@thunderid/express 1.11.0 → 1.12.0

package/dist/ThunderIDExpressClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,iCAAiC,EACjC,6BAA6B,EAE7B,OAAO,EACP,aAAa,EACb,IAAI,EAEL,MAAM,iBAAiB,CAAC;AACzB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAGpD,cAAM,sBAAsB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,cAAc,CAAkC;;IAMlC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhF,IAAW,aAAa,IAAI,mBAAmB,GAAG,SAAS,CAE1D;IAED;;;;OAIG;IACI,oBAAoB,IAAI,MAAM;IAOxB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAMhF;;;;;;;;;;;;;OAaG;IACI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,6BAA6B;IAWpE,gCAAgC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7F,MAAM,CAC1B,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,EAC3B,YAAY,CAAC,EAAE,iCAAiC,GAC/C,OAAO,CAAC,aAAa,CAAC;IAuDH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhE;AAED,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,iCAAiC,EACjC,6BAA6B,EAE7B,OAAO,EACP,aAAa,EACb,IAAI,EAEL,MAAM,iBAAiB,CAAC;AACzB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAGpD,cAAM,sBAAsB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,cAAc,CAAkC;;IAMlC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhF,IAAW,aAAa,IAAI,mBAAmB,GAAG,SAAS,CAE1D;IAED;;;;OAIG;IACI,oBAAoB,IAAI,MAAM;IAOxB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAMhF;;;;;;;;;;;;;OAaG;IACI,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,6BAA6B;IAWpE,gCAAgC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7F,MAAM,CAC1B,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,IAAI,CAAC,EAAE,OAAO,CAAC,YAAY,EAC3B,YAAY,CAAC,EAAE,iCAAiC,GAC/C,OAAO,CAAC,aAAa,CAAC;IA+DH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhE;AAED,eAAe,sBAAsB,CAAC"}

package/dist/cjs/index.cjs

@@ -114,7 +114,12 @@ var ThunderIDExpressClient = class extends __thunderid_node.ThunderIDNodeClient
 			});
 			res.redirect(url);
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
+		const ouId = req.query["ouId"];
+		const resolvedSignInConfig = typeof ouId === "string" && ouId !== "" && !req.query["code"] ? {
+			...signInConfig,
+			organizationUnitId: ouId
+		} : signInConfig;
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], resolvedSignInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -459,6 +464,55 @@ const handleBackchannelLogout = () => {
 };
 var backchannelLogout_default = handleBackchannelLogout;
 
+//#endregion
+//#region src/middleware/requireAccess.ts
+/**
+* Returns Express middleware that asks the server's AuthZEN policy decision point whether the request
+* may proceed, and answers `403` on a denial. The application maps the request to a subject, an action
+* and a resource. Requires `thunderID()` to be mounted first.
+*
+* ```ts
+* app.get(
+*   '/bookings/:id',
+*   protect(),
+*   requireAccess(async (req) => ({
+*     subject: {type: 'user', id: (await req.thunderIDAuth.getUserFromRequest(req))?.sub},
+*     resource: {type: 'https://api.example.com/booking', id: req.params.id},
+*     action: {name: 'booking:read'},
+*   })),
+*   handler,
+* );
+* ```
+*/
+const requireAccess = (toRequest, options = {}) => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			__thunderid_node.logger.error("thunderID() middleware must be mounted before requireAccess()");
+			res.status(500).end();
+			return;
+		}
+		let decision;
+		try {
+			decision = await client.evaluateAccess(await toRequest(req), { secret: options.secret });
+		} catch (error) {
+			if (options.onError) options.onError(req, res, error);
+			else {
+				__thunderid_node.logger.error("Access evaluation failed.");
+				res.status(500).end();
+			}
+			return;
+		}
+		if (decision?.decision === true) {
+			next();
+			return;
+		}
+		if (options.onDenied) options.onDenied(req, res, decision);
+		else res.status(403).end();
+	};
+};
+var requireAccess_default = requireAccess;
+
 //#endregion
 exports.CookieConfig = CookieConfig_default;
 exports.ThunderIDExpressClient = ThunderIDExpressClient_default;
@@ -467,6 +521,7 @@ exports.handleFlow = flow_default;
 exports.handleSignIn = handleSignIn;
 exports.handleSignOut = handleSignOut;
 exports.protect = protect_default;
+exports.requireAccess = requireAccess_default;
 exports.thunderID = thunderID;
 Object.keys(__thunderid_node).forEach(function (k) {
   if (k !== 'default' && !Object.prototype.hasOwnProperty.call(exports, k)) Object.defineProperty(exports, k, {

package/dist/edge/index.js

@@ -90,7 +90,12 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 			});
 			res.redirect(url);
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
+		const ouId = req.query["ouId"];
+		const resolvedSignInConfig = typeof ouId === "string" && ouId !== "" && !req.query["code"] ? {
+			...signInConfig,
+			organizationUnitId: ouId
+		} : signInConfig;
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], resolvedSignInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -436,4 +441,53 @@ const handleBackchannelLogout = () => {
 var backchannelLogout_default = handleBackchannelLogout;
 
 //#endregion
-export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };
+//#region src/middleware/requireAccess.ts
+/**
+* Returns Express middleware that asks the server's AuthZEN policy decision point whether the request
+* may proceed, and answers `403` on a denial. The application maps the request to a subject, an action
+* and a resource. Requires `thunderID()` to be mounted first.
+*
+* ```ts
+* app.get(
+*   '/bookings/:id',
+*   protect(),
+*   requireAccess(async (req) => ({
+*     subject: {type: 'user', id: (await req.thunderIDAuth.getUserFromRequest(req))?.sub},
+*     resource: {type: 'https://api.example.com/booking', id: req.params.id},
+*     action: {name: 'booking:read'},
+*   })),
+*   handler,
+* );
+* ```
+*/
+const requireAccess = (toRequest, options = {}) => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before requireAccess()");
+			res.status(500).end();
+			return;
+		}
+		let decision;
+		try {
+			decision = await client.evaluateAccess(await toRequest(req), { secret: options.secret });
+		} catch (error) {
+			if (options.onError) options.onError(req, res, error);
+			else {
+				logger.error("Access evaluation failed.");
+				res.status(500).end();
+			}
+			return;
+		}
+		if (decision?.decision === true) {
+			next();
+			return;
+		}
+		if (options.onDenied) options.onDenied(req, res, decision);
+		else res.status(403).end();
+	};
+};
+var requireAccess_default = requireAccess;
+
+//#endregion
+export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, requireAccess_default as requireAccess, thunderID };

package/dist/index.d.ts

@@ -3,6 +3,8 @@ export { thunderID, handleSignIn, handleSignOut } from './middleware/authenticat
 export { default as protect } from './middleware/protect';
 export { default as handleFlow } from './middleware/flow';
 export { default as handleBackchannelLogout } from './middleware/backchannelLogout';
+export { default as requireAccess } from './middleware/requireAccess';
+export type { RequireAccessOptions } from './middleware/requireAccess';
 export type { ExpressClientConfig, ThunderIDExpressConfig, StrictExpressClientConfig } from './models/config';
 export { default as CookieConfig } from './constants/CookieConfig';
 export * from '@thunderid/node';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAC,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,gCAAgC,CAAC;AAGlF,YAAY,EAAC,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAC,MAAM,iBAAiB,CAAC;AAK5G,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAIjE,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAC,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAC,OAAO,IAAI,aAAa,EAAC,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAC,oBAAoB,EAAC,MAAM,4BAA4B,CAAC;AAGrE,YAAY,EAAC,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAC,MAAM,iBAAiB,CAAC;AAK5G,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAIjE,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -90,7 +90,12 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 			});
 			res.redirect(url);
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
+		const ouId = req.query["ouId"];
+		const resolvedSignInConfig = typeof ouId === "string" && ouId !== "" && !req.query["code"] ? {
+			...signInConfig,
+			organizationUnitId: ouId
+		} : signInConfig;
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], resolvedSignInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -436,4 +441,53 @@ const handleBackchannelLogout = () => {
 var backchannelLogout_default = handleBackchannelLogout;
 
 //#endregion
-export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };
+//#region src/middleware/requireAccess.ts
+/**
+* Returns Express middleware that asks the server's AuthZEN policy decision point whether the request
+* may proceed, and answers `403` on a denial. The application maps the request to a subject, an action
+* and a resource. Requires `thunderID()` to be mounted first.
+*
+* ```ts
+* app.get(
+*   '/bookings/:id',
+*   protect(),
+*   requireAccess(async (req) => ({
+*     subject: {type: 'user', id: (await req.thunderIDAuth.getUserFromRequest(req))?.sub},
+*     resource: {type: 'https://api.example.com/booking', id: req.params.id},
+*     action: {name: 'booking:read'},
+*   })),
+*   handler,
+* );
+* ```
+*/
+const requireAccess = (toRequest, options = {}) => {
+	return async (req, res, next) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before requireAccess()");
+			res.status(500).end();
+			return;
+		}
+		let decision;
+		try {
+			decision = await client.evaluateAccess(await toRequest(req), { secret: options.secret });
+		} catch (error) {
+			if (options.onError) options.onError(req, res, error);
+			else {
+				logger.error("Access evaluation failed.");
+				res.status(500).end();
+			}
+			return;
+		}
+		if (decision?.decision === true) {
+			next();
+			return;
+		}
+		if (options.onDenied) options.onDenied(req, res, decision);
+		else res.status(403).end();
+	};
+};
+var requireAccess_default = requireAccess;
+
+//#endregion
+export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, requireAccess_default as requireAccess, thunderID };

package/dist/middleware/requireAccess.d.ts

@@ -0,0 +1,41 @@
+import { AccessEvaluationRequest, AccessEvaluationResponse } from '@thunderid/node';
+import express from 'express';
+/**
+ * Options for {@link requireAccess}.
+ */
+export interface RequireAccessOptions {
+    /**
+     * Called when the decision is a denial. Defaults to answering `403`.
+     */
+    onDenied?: (req: express.Request, res: express.Response, decision: AccessEvaluationResponse) => void;
+    /**
+     * Called when the evaluation itself fails (transport or a 4xx/5xx answer). Defaults to answering
+     * `500`. The request is never let through on a failure.
+     */
+    onError?: (req: express.Request, res: express.Response, error: unknown) => void;
+    /**
+     * The server-level secret, when it is not set as `accessEvaluation.secret` in the configuration.
+     */
+    secret?: string;
+}
+/**
+ * Returns Express middleware that asks the server's AuthZEN policy decision point whether the request
+ * may proceed, and answers `403` on a denial. The application maps the request to a subject, an action
+ * and a resource. Requires `thunderID()` to be mounted first.
+ *
+ * ```ts
+ * app.get(
+ *   '/bookings/:id',
+ *   protect(),
+ *   requireAccess(async (req) => ({
+ *     subject: {type: 'user', id: (await req.thunderIDAuth.getUserFromRequest(req))?.sub},
+ *     resource: {type: 'https://api.example.com/booking', id: req.params.id},
+ *     action: {name: 'booking:read'},
+ *   })),
+ *   handler,
+ * );
+ * ```
+ */
+declare const requireAccess: (toRequest: (req: express.Request) => AccessEvaluationRequest | Promise<AccessEvaluationRequest>, options?: RequireAccessOptions) => ((req: express.Request, res: express.Response, next: express.NextFunction) => Promise<void>);
+export default requireAccess;
+//# sourceMappingURL=requireAccess.d.ts.map

package/dist/middleware/requireAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requireAccess.d.ts","sourceRoot":"","sources":["../../src/middleware/requireAccess.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAmB,MAAM,iBAAiB,CAAC;AACpG,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,wBAAwB,KAAK,IAAI,CAAC;IACrG;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAChF;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,aAAa,GACjB,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,KAAK,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,EAC/F,UAAS,oBAAyB,KACjC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAoC7F,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/express",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Express.js SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -47,7 +47,7 @@
     "vitest": "4.1.11"
   },
   "dependencies": {
-    "@thunderid/node": "^1.11.0",
+    "@thunderid/node": "^1.12.0",
     "uuid": "11.1.1"
   },
   "peerDependencies": {