const checkAuthorizationOnly = (opts?: EndpointArgs) => (req: express.Request, res: express.Response, next: express.NextFunction) => {
+  // executeRequestHandlers(req, res, next, opts)
+  return checkAuthorizationImpl(req, res, next, opts)
+}
+export const checkAuth = (opts?: EndpointArgs): RequestHandler<ParamsDictionary, any, any, ParsedQs, Record<string, any>>[] => {
+  const handlers: RequestHandler<ParamsDictionary, any, any, ParsedQs, Record<string, any>>[] = []
+  handlers.push(checkAuthenticationOnly(opts))
+  handlers.push(checkAuthorizationOnly(opts))
+  opts?.handlers && handlers.push(...opts.handlers)
+  return handlers
+}
+
+export function copyGlobalAuthToEndpoint(args?: { opts?: HasEndpointOpts; key: string }) {
+  const opts = args?.opts
+  const key = args?.key
+  if (!opts || !key || !hasEndpointOpts(opts)) {
+    return
+  }
+  if (opts.endpointOpts?.globalAuth) {
+    if (opts.endpointOpts[key]?.disableGlobalAuth === true) {
+      return
+    }
+    opts.endpointOpts[key] = {
+      ...opts.endpointOpts[key],
+      endpoint: { ...opts.endpointOpts.globalAuth, ...opts.endpointOpts[key]?.endpoint },
+    }
+  }
+}
+
+export function copyGlobalAuthToEndpoints(args?: { opts?: HasEndpointOpts; keys: string[] }) {
+  args?.keys.forEach((key) => copyGlobalAuthToEndpoint({ opts: args?.opts, key }))
+}

package/src/entra-id-auth.ts

@@ -0,0 +1,47 @@
+import passport from 'passport'
+import { IBearerStrategyOption, IBearerStrategyOptionWithRequest, ITokenPayload, VerifyCallback } from './types'
+
+export class EntraIDAuth {
+  private readonly strategy: string
+  private options?: IBearerStrategyOptionWithRequest
+
+  public static init(strategy: string) {
+    return new EntraIDAuth(strategy)
+  }
+
+  private constructor(strategy: string) {
+    this.strategy = strategy
+  }
+
+  public withOptions(options: IBearerStrategyOption | IBearerStrategyOptionWithRequest): this {
+    this.options = {
+      ...options,
+      passReqToCallback: 'passReqToCallback' in options ? options.passReqToCallback : false,
+    }
+    return this
+  }
+
+  connectPassport() {
+    const _options = this.options
+    if (!_options) {
+      throw Error('No options supplied for EntraID')
+    }
+    import('passport-azure-ad')
+      .then((entraID) =>
+        passport.use(
+          this.strategy,
+          new entraID.BearerStrategy(_options, function (token: ITokenPayload, cb: VerifyCallback): void {
+            if (token) {
+              // console.log(`token: ${JSON.stringify(token, null, 2)}`)
+              return cb(null, token)
+            }
+            return cb('bearer token not found or incorrect', null)
+          })
+        )
+      )
+      .catch((reason) => {
+        console.log(reason)
+        throw Error('Could not create bearer strategy. Did you include the "passport-azure-ad/bearer-strategy" dependency in package.json?')
+      })
+  }
+}