@spine-event-engine/server 2.0.0-snapshot.26 → 2.0.0-snapshot.28

package/dist/browser/browser-admission.js

@@ -0,0 +1,200 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+/**
+ * Immutable startup admission names and raw request inspection for one browser host.
+ */
+export class BrowserAdmissionPolicy {
+    /**
+     * Captured duplicate-sensitive names for the active RPC credential reader.
+     */
+    reader;
+    /**
+     * Captured duplicate-sensitive names indexed by exact authentication route path.
+     */
+    routes;
+    #csrfHeaders;
+    #selectedCookies;
+    /**
+     * Stores the validated reader and route names for one listener.
+     * @param reader Active RPC credential reader declaration.
+     * @param routes Authentication route declarations indexed by exact path.
+     */
+    constructor(reader, routes) {
+        this.reader = reader;
+        this.routes = routes;
+        const all = [reader, ...routes.values()];
+        this.#csrfHeaders = new Set(all.flatMap((value) => value.csrfHeaderNames));
+        this.#selectedCookies = new Set(all.flatMap((value) => [...value.credentialCookieNames, ...value.stateCookieNames]));
+    }
+    /**
+     * Validates and copies every declaration before the first asynchronous startup step.
+     * @param reader Active RPC credential reader declaration.
+     * @param routes Validated route configurations indexed by pathname.
+     * @returns One immutable admission policy for startup and requests.
+     */
+    static create(reader, routes) {
+        const copied = new Map();
+        for (const [path, route] of routes)
+            copied.set(path, AdmissionNames.copy(route.admission));
+        return new BrowserAdmissionPolicy(AdmissionNames.copy(reader), copied);
+    }
+    /**
+     * Rejects ambiguous raw headers and returns an immutable duplicate-preserving view.
+     * @param request Incoming Node request before WHATWG normalization.
+     * @param active Reader or selected route declaration for primary conflict checks.
+     * @returns Raw header view or a terminal admission rejection.
+     */
+    inspect(request, active) {
+        const headers = AdmissionNames.raw(request.rawHeaders);
+        for (const name of ["authorization", "origin", ...this.#csrfHeaders])
+            if ((headers[name]?.length ?? 0) > 1)
+                return { kind: "rejected", reason: `repeated ${name}` };
+        const cookies = AdmissionNames.cookies(headers.cookie ?? [], this.#selectedCookies);
+        if ("reason" in cookies)
+            return { kind: "rejected", reason: cookies.reason };
+        const primary = active.credentialCookieNames.filter((name) => cookies.present.has(name));
+        if (primary.length > 1 || (primary.length > 0 && (headers.authorization?.length ?? 0) > 0))
+            return { kind: "rejected", reason: "simultaneous credentials" };
+        return { kind: "admitted", headers: AdmissionNames.freeze(headers) };
+    }
+}
+/**
+ * Internal name validation and raw field selection.
+ */
+const AdmissionNames = Object.freeze({
+    /**
+     * Copies a complete metadata declaration and validates all three required arrays.
+     * @param supplied JavaScript or TypeScript caller metadata.
+     * @returns Frozen normalized header names and exact cookie names.
+     */
+    copy(supplied) {
+        if (typeof supplied !== "object" || supplied === null)
+            throw new Error("Browser credential admission metadata is required.");
+        const value = supplied;
+        const csrf = AdmissionNames.names(value.csrfHeaderNames, "csrfHeaderNames", true);
+        const credential = AdmissionNames.names(value.credentialCookieNames, "credentialCookieNames", false);
+        const state = AdmissionNames.names(value.stateCookieNames, "stateCookieNames", false);
+        if (credential.some((name) => state.includes(name)))
+            throw new Error("Browser credential and state cookie names must be distinct.");
+        return Object.freeze({
+            csrfHeaderNames: csrf,
+            credentialCookieNames: credential,
+            stateCookieNames: state,
+        });
+    },
+    /**
+     * Validates a complete array without accepting sparse or repeated names.
+     * @param supplied Metadata array from a caller.
+     * @param label Category used in configuration errors.
+     * @param header Whether case-insensitive HTTP header rules apply.
+     * @returns Frozen validated names.
+     */
+    names(supplied, label, header) {
+        if (!Array.isArray(supplied))
+            throw new Error(`Browser ${label} must be an array.`);
+        const names = [];
+        for (let index = 0; index < supplied.length; index += 1) {
+            if (!(index in supplied))
+                throw new Error(`Browser ${label} must not be sparse.`);
+            const raw = supplied[index];
+            if (typeof raw !== "string" || !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(raw))
+                throw new Error(`Browser ${label} contains an invalid name.`);
+            const name = header ? raw.toLowerCase() : raw;
+            if (header && ["authorization", "origin", "cookie"].includes(name))
+                throw new Error(`Browser ${label} contains a reserved header.`);
+            if (names.includes(name))
+                throw new Error(`Browser ${label} contains a duplicate name.`);
+            names.push(name);
+        }
+        return Object.freeze(names);
+    },
+    /**
+     * Collects all Node raw header pairs without losing repeated field values.
+     * @param pairs Alternating raw header names and values.
+     * @returns Lowercase names mapped to original ordered values.
+     */
+    raw(pairs) {
+        const result = Object.create(null);
+        for (let index = 0; index < pairs.length; index += 2) {
+            const name = pairs[index]?.toLowerCase();
+            const value = pairs[index + 1];
+            if (name === undefined || value === undefined)
+                continue;
+            (result[name] ??= []).push(value);
+        }
+        return result;
+    },
+    /**
+     * Checks raw Cookie pairs before any first-value parser can hide ambiguity.
+     * @param fields Original Cookie field values in arrival order.
+     * @param selected Names declared by any mounted reader or route.
+     * @returns Present selected names or a terminal syntax/duplicate rejection.
+     */
+    cookies(fields, selected) {
+        const present = new Set();
+        for (const field of fields) {
+            if (AdmissionNames.invalidField(field))
+                return { reason: "malformed Cookie field" };
+            for (const pair of field.split(";")) {
+                const index = pair.indexOf("=");
+                if (index <= 0)
+                    return { reason: "malformed Cookie pair" };
+                const name = pair.slice(0, index).trim();
+                const value = pair.slice(index + 1).trim();
+                if (!AdmissionNames.validPair(name, value))
+                    return { reason: "malformed Cookie pair" };
+                if (!selected.has(name))
+                    continue;
+                if (present.has(name))
+                    return { reason: "repeated selected Cookie" };
+                present.add(name);
+            }
+        }
+        return { present };
+    },
+    /**
+     * Checks a raw Cookie field for controls and comma-combined ambiguity.
+     * @param field Original field value.
+     * @returns Whether the field contains a forbidden character.
+     */
+    invalidField(field) {
+        for (const character of field) {
+            const code = character.charCodeAt(0);
+            if (code <= 31 || code === 127 || character === ",")
+                return true;
+        }
+        return false;
+    },
+    /**
+     * Checks one Cookie pair's raw token name and printable value.
+     * @param name Cookie name before decoding.
+     * @param value Cookie value before decoding.
+     * @returns Whether the pair has valid transport syntax.
+     */
+    validPair(name, value) {
+        return /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name) && /^[\x21-\x7e]*$/.test(value);
+    },
+    /**
+     * Creates immutable header fields and ordered value arrays for the selected reader.
+     * @param headers Duplicate-preserving mutable request-local collection.
+     * @returns Immutable lowercase header view.
+     */
+    freeze(headers) {
+        const result = Object.create(null);
+        for (const [name, values] of Object.entries(headers))
+            result[name] = values.length === 1 ? (values[0] ?? "") : Object.freeze([...values]);
+        return Object.freeze(result);
+    },
+});
+//# sourceMappingURL=browser-admission.js.map

package/dist/browser/browser-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-admission.js","sourceRoot":"","sources":["../../src/browser/browser-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;GAEG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACM,MAAM,CAA6B;IAE5C;;OAEG;IACM,MAAM,CAAkD;IAExD,YAAY,CAAsB;IAElC,gBAAgB,CAAsB;IAE/C;;;;OAIG;IACH,YACE,MAAkC,EAClC,MAAuD;QAEvD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,GAAG,IAAI,GAAG,CAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,qBAAqB,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CACpF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CACX,MAAe,EACf,MAA6C;QAE7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAC;QAC7D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,sBAAsB,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,OAA6B,EAC7B,MAAkC;QAIlC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QAChG,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACpF,IAAI,QAAQ,IAAI,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAClE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,CAAC;CACF;AAOD;;GAEG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC;;;;OAIG;IACH,IAAI,CAAC,QAAiB;QACpB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;YACnD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,QAAmC,CAAC;QAClD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAClF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CACrC,KAAK,CAAC,qBAAqB,EAC3B,uBAAuB,EACvB,KAAK,CACN,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,eAAe,EAAE,IAAI;YACrB,qBAAqB,EAAE,UAAU;YACjC,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAiB,EAAE,KAAa,EAAE,MAAe;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,oBAAoB,CAAC,CAAC;QACpF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,sBAAsB,CAAC,CAAC;YAClF,MAAM,GAAG,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,4BAA4B,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9C,IAAI,MAAM,IAAI,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,8BAA8B,CAAC,CAAC;YAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,6BAA6B,CAAC,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,KAAwB;QAC1B,MAAM,MAAM,GAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA6B,CAAC;QACzF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YACxD,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CACL,MAAyB,EACzB,QAA6B;QAE7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACpF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,IAAI,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;gBACvF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAClC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAa;QACxB,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;QACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,IAAY,EAAE,KAAa;QACnC,OAAO,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAiC;QACtC,MAAM,MAAM,GAA+C,MAAM,CAAC,MAAM,CAAC,IAAI,CAG5E,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;CACF,CAAC,CAAC"}

package/dist/browser/browser-server.d.ts

@@ -1,11 +1,13 @@
 import * as http from "node:http";
 import type { AddressInfo } from "node:net";
 import { TransportFacts } from "@spine-event-engine/auth";
+import { type ContextValues } from "@connectrpc/connect";
 import { Http2SessionManager } from "@connectrpc/connect-node";
 import { ApplicationNode } from "@spine-event-engine/deployment";
 import type { RunningServer } from "../server/server.js";
 import { Server } from "../server/server.js";
-import type { BrowserAuthRoute, BrowserServerOptions, StandaloneBrowserServerOptions } from "./options.js";
+import type { BrowserAuthRoute, BrowserCredentialReader, BrowserServerOptions, StandaloneBrowserServerOptions } from "./options.js";
+import { BrowserAdmissionPolicy } from "./browser-admission.js";
 /**
  * Holds fully normalized options while a browser listener is being assembled.
  *
@@ -17,6 +19,9 @@ type BrowserHostOptions = BrowserServerOptions & {
     readonly readMaxBytes: number;
     readonly writeMaxBytes: number;
     readonly production: boolean;
+    readonly credentialReader: BrowserCredentialReader;
+    readonly admissionPolicy: BrowserAdmissionPolicy;
+    readonly authRouteMap: ReadonlyMap<string, BrowserAuthRoute>;
     readonly dynamicManagerFactory?: (node: ApplicationNode) => Http2SessionManager;
 };
 /**
@@ -70,13 +75,14 @@ export declare const browserServerImplementation: Readonly<{
      */
     requests(options: BrowserServerOptions): {
         /**
-         * Reads a configured cookie credential or a Bearer authorization value.
+         * Reads the credential admitted into this Connect call's context values.
          *
-         * @param context Incoming request headers; these do not establish authenticated identity.
-         * @returns The extracted credential, an empty bearer value for rejected cookies, or no credential.
+         * @param context Connect context values carrying the reader's result.
+         * @returns The admitted credential, or undefined when the reader found none.
          */
         credential(context: {
             readonly requestHeader: Headers;
+            readonly values?: ContextValues;
         }): {
             readonly kind: "bearer" | "cookie";
             readonly value: string;
@@ -211,13 +217,14 @@ type BrowserServerTestAccess = Omit<typeof browserServerImplementation, "open" |
      */
     requests(options: BrowserServerTestOptions): {
         /**
-         * Reads a configured cookie credential or a Bearer authorization value.
+         * Reads the credential admitted into this Connect call's context values.
          *
-         * @param context Incoming request headers; these do not establish authenticated identity.
-         * @returns The extracted credential, an empty bearer value for rejected cookies, or no credential.
+         * @param context Connect context values carrying the reader's result.
+         * @returns The admitted credential, or undefined when the reader found none.
          */
         credential(context: {
             readonly requestHeader: Headers;
+            readonly values?: ContextValues;
         }): {
             readonly kind: "bearer" | "cookie";
             readonly value: string;

package/dist/browser/browser-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-server.d.ts","sourceRoot":"","sources":["../../src/browser/browser-server.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAOL,cAAc,EAMf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,eAAe,EAAsB,MAAM,gCAAgC,CAAC;AAOrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAuB,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACpB,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AAwBtB;;;;GAIG;AACH,KAAK,kBAAkB,GAAG,oBAAoB,GAAG;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,mBAAmB,CAAC;CACjF,CAAC;AAEF;;;;GAIG;AACH,KAAK,wBAAwB,GAAG,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAsCnF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC;IACjD;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEnF;;;;;;OAMG;IACH,IAAI,CACF,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC9C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3E;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG;QACvC;;;;;WAKG;QACH,UAAU,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;SAAE,GACnD;YACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;YACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;SACxB,GACD,SAAS,CAAC;QAEd;;;;;WAKG;QACH,SAAS,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;SAAE,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;KACjG,CAAC;IAEF;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAElC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAAC;IAE1D;;;;;OAKG;IACH,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG;QAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,CAAC;IAEF;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAEjF;;;;;OAKG;IACH,UAAU,CACR,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,GAC9C,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAEzC;;;;;;;;;OASG;IACH,YAAY,CACV,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,QAAQ,EAAE,IAAI,CAAC,cAAc,EAC7B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,EAC5B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9E;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CAAC;CAC/F,CA4dC,CAAC;AAEH;;;;GAIG;AACH,KAAK,uBAAuB,GAAG,IAAI,CACjC,OAAO,2BAA2B,EAClC,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,wBAAwB,GAAG,WAAW,CACrE,GAAG;IACF;;;;;;OAMG;IACH,IAAI,CACF,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC9D,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/E;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG;QAC3C;;;;;WAKG;QACH,UAAU,CAAC,OAAO,EAAE;YAClB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;SACjC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;QAE/E;;;;;WAKG;QACH,SAAS,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;SAAE,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;KACjG,CAAC;IAEF;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAErF;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,OAAO,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;CACnG,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBAEpC,CAAC"}
+{"version":3,"file":"browser-server.d.ts","sourceRoot":"","sources":["../../src/browser/browser-server.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAOL,cAAc,EAOf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,eAAe,EAAsB,MAAM,gCAAgC,CAAC;AAOrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAuB,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,8BAA8B,EAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAoDhE;;;;GAIG;AACH,KAAK,kBAAkB,GAAG,oBAAoB,GAAG;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC7D,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,mBAAmB,CAAC;CACjF,CAAC;AAYF;;;;GAIG;AACH,KAAK,wBAAwB,GAAG,oBAAoB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAsCnF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC;IACjD;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEnF;;;;;;OAMG;IACH,IAAI,CACF,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC9C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAErE;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3E;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG;QACvC;;;;;WAKG;QACH,UAAU,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;SAAE,GACpF;YACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;YACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;SACxB,GACD,SAAS,CAAC;QAEd;;;;;WAKG;QACH,SAAS,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;SAAE,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;KACjG,CAAC;IAEF;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAElC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAAC;IAE1D;;;;;OAKG;IACH,uBAAuB,CAAC,IAAI,EAAE,eAAe,GAAG;QAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE;YAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,CAAC;IAEF;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAEjF;;;;;OAKG;IACH,UAAU,CACR,MAAM,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,GAC9C,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAEzC;;;;;;;;;OASG;IACH,YAAY,CACV,OAAO,EAAE,IAAI,CAAC,eAAe,EAC7B,QAAQ,EAAE,IAAI,CAAC,cAAc,EAC7B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,EAC5B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE9E;;;;;OAKG;IACH,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CAAC;CAC/F,CAiYC,CAAC;AAEH;;;;GAIG;AACH,KAAK,uBAAuB,GAAG,IAAI,CACjC,OAAO,2BAA2B,EAClC,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,wBAAwB,GAAG,WAAW,CACrE,GAAG;IACF;;;;;;OAMG;IACH,IAAI,CACF,MAAM,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,EAC9D,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE1B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAE/E;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,wBAAwB,GAAG;QAC3C;;;;;WAKG;QACH,UAAU,CAAC,OAAO,EAAE;YAClB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;YAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;SACjC,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAC;QAE/E;;;;;WAKG;QACH,SAAS,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;SAAE,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;KACjG,CAAC;IAEF;;;;;OAKG;IACH,sBAAsB,CAAC,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAErF;;;;;;OAMG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,EAAE,OAAO,EAAE,wBAAwB,GAAG,kBAAkB,CAAC;CACnG,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBAEpC,CAAC"}