@ttoss/http-server-auth 0.3.3 → 0.3.5

package/dist/index.cjs

@@ -76,8 +76,22 @@ var trySystem = (token, opts) => {
 };
 /** Sentinel: token verified but missing a required scope → 403, not 401. */
 var FORBIDDEN = Symbol("forbidden");
+/**
+* Derives a space-separated scope string from the payload.
+* Accepts either `scope: string` (standard JWT claim) or `scopes: string[]`
+* (a common alternative shape). Returns `null` when neither is present.
+*/
+var resolveScopeString = payload => {
+  if (typeof payload.scope === "string") return payload.scope;
+  if (Array.isArray(payload.scopes) && payload.scopes.every(s => {
+    return typeof s === "string";
+  })) return payload.scopes.join(" ");
+  return null;
+};
 var hasRequiredScopes = (requiredScopes, payload) => {
-  const tokenScopes = (typeof payload.scope === "string" ? payload.scope : "").split(" ");
+  const scopeString = resolveScopeString(payload);
+  if (scopeString === null) return false;
+  const tokenScopes = scopeString ? scopeString.split(" ") : [];
   return requiredScopes.every(s => {
     return tokenScopes.includes(s);
   });

package/dist/index.d.cts

@@ -52,8 +52,9 @@ type OAuthOptions = {
    */
   mapPayload?: (payload: Record<string, unknown>, ctx: Context) => AuthenticatedUser | null;
   /**
-   * Scopes that must all be present on the token's space-separated `scope`
-   * claim. A verified token missing any of them yields a `403`.
+   * Scopes that must all be present on the token, else `403`.
+   * `verify` may return either `scope: string` (space-separated JWT claim) or
+   * `scopes: string[]`; both are normalised internally.
    */
   requiredScopes?: string[];
 };

package/dist/index.d.mts

@@ -52,8 +52,9 @@ type OAuthOptions = {
    */
   mapPayload?: (payload: Record<string, unknown>, ctx: Context) => AuthenticatedUser | null;
   /**
-   * Scopes that must all be present on the token's space-separated `scope`
-   * claim. A verified token missing any of them yields a `403`.
+   * Scopes that must all be present on the token, else `403`.
+   * `verify` may return either `scope: string` (space-separated JWT claim) or
+   * `scopes: string[]`; both are normalised internally.
    */
   requiredScopes?: string[];
 };

package/dist/index.mjs

@@ -45,8 +45,22 @@ var trySystem = (token, opts) => {
 };
 /** Sentinel: token verified but missing a required scope → 403, not 401. */
 var FORBIDDEN = Symbol("forbidden");
+/**
+* Derives a space-separated scope string from the payload.
+* Accepts either `scope: string` (standard JWT claim) or `scopes: string[]`
+* (a common alternative shape). Returns `null` when neither is present.
+*/
+var resolveScopeString = payload => {
+  if (typeof payload.scope === "string") return payload.scope;
+  if (Array.isArray(payload.scopes) && payload.scopes.every(s => {
+    return typeof s === "string";
+  })) return payload.scopes.join(" ");
+  return null;
+};
 var hasRequiredScopes = (requiredScopes, payload) => {
-  const tokenScopes = (typeof payload.scope === "string" ? payload.scope : "").split(" ");
+  const scopeString = resolveScopeString(payload);
+  if (scopeString === null) return false;
+  const tokenScopes = scopeString ? scopeString.split(" ") : [];
   return requiredScopes.every(s => {
     return tokenScopes.includes(s);
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,15 +32,15 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.7.0"
+    "@ttoss/auth-core": "^0.8.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
     "jest": "^30.4.2",
     "supertest": "^7.2.2",
     "tsdown": "^0.22.2",
-    "@ttoss/http-server": "^0.7.1",
-    "@ttoss/config": "^1.37.17"
+    "@ttoss/config": "^1.37.17",
+    "@ttoss/http-server": "^0.7.1"
   },
   "peerDependencies": {
     "@ttoss/http-server": "^0.7.1"