@ttoss/http-server-auth 0.6.3 → 0.7.0

package/README.md

@@ -173,3 +173,9 @@ path when the app versions its API; individual paths are overridable through
 ## OAuth authorization server
 
 The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/authorize`, `/token`, `/register`, discovery), a thin adapter over `createOAuthHandlers` from [`@ttoss/auth-core`](https://ttoss.dev/docs/modules/packages/auth-core). Pair it with the `oauth` verification strategy above when one deployment both issues and verifies. See the [OAuth Authorization Server](https://ttoss.dev/docs/engineering/guidelines/oauth-authorization-server) guideline.
+
+### Protected resource metadata (RFC 9728)
+
+Passing `resource` to `oauthServer()` serves the protected-resource metadata document; `createProtectedResourceMetadataMiddleware` serves the same document when you bring your own auth middleware. Both answer at **every** location RFC 9728 defines for that resource — the root, plus the path-derived `/.well-known/oauth-protected-resource<path>` when the resource identifier carries a path, since §3.1 inserts the well-known segment between host and path. The locations and the document body come from `protectedResourceMetadataPaths` / `protectedResourceMetadataDocument` in `@ttoss/auth-core` (re-exported here), which is also what `getWwwAuthenticateHeader` derives its URL from — so the header and the routes cannot disagree.
+
+Mount either **before** `authMiddleware`: clients fetch discovery before they have a token.

package/dist/index.cjs

@@ -295,7 +295,9 @@ var oauthServer = options => {
     applyResponse(ctx, engine.authorizationServerMetadata());
   });
   const prm = engine.protectedResourceMetadata();
-  if (prm) router.get("/.well-known/oauth-protected-resource", ctx => {
+  if (prm && options.resource) for (const metadataPath of (0, _ttoss_auth_core.protectedResourceMetadataPaths)({
+    resource: options.resource
+  })) router.get(metadataPath, ctx => {
     applyResponse(ctx, prm);
   });
   router.get(engine.paths.authorize, async ctx => {
@@ -310,17 +312,25 @@ var oauthServer = options => {
   return router;
 };
 /**
-* Koa middleware that serves `GET /.well-known/oauth-protected-resource`
-* (RFC 9728). Mount it **before** `authMiddleware` so the discovery endpoint
+* Koa middleware that serves the RFC 9728 Protected Resource Metadata
+* document. Mount it **before** `authMiddleware` so the discovery endpoint
 * stays unauthenticated (clients fetch it before they have a token).
+*
+* It answers at every location `protectedResourceMetadataPaths` derives for
+* the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
+* the resource identifier carries a path.
 */
 var createProtectedResourceMetadataMiddleware = args => {
+  const metadataPaths = new Set((0, _ttoss_auth_core.protectedResourceMetadataPaths)({
+    resource: args.resource
+  }));
+  const body = (0, _ttoss_auth_core.protectedResourceMetadataDocument)({
+    resource: args.resource,
+    authorizationServers: args.authorizationServers
+  });
   return async (ctx, next) => {
-    if (ctx.method === "GET" && ctx.path === "/.well-known/oauth-protected-resource") {
-      ctx.body = {
-        resource: args.resource,
-        authorization_servers: args.authorizationServers
-      };
+    if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {
+      ctx.body = body;
       return;
     }
     await next();
@@ -379,4 +389,22 @@ Object.defineProperty(exports, 'normalizeEmail', {
   }
 });
 exports.oauthServer = oauthServer;
+Object.defineProperty(exports, 'protectedResourceMetadataDocument', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.protectedResourceMetadataDocument;
+  }
+});
+Object.defineProperty(exports, 'protectedResourceMetadataPaths', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.protectedResourceMetadataPaths;
+  }
+});
+Object.defineProperty(exports, 'protectedResourceMetadataUrl', {
+  enumerable: true,
+  get: function () {
+    return _ttoss_auth_core.protectedResourceMetadataUrl;
+  }
+});
 exports.requireAuth = requireAuth;

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
-import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail } from "@ttoss/auth-core";
+import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
 
 //#region src/types.d.ts
 type AuthenticatedUser = {
@@ -158,9 +158,13 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  */
 declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
- * Koa middleware that serves `GET /.well-known/oauth-protected-resource`
- * (RFC 9728). Mount it **before** `authMiddleware` so the discovery endpoint
+ * Koa middleware that serves the RFC 9728 Protected Resource Metadata
+ * document. Mount it **before** `authMiddleware` so the discovery endpoint
  * stays unauthenticated (clients fetch it before they have a token).
+ *
+ * It answers at every location `protectedResourceMetadataPaths` derives for
+ * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
+ * the resource identifier carries a path.
  */
 declare const createProtectedResourceMetadataMiddleware: (args: {
   /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
@@ -184,4 +188,4 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  */
 declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 
-import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail } from "@ttoss/auth-core";
+import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
 
 //#region src/types.d.ts
@@ -158,9 +158,13 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  */
 declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
- * Koa middleware that serves `GET /.well-known/oauth-protected-resource`
- * (RFC 9728). Mount it **before** `authMiddleware` so the discovery endpoint
+ * Koa middleware that serves the RFC 9728 Protected Resource Metadata
+ * document. Mount it **before** `authMiddleware` so the discovery endpoint
  * stays unauthenticated (clients fetch it before they have a token).
+ *
+ * It answers at every location `protectedResourceMetadataPaths` derives for
+ * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
+ * the resource identifier carries a path.
  */
 declare const createProtectedResourceMetadataMiddleware: (args: {
   /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
@@ -184,4 +188,4 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  */
 declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };

package/dist/index.mjs

@@ -1,6 +1,6 @@
 /** Powered by @ttoss/config. https://ttoss.dev/docs/modules/packages/config/ */
 import crypto from "node:crypto";
-import { createEmailAuthHandlers, createEmailAuthHandlers as createEmailAuthHandlers$1, createOAuthHandlers, createOAuthHandlers as createOAuthHandlers$1, emailAuthErrorCodes, getWwwAuthenticateHeader, hashApiToken, normalizeEmail, verifyJwt } from "@ttoss/auth-core";
+import { createEmailAuthHandlers, createEmailAuthHandlers as createEmailAuthHandlers$1, createOAuthHandlers, createOAuthHandlers as createOAuthHandlers$1, emailAuthErrorCodes, getWwwAuthenticateHeader, hashApiToken, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataDocument as protectedResourceMetadataDocument$1, protectedResourceMetadataPaths, protectedResourceMetadataPaths as protectedResourceMetadataPaths$1, protectedResourceMetadataUrl, verifyJwt } from "@ttoss/auth-core";
 import { Router } from "@ttoss/http-server";
 
 //#region src/origin.ts
@@ -264,7 +264,9 @@ var oauthServer = options => {
     applyResponse(ctx, engine.authorizationServerMetadata());
   });
   const prm = engine.protectedResourceMetadata();
-  if (prm) router.get("/.well-known/oauth-protected-resource", ctx => {
+  if (prm && options.resource) for (const metadataPath of protectedResourceMetadataPaths$1({
+    resource: options.resource
+  })) router.get(metadataPath, ctx => {
     applyResponse(ctx, prm);
   });
   router.get(engine.paths.authorize, async ctx => {
@@ -279,17 +281,25 @@ var oauthServer = options => {
   return router;
 };
 /**
-* Koa middleware that serves `GET /.well-known/oauth-protected-resource`
-* (RFC 9728). Mount it **before** `authMiddleware` so the discovery endpoint
+* Koa middleware that serves the RFC 9728 Protected Resource Metadata
+* document. Mount it **before** `authMiddleware` so the discovery endpoint
 * stays unauthenticated (clients fetch it before they have a token).
+*
+* It answers at every location `protectedResourceMetadataPaths` derives for
+* the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
+* the resource identifier carries a path.
 */
 var createProtectedResourceMetadataMiddleware = args => {
+  const metadataPaths = new Set(protectedResourceMetadataPaths$1({
+    resource: args.resource
+  }));
+  const body = protectedResourceMetadataDocument$1({
+    resource: args.resource,
+    authorizationServers: args.authorizationServers
+  });
   return async (ctx, next) => {
-    if (ctx.method === "GET" && ctx.path === "/.well-known/oauth-protected-resource") {
-      ctx.body = {
-        resource: args.resource,
-        authorization_servers: args.authorizationServers
-      };
+    if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {
+      ctx.body = body;
       return;
     }
     await next();
@@ -313,4 +323,4 @@ var requireAuth = options => {
 };
 
 //#endregion
-export { authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, requireAuth };
+export { authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.6.3",
+  "version": "0.7.0",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,18 +32,18 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.14.0"
+    "@ttoss/auth-core": "^0.15.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
     "jest": "^30.4.2",
     "supertest": "^7.2.2",
     "tsdown": "^0.22.2",
-    "@ttoss/config": "^1.38.0",
-    "@ttoss/http-server": "^0.8.1"
+    "@ttoss/http-server": "^0.9.0",
+    "@ttoss/config": "^1.39.0"
   },
   "peerDependencies": {
-    "@ttoss/http-server": "^0.8.1"
+    "@ttoss/http-server": "^0.9.0"
   },
   "publishConfig": {
     "access": "public",