@ttoss/http-server-auth 0.8.4 → 0.9.0

package/README.md

@@ -176,6 +176,6 @@ The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/
 
 ### Protected resource metadata (RFC 9728)
 
-Passing `resource` to `oauthServer()` serves the protected-resource metadata document; `createProtectedResourceMetadataMiddleware` serves the same document when you bring your own auth middleware. Both answer at **every** location RFC 9728 defines for that resource — the root, plus the path-derived `/.well-known/oauth-protected-resource<path>` when the resource identifier carries a path, since §3.1 inserts the well-known segment between host and path. The locations and the document body come from `protectedResourceMetadataPaths` / `protectedResourceMetadataDocument` in `@ttoss/auth-core` (re-exported here), which is also what `getWwwAuthenticateHeader` derives its URL from — so the header and the routes cannot disagree.
+Passing `resource` to `oauthServer()` serves the protected-resource metadata document; `createProtectedResourceMetadataMiddleware` serves the same document when you bring your own auth middleware. Both answer at **every** location RFC 9728 defines for that resource — the root, plus the path-derived `/.well-known/oauth-protected-resource<path>` when the resource identifier carries a path, since §3.1 inserts the well-known segment between host and path. The locations and the document body come from `protectedResourceMetadataPaths` / `protectedResourceMetadataDocument` in `@ttoss/auth-core` (re-exported here), which is also what `getWwwAuthenticateHeader` derives its URL from — so the header and the routes cannot disagree. `oauthServer()` advertises its `scopesSupported` as the document's `scopes_supported`; pass `scopesSupported` to `createProtectedResourceMetadataMiddleware` for the same.
 
 Mount either **before** `authMiddleware`: clients fetch discovery before they have a token.

package/dist/index.cjs

@@ -326,7 +326,8 @@ var createProtectedResourceMetadataMiddleware = args => {
   }));
   const body = (0, _ttoss_auth_core.protectedResourceMetadataDocument)({
     resource: args.resource,
-    authorizationServers: args.authorizationServers
+    authorizationServers: args.authorizationServers,
+    scopesSupported: args.scopesSupported
   });
   return async (ctx, next) => {
     if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {

package/dist/index.d.cts

@@ -168,7 +168,8 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  */
 declare const createProtectedResourceMetadataMiddleware: (args: {
   /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
-  authorizationServers: string[];
+  authorizationServers: string[]; /** Scopes this resource accepts, advertised as `scopes_supported`. */
+  scopesSupported?: string[];
 }) => Middleware;
 //#endregion
 //#region src/origin.d.ts

package/dist/index.d.mts

@@ -168,7 +168,8 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  */
 declare const createProtectedResourceMetadataMiddleware: (args: {
   /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
-  authorizationServers: string[];
+  authorizationServers: string[]; /** Scopes this resource accepts, advertised as `scopes_supported`. */
+  scopesSupported?: string[];
 }) => Middleware;
 //#endregion
 //#region src/origin.d.ts

package/dist/index.mjs

@@ -295,7 +295,8 @@ var createProtectedResourceMetadataMiddleware = args => {
   }));
   const body = protectedResourceMetadataDocument$1({
     resource: args.resource,
-    authorizationServers: args.authorizationServers
+    authorizationServers: args.authorizationServers,
+    scopesSupported: args.scopesSupported
   });
   return async (ctx, next) => {
     if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,7 +32,7 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.17.2"
+    "@ttoss/auth-core": "^0.18.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
@@ -40,10 +40,10 @@
     "supertest": "^7.2.2",
     "tsdown": "^0.22.2",
     "@ttoss/config": "^1.41.0",
-    "@ttoss/http-server": "^0.12.2"
+    "@ttoss/http-server": "^0.13.1"
   },
   "peerDependencies": {
-    "@ttoss/http-server": "^0.12.2"
+    "@ttoss/http-server": "^0.13.1"
   },
   "publishConfig": {
     "access": "public",