@thymian/rules-rfc-9110 0.1.0

package/README.md

@@ -0,0 +1,11 @@
+# Thymian
+
+Add resilience and HTTP conformance to your API development workflow. Thymian is a lightweight, language-agnostic library that helps you build robust APIs.
+
+## @thymian/rfc-9110-rules
+
+Reusable HTTP rules based on RFC 9110.
+
+## Documentation
+
+For comprehensive documentation, visit [Thymian Documentation](https://thymian.dev/).

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import type { RuleSet } from '@thymian/core';
+declare const rfc9110: RuleSet;
+export default rfc9110;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,QAAA,MAAM,OAAO,EAAE,OAId,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+const rfc9110 = {
+    name: 'rfc9110',
+    url: 'https://www.rfc-editor.org/rfc/rfc9110.html',
+    pattern: 'rules/**/*.rule.js',
+};
+export default rfc9110;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,GAAY;IACvB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,6CAA6C;IAClD,OAAO,EAAE,oBAAoB;CAC9B,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=origin-server-should-send-401-for-invalid-credentials.rule.d.ts.map

package/dist/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-401-for-invalid-credentials.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/origin-server-should-send-401-for-invalid-credentials')
+    .severity('warn')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-credentials')
+    .description('Upon receipt of a request for a protected resource that omits credentials, contains invalid credentials, or partial credentials, an origin server SHOULD send a 401 (Unauthorized) response that contains a WWW-Authenticate header field.')
+    .appliesTo('origin server')
+    .done();
+//# sourceMappingURL=origin-server-should-send-401-for-invalid-credentials.rule.js.map

package/dist/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origin-server-should-send-401-for-invalid-credentials.rule.js","sourceRoot":"","sources":["../../../../src/rules/authentication/credentials/origin-server-should-send-401-for-invalid-credentials.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,+DAA+D,CAChE;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,8DAA8D,CAAC;KACnE,WAAW,CACV,4OAA4O,CAC7O;KACA,SAAS,CAAC,eAAe,CAAC;KAC1B,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-should-send-407-for-invalid-proxy-credentials.rule.d.ts.map

package/dist/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-should-send-407-for-invalid-proxy-credentials.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-should-send-407-for-invalid-proxy-credentials')
+    .severity('warn')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-credentials')
+    .description('Upon receipt of a request that omits proxy credentials or contains invalid or partial proxy credentials, a proxy that requires authentication SHOULD generate a 407 (Proxy Authentication Required) response with a Proxy-Authenticate header field.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-should-send-407-for-invalid-proxy-credentials.rule.js.map

package/dist/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-should-send-407-for-invalid-proxy-credentials.rule.js","sourceRoot":"","sources":["../../../../src/rules/authentication/credentials/proxy-should-send-407-for-invalid-proxy-credentials.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,6DAA6D,CAC9D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,8DAA8D,CAAC;KACnE,WAAW,CACV,sPAAsP,CACvP;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-must-not-modify-authentication-info.rule.d.ts.map

package/dist/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-authentication-info.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-must-not-modify-authentication-info')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-users-to-ori')
+    .description('A proxy forwarding a response is not allowed to modify the Authentication-Info field value in any way.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-must-not-modify-authentication-info.rule.js.map

package/dist/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-authentication-info.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/authentication-info/proxy-must-not-modify-authentication-info.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,mDAAmD,CAAC;KACzE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,wGAAwG,CACzG;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-must-not-modify-authorization.rule.d.ts.map

package/dist/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-authorization.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-must-not-modify-authorization')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-users-to-ori')
+    .description('A proxy forwarding a request MUST NOT modify any Authorization header fields in that request.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-must-not-modify-authorization.rule.js.map

package/dist/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-authorization.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/authorization/proxy-must-not-modify-authorization.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,6CAA6C,CAAC;KACnE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,+FAA+F,CAChG;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-must-not-modify-www-authenticate.rule.d.ts.map

package/dist/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-www-authenticate.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-must-not-modify-www-authenticate')
+    .severity('error')
+    .type('analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-users-to-ori')
+    .description('A proxy forwarding a response MUST NOT modify any WWW-Authenticate header fields in that response.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-must-not-modify-www-authenticate.rule.js.map

package/dist/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-must-not-modify-www-authenticate.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/www-authenticate/proxy-must-not-modify-www-authenticate.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,gDAAgD,CAAC;KACtE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,WAAW,CAAC;KACjB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,oGAAoG,CACrG;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-may-send-www-authenticate-in-other-responses.rule.d.ts.map

package/dist/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-send-www-authenticate-in-other-responses.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.ts"],"names":[],"mappings":";AAGA,wBAeU"}

package/dist/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.js

@@ -0,0 +1,11 @@
+import { not, responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/server-may-send-www-authenticate-in-other-responses')
+    .severity('hint')
+    .type('static', 'analytics', 'test')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-users-to-ori')
+    .description('A server MAY generate a WWW-Authenticate header field in other response messages to indicate that supplying credentials (or different credentials) might affect the response.')
+    .appliesTo('server')
+    .rule((ctx) => ctx.validateCommonHttpTransactions(not(responseHeader('www-authenticate'))))
+    .done();
+//# sourceMappingURL=server-may-send-www-authenticate-in-other-responses.rule.js.map

package/dist/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-may-send-www-authenticate-in-other-responses.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/origin-server/www-authenticate/server-may-send-www-authenticate-in-other-responses.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,6DAA6D,CAC9D;KACE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC;KACnC,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,+KAA+K,CAChL;KACA,SAAS,CAAC,QAAQ,CAAC;KACnB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,8BAA8B,CAAC,GAAG,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAC5E;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=authentication-parameter-name-must-occur-once-per-challenge.rule.d.ts.map

package/dist/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-parameter-name-must-occur-once-per-challenge.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.ts"],"names":[],"mappings":";AASA,wBA4CU"}

package/dist/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.js

@@ -0,0 +1,31 @@
+import { getHeader, or, requestHeader, responseHeader } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+import { parseChallenges } from '../utils/auth-parser.js';
+import { requestAuthenticationHeaders, responseAuthenticationHeaders, } from '../utils/authentication-header-names.js';
+export default httpRule('rfc9110/authentication-parameter-name-must-occur-once-per-challenge')
+    .severity('error')
+    .type('test', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authentication-parameters')
+    .description('Authentication parameter names are matched case-insensitively and each parameter name MUST only occur once per challenge.')
+    .rule((ctx) => ctx.validateHttpTransactions(or(...requestAuthenticationHeaders.map((h) => requestHeader(h)), ...responseAuthenticationHeaders.map((h) => responseHeader(h))), (req, res) => {
+    const headers = [
+        ...requestAuthenticationHeaders.flatMap((header) => getHeader(req.headers, header) ?? []),
+        ...responseAuthenticationHeaders.flatMap((header) => getHeader(res.headers, header) ?? []),
+    ];
+    for (const headerValue of headers) {
+        const challenges = parseChallenges(headerValue);
+        for (const challenge of challenges) {
+            const seenParams = new Set();
+            for (const param of challenge.parameters) {
+                const lowerName = param.name.toLowerCase();
+                if (seenParams.has(lowerName)) {
+                    return true; // Violation found
+                }
+                seenParams.add(lowerName);
+            }
+        }
+    }
+    return false;
+}))
+    .done();
+//# sourceMappingURL=authentication-parameter-name-must-occur-once-per-challenge.rule.js.map

package/dist/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-parameter-name-must-occur-once-per-challenge.rule.js","sourceRoot":"","sources":["../../../../src/rules/authentication/parameters/authentication-parameter-name-must-occur-once-per-challenge.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAEjD,eAAe,QAAQ,CACrB,qEAAqE,CACtE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KACzB,GAAG,CACF,4EAA4E,CAC7E;KACA,WAAW,CACV,2HAA2H,CAC5H;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,EAAE,CACA,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAC5D,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAC/D,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACX,MAAM,OAAO,GAAG;QACd,GAAG,4BAA4B,CAAC,OAAO,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CACjD;QACD,GAAG,6BAA6B,CAAC,OAAO,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CACjD;KACF,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAChD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC3C,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAC,CAAC,kBAAkB;gBACjC,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=authentication-scheme-must-accept-token-and-quoted-string.rule.d.ts.map

package/dist/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-scheme-must-accept-token-and-quoted-string.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.ts"],"names":[],"mappings":";AAEA,wBAYU"}

package/dist/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/authentication-scheme-must-accept-token-and-quoted-string')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authentication-parameters')
+    .description('Authentication scheme definitions need to accept both token and quoted-string notations for parameter values, both for senders and recipients.')
+    .appliesTo('server', 'client', 'proxy')
+    .done();
+//# sourceMappingURL=authentication-scheme-must-accept-token-and-quoted-string.rule.js.map

package/dist/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-scheme-must-accept-token-and-quoted-string.rule.js","sourceRoot":"","sources":["../../../../src/rules/authentication/parameters/authentication-scheme-must-accept-token-and-quoted-string.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,mEAAmE,CACpE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CACF,4EAA4E,CAC7E;KACA,WAAW,CACV,gJAAgJ,CACjJ;KACA,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;KACtC,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-authenticate-applies-to-next-client.rule.d.ts.map

package/dist/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-authenticate-applies-to-next-client.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-authenticate-applies-to-next-client')
+    .severity('hint')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-clients-to-p')
+    .description('Unlike WWW-Authenticate, the Proxy-Authenticate header field applies only to the next outbound client on the response chain.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-authenticate-applies-to-next-client.rule.js.map

package/dist/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-authenticate-applies-to-next-client.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/proxy/proxy-authenticate/proxy-authenticate-applies-to-next-client.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,mDAAmD,CAAC;KACzE,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,8HAA8H,CAC/H;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=proxy-may-relay-credentials.rule.d.ts.map

package/dist/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-may-relay-credentials.rule.d.ts","sourceRoot":"","sources":["../../../../../src/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/proxy-may-relay-credentials')
+    .severity('hint')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-authenticating-clients-to-p')
+    .description('A proxy MAY relay the credentials from the client request to the next proxy if that is the mechanism by which the proxies cooperatively authenticate a given request.')
+    .appliesTo('proxy')
+    .done();
+//# sourceMappingURL=proxy-may-relay-credentials.rule.js.map

package/dist/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-may-relay-credentials.rule.js","sourceRoot":"","sources":["../../../../../src/rules/authentication/proxy/proxy-authorization/proxy-may-relay-credentials.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,qCAAqC,CAAC;KAC3D,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,uKAAuK,CACxK;KACA,SAAS,CAAC,OAAO,CAAC;KAClB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=realm-parameter-must-use-quoted-string-syntax.rule.d.ts.map

package/dist/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-parameter-must-use-quoted-string-syntax.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.ts"],"names":[],"mappings":";AAgBA,wBAwCU"}

package/dist/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.js

@@ -0,0 +1,29 @@
+import { equalsIgnoreCase, getHeader, or, requestHeader, responseHeader, } from '@thymian/core';
+import { httpRule } from '@thymian/core';
+import { parseChallenges } from '../utils/auth-parser.js';
+import { requestAuthenticationHeaders, responseAuthenticationHeaders, } from '../utils/authentication-header-names.js';
+export default httpRule('rfc9110/realm-parameter-must-use-quoted-string-syntax')
+    .severity('error')
+    .type('test', 'analytics')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-establishing-a-protection-s')
+    .description('For historical reasons, a sender MUST only generate the quoted-string syntax for realm parameter values.')
+    .rule((ctx) => ctx.validateHttpTransactions(or(...requestAuthenticationHeaders.map((h) => requestHeader(h)), ...responseAuthenticationHeaders.map((h) => responseHeader(h))), (req, res) => {
+    const headers = [
+        ...requestAuthenticationHeaders.flatMap((header) => getHeader(req.headers, header) ?? []),
+        ...responseAuthenticationHeaders.flatMap((header) => getHeader(res.headers, header) ?? []),
+    ];
+    for (const headerValue of headers) {
+        const challenges = parseChallenges(headerValue);
+        for (const challenge of challenges) {
+            for (const param of challenge.parameters) {
+                const isRealmParam = equalsIgnoreCase(param.name, 'realm');
+                if (isRealmParam && !param.isQuoted) {
+                    return true; // Violation: realm used token syntax instead of quoted-string
+                }
+            }
+        }
+    }
+    return false;
+}))
+    .done();
+//# sourceMappingURL=realm-parameter-must-use-quoted-string-syntax.rule.js.map

package/dist/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realm-parameter-must-use-quoted-string-syntax.rule.js","sourceRoot":"","sources":["../../../../src/rules/authentication/realm/realm-parameter-must-use-quoted-string-syntax.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,EAAE,EACF,aAAa,EACb,cAAc,GAEf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAEjD,eAAe,QAAQ,CAAC,uDAAuD,CAAC;KAC7E,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;KACzB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,0GAA0G,CAC3G;KACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,CAAC,wBAAwB,CAC1B,EAAE,CACA,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAC5D,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAC/D,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACX,MAAM,OAAO,GAAG;QACd,GAAG,4BAA4B,CAAC,OAAO,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CACjD;QACD,GAAG,6BAA6B,CAAC,OAAO,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CACjD;KACF,CAAC;IAEF,KAAK,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAChD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC3D,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC,CAAC,8DAA8D;gBAC7E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CACF,CACF;KACA,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=user-agent-may-reuse-same-credentials-for-identical-protection-space.d.ts.map

package/dist/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-reuse-same-credentials-for-identical-protection-space.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.ts"],"names":[],"mappings":";AAEA,wBAUU"}

package/dist/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.js

@@ -0,0 +1,9 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/protection-space-cannot-extend-beyond-origin')
+    .severity('hint')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#name-establishing-a-protection-s')
+    .description('If a prior request has been authorized, the user agent MAY reuse the same credentials for all other requests within that protection space for a period of time determined by the authentication scheme, parameters, and/or user preferences (such as a configurable inactivity timeout).')
+    .appliesTo('user-agent')
+    .done();
+//# sourceMappingURL=user-agent-may-reuse-same-credentials-for-identical-protection-space.js.map

package/dist/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent-may-reuse-same-credentials-for-identical-protection-space.js","sourceRoot":"","sources":["../../../../src/rules/authentication/realm/user-agent-may-reuse-same-credentials-for-identical-protection-space.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CAAC,sDAAsD,CAAC;KAC5E,QAAQ,CAAC,MAAM,CAAC;KAChB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CACF,8EAA8E,CAC/E;KACA,WAAW,CACV,0RAA0R,CAC3R;KACA,SAAS,CAAC,YAAY,CAAC;KACvB,IAAI,EAAE,CAAC"}

package/dist/rules/authentication/utils/auth-parser.d.ts

@@ -0,0 +1,16 @@
+export interface AuthParameter {
+    name: string;
+    value: string;
+    isQuoted: boolean;
+}
+export interface Challenge {
+    scheme: string;
+    token68?: string;
+    parameters: AuthParameter[];
+}
+/**
+ * Parses WWW-Authenticate or Proxy-Authenticate header values into Challenges.
+ * Follows RFC 9110 Section 11 format.
+ */
+export declare function parseChallenges(headerValue: string): Challenge[];
+//# sourceMappingURL=auth-parser.d.ts.map

package/dist/rules/authentication/utils/auth-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-parser.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/utils/auth-parser.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAiDhE"}

package/dist/rules/authentication/utils/auth-parser.js

@@ -0,0 +1,83 @@
+/**
+ * Parses WWW-Authenticate or Proxy-Authenticate header values into Challenges.
+ * Follows RFC 9110 Section 11 format.
+ */
+export function parseChallenges(headerValue) {
+    const challenges = [];
+    const parts = splitByCommaIgnoringQuotes(headerValue);
+    let currentChallenge = null;
+    for (let part of parts) {
+        part = part.trim();
+        if (!part) {
+            continue;
+        }
+        // Check if this part starts with a new scheme or is a continuation of parameters
+        // A new scheme is a token followed by a space or end of string, NOT followed by '='
+        const firstSpaceIndex = part.indexOf(' ');
+        const firstEqualsIndex = part.indexOf('=');
+        const isNewScheme = firstEqualsIndex === -1 ||
+            (firstSpaceIndex !== -1 && firstSpaceIndex < firstEqualsIndex);
+        if (isNewScheme) {
+            const scheme = firstSpaceIndex === -1 ? part : part.substring(0, firstSpaceIndex);
+            const remainder = firstSpaceIndex === -1 ? '' : part.substring(firstSpaceIndex).trim();
+            currentChallenge = {
+                scheme,
+                parameters: [],
+            };
+            challenges.push(currentChallenge);
+            if (remainder) {
+                if (remainder.indexOf('=') === -1) {
+                    // Likely token68
+                    currentChallenge.token68 = remainder;
+                }
+                else {
+                    // It's a list of parameters starting right after the scheme
+                    parseParameters(remainder, currentChallenge.parameters);
+                }
+            }
+        }
+        else if (currentChallenge) {
+            // Continuation of parameters for the current challenge
+            parseParameters(part, currentChallenge.parameters);
+        }
+    }
+    return challenges;
+}
+function parseParameters(input, target) {
+    const params = splitByCommaIgnoringQuotes(input);
+    for (const param of params) {
+        const eqIndex = param.indexOf('=');
+        if (eqIndex !== -1) {
+            const name = param.substring(0, eqIndex).trim();
+            let value = param.substring(eqIndex + 1).trim();
+            let isQuoted = false;
+            if (value.startsWith('"') && value.endsWith('"')) {
+                value = value.substring(1, value.length - 1);
+                isQuoted = true;
+            }
+            target.push({ name, value, isQuoted });
+        }
+    }
+}
+function splitByCommaIgnoringQuotes(input) {
+    const result = [];
+    let current = '';
+    let inQuotes = false;
+    for (let i = 0; i < input.length; i++) {
+        const char = input[i];
+        if (char === '"') {
+            inQuotes = !inQuotes;
+            current += char;
+        }
+        else if (char === ',' && !inQuotes) {
+            result.push(current);
+            current = '';
+        }
+        else {
+            current += char;
+        }
+    }
+    result.push(current);
+    return result;
+}
+//# sourceMappingURL=auth-parser.js.map

package/dist/rules/authentication/utils/auth-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-parser.js","sourceRoot":"","sources":["../../../../src/rules/authentication/utils/auth-parser.ts"],"names":[],"mappings":"AAYA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAEtD,IAAI,gBAAgB,GAAqB,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE3C,MAAM,WAAW,GACf,gBAAgB,KAAK,CAAC,CAAC;YACvB,CAAC,eAAe,KAAK,CAAC,CAAC,IAAI,eAAe,GAAG,gBAAgB,CAAC,CAAC;QAEjE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GACV,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACrE,MAAM,SAAS,GACb,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;YAEvE,gBAAgB,GAAG;gBACjB,MAAM;gBACN,UAAU,EAAE,EAAE;aACf,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAElC,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;oBAClC,iBAAiB;oBACjB,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,4DAA4D;oBAC5D,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,gBAAgB,EAAE,CAAC;YAC5B,uDAAuD;YACvD,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,MAAuB;IAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,OAAO,IAAI,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rules/authentication/utils/authentication-header-names.d.ts

@@ -0,0 +1,3 @@
+export declare const requestAuthenticationHeaders: string[];
+export declare const responseAuthenticationHeaders: string[];
+//# sourceMappingURL=authentication-header-names.d.ts.map

package/dist/rules/authentication/utils/authentication-header-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-header-names.d.ts","sourceRoot":"","sources":["../../../../src/rules/authentication/utils/authentication-header-names.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,UAGxC,CAAC;AACF,eAAO,MAAM,6BAA6B,UAKzC,CAAC"}

package/dist/rules/authentication/utils/authentication-header-names.js

@@ -0,0 +1,11 @@
+export const requestAuthenticationHeaders = [
+    'authorization',
+    'proxy-authorization',
+];
+export const responseAuthenticationHeaders = [
+    'www-authenticate',
+    'authentication-info',
+    'proxy-authenticate',
+    'proxy-authentication-info',
+];
+//# sourceMappingURL=authentication-header-names.js.map

package/dist/rules/authentication/utils/authentication-header-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-header-names.js","sourceRoot":"","sources":["../../../../src/rules/authentication/utils/authentication-header-names.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,eAAe;IACf,qBAAqB;CACtB,CAAC;AACF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,2BAA2B;CAC5B,CAAC"}

package/dist/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=non-origin-server-must-not-evaluate-conditional-headers.rule.d.ts.map

package/dist/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"non-origin-server-must-not-evaluate-conditional-headers.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.ts"],"names":[],"mappings":";AAEA,wBAcU"}

package/dist/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.js

@@ -0,0 +1,11 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/non-origin-server-must-not-evaluate-conditional-headers')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-13.2.1')
+    .description('A server that is not the origin server for the target resource and cannot act as a cache for requests on the target resource MUST NOT evaluate the conditional request header fields defined by this specification, and it MUST forward them if the request is forwarded, since the generating client intends that they be evaluated by a server that can provide a current representation.')
+    .summary('Non-origin server that cannot act as cache MUST NOT evaluate conditional headers.')
+    .appliesTo('intermediary', 'proxy')
+    .tags('conditional-requests', 'evaluation', 'forwarding')
+    .done();
+//# sourceMappingURL=non-origin-server-must-not-evaluate-conditional-headers.rule.js.map

package/dist/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"non-origin-server-must-not-evaluate-conditional-headers.rule.js","sourceRoot":"","sources":["../../../../src/rules/conditional-requests/evaluation/non-origin-server-must-not-evaluate-conditional-headers.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,iEAAiE,CAClE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,4DAA4D,CAAC;KACjE,WAAW,CACV,6XAA6X,CAC9X;KACA,OAAO,CACN,mFAAmF,CACpF;KACA,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC;KAClC,IAAI,CAAC,sBAAsB,EAAE,YAAY,EAAE,YAAY,CAAC;KACxD,IAAI,EAAE,CAAC"}

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-must-evaluate-preconditions-after-normal-checks.rule.d.ts.map

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-must-evaluate-preconditions-after-normal-checks.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.ts"],"names":[],"mappings":";AAEA,wBAcU"}

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.js

@@ -0,0 +1,11 @@
+import { httpRule } from '@thymian/core';
+export default httpRule('rfc9110/server-must-evaluate-preconditions-after-normal-checks')
+    .severity('error')
+    .type('informational')
+    .url('https://www.rfc-editor.org/rfc/rfc9110.html#section-13.2.1')
+    .description('Except when excluded below, a recipient cache or origin server MUST evaluate received request preconditions after it has successfully performed its normal request checks and just before it would process the request content (if any) or perform the action associated with the request method.')
+    .summary('Server MUST evaluate preconditions after normal checks and before processing request content.')
+    .appliesTo('server', 'cache', 'origin server')
+    .tags('conditional-requests', 'evaluation', 'timing')
+    .done();
+//# sourceMappingURL=server-must-evaluate-preconditions-after-normal-checks.rule.js.map

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-must-evaluate-preconditions-after-normal-checks.rule.js","sourceRoot":"","sources":["../../../../src/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-after-normal-checks.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,eAAe,QAAQ,CACrB,gEAAgE,CACjE;KACE,QAAQ,CAAC,OAAO,CAAC;KACjB,IAAI,CAAC,eAAe,CAAC;KACrB,GAAG,CAAC,4DAA4D,CAAC;KACjE,WAAW,CACV,mSAAmS,CACpS;KACA,OAAO,CACN,+FAA+F,CAChG;KACA,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC;KAC7C,IAAI,CAAC,sBAAsB,EAAE,YAAY,EAAE,QAAQ,CAAC;KACpD,IAAI,EAAE,CAAC"}

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-in-correct-order.rule.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@thymian/core").Rule<Record<PropertyKey, unknown>>;
+export default _default;
+//# sourceMappingURL=server-must-evaluate-preconditions-in-correct-order.rule.d.ts.map

package/dist/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-in-correct-order.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-must-evaluate-preconditions-in-correct-order.rule.d.ts","sourceRoot":"","sources":["../../../../src/rules/conditional-requests/evaluation/server-must-evaluate-preconditions-in-correct-order.rule.ts"],"names":[],"mappings":";AAEA,wBAcU"}