@stacksjs/rpx 0.11.20 → 0.11.21

package/dist/acme-challenge.d.ts

@@ -0,0 +1,13 @@
+/**
+ * If `pathname` is an ACME http-01 challenge request, return the token's
+ * key-authorization contents from `<webroot>/<token>`; otherwise (or on any
+ * unsafe/missing token) return `null` so the caller falls through to its normal
+ * handling.
+ *
+ * The token must be a single path segment of ACME's `base64url` alphabet — this
+ * never rejects a real Let's Encrypt token, but refuses slashes, `..`, and other
+ * traversal so a crafted request can't read outside the challenge directory.
+ */
+export declare function readAcmeChallenge(webroot: string, pathname: string): string | null;
+/** The fixed request prefix Let's Encrypt fetches an http-01 token from. */
+export declare const ACME_CHALLENGE_PREFIX: '/.well-known/acme-challenge/';

package/dist/auth.d.ts

@@ -0,0 +1,21 @@
+import type { BasicAuthConfig } from './types';
+/** Parse an htpasswd file body into a `user → hash` map (last entry wins). */
+export declare function parseHtpasswd(body: string): Map<string, string>;
+/**
+ * Resolve a {@link BasicAuthConfig} into an enforceable policy, or `undefined`
+ * when no usable credentials are configured (treated as "no auth"). The htpasswd
+ * file, when given, is read once here so request handling stays allocation-free.
+ */
+export declare function resolveAuth(cfg?: BasicAuthConfig): ResolvedAuth | undefined;
+/**
+ * Enforce a route's Basic auth policy against a request. Returns `undefined`
+ * when the request is authorized (handling continues) or a `401` challenge
+ * `Response` when it is not. ACME http-01 challenge requests are always allowed
+ * so on-demand certificate issuance for a protected host still works.
+ */
+export declare function enforceBasicAuth(req: Request, pathname: string, auth: ResolvedAuth): Response | undefined;
+/** A resolved, ready-to-enforce auth policy for one route. */
+export declare interface ResolvedAuth {
+  realm: string
+  verify: (username: string, password: string) => boolean
+}