@ttoss/http-server-auth 0.8.5 → 0.10.0

package/README.md

@@ -176,6 +176,6 @@ The package also ships `oauthServer()` — a Koa `Router` that issues tokens (`/
 
 ### Protected resource metadata (RFC 9728)
 
-Passing `resource` to `oauthServer()` serves the protected-resource metadata document; `createProtectedResourceMetadataMiddleware` serves the same document when you bring your own auth middleware. Both answer at **every** location RFC 9728 defines for that resource — the root, plus the path-derived `/.well-known/oauth-protected-resource<path>` when the resource identifier carries a path, since §3.1 inserts the well-known segment between host and path. The locations and the document body come from `protectedResourceMetadataPaths` / `protectedResourceMetadataDocument` in `@ttoss/auth-core` (re-exported here), which is also what `getWwwAuthenticateHeader` derives its URL from — so the header and the routes cannot disagree.
+Passing `resource` to `oauthServer()` serves the protected-resource metadata document; `createProtectedResourceMetadataMiddleware` serves the same document when you bring your own auth middleware. Both answer at **every** location RFC 9728 defines for that resource — the root, plus the path-derived `/.well-known/oauth-protected-resource<path>` when the resource identifier carries a path, since §3.1 inserts the well-known segment between host and path. The locations and the document body come from `protectedResourceMetadataPaths` / `protectedResourceMetadataDocument` in `@ttoss/auth-core` (re-exported here), which is also what `getWwwAuthenticateHeader` derives its URL from — so the header and the routes cannot disagree. `oauthServer()` advertises its `scopesSupported` as the document's `scopes_supported`; pass `scopesSupported` to `createProtectedResourceMetadataMiddleware` for the same.
 
 Mount either **before** `authMiddleware`: clients fetch discovery before they have a token.

package/dist/index.cjs

@@ -23,7 +23,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
   value: mod,
   enumerable: true
 }) : target, mod));
@@ -326,7 +326,8 @@ var createProtectedResourceMetadataMiddleware = args => {
   }));
   const body = (0, _ttoss_auth_core.protectedResourceMetadataDocument)({
     resource: args.resource,
-    authorizationServers: args.authorizationServers
+    authorizationServers: args.authorizationServers,
+    scopesSupported: args.scopesSupported
   });
   return async (ctx, next) => {
     if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {
@@ -355,13 +356,13 @@ var requireAuth = options => {
 
 //#endregion
 exports.authMiddleware = authMiddleware;
-Object.defineProperty(exports, 'createEmailAuthHandlers', {
+Object.defineProperty(exports, "createEmailAuthHandlers", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.createEmailAuthHandlers;
   }
 });
-Object.defineProperty(exports, 'createOAuthHandlers', {
+Object.defineProperty(exports, "createOAuthHandlers", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.createOAuthHandlers;
@@ -369,39 +370,39 @@ Object.defineProperty(exports, 'createOAuthHandlers', {
 });
 exports.createProtectedResourceMetadataMiddleware = createProtectedResourceMetadataMiddleware;
 exports.emailAuth = emailAuth;
-Object.defineProperty(exports, 'emailAuthErrorCodes', {
+Object.defineProperty(exports, "emailAuthErrorCodes", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.emailAuthErrorCodes;
   }
 });
-Object.defineProperty(exports, 'getWwwAuthenticateHeader', {
+Object.defineProperty(exports, "getWwwAuthenticateHeader", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.getWwwAuthenticateHeader;
   }
 });
 exports.isOriginAllowed = isOriginAllowed;
-Object.defineProperty(exports, 'normalizeEmail', {
+Object.defineProperty(exports, "normalizeEmail", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.normalizeEmail;
   }
 });
 exports.oauthServer = oauthServer;
-Object.defineProperty(exports, 'protectedResourceMetadataDocument', {
+Object.defineProperty(exports, "protectedResourceMetadataDocument", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataDocument;
   }
 });
-Object.defineProperty(exports, 'protectedResourceMetadataPaths', {
+Object.defineProperty(exports, "protectedResourceMetadataPaths", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataPaths;
   }
 });
-Object.defineProperty(exports, 'protectedResourceMetadataUrl', {
+Object.defineProperty(exports, "protectedResourceMetadataUrl", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataUrl;

package/dist/index.d.cts

@@ -1,7 +1,6 @@
 
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
 import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
-
 //#region src/types.d.ts
 type AuthenticatedUser = {
   id: string;
@@ -31,7 +30,8 @@ type ApiTokenOptions = {
   lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
-  secret: string; /** User attached to ctx.state.user for system calls. */
+  secret: string;
+  /** User attached to ctx.state.user for system calls. */
   user: AuthenticatedUser;
 };
 type OAuthOptions = {
@@ -59,7 +59,8 @@ type OAuthOptions = {
   requiredScopes?: string[];
 };
 type AuthMiddlewareOptions = {
-  /** Ordered list of strategies to attempt. First match wins. */strategies: AuthStrategy[];
+  /** Ordered list of strategies to attempt. First match wins. */
+  strategies: AuthStrategy[];
   jwt?: JwtOptions;
   apiToken?: ApiTokenOptions;
   system?: SystemOptions;
@@ -91,7 +92,7 @@ type AuthMiddlewareOptions = {
  * header, RFC 9728 when `resourceMetadataUrl` is set) for missing/invalid
  * tokens, and `403` when a verified token is missing a required scope.
  */
-declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
+export declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
 //#region src/emailAuth.d.ts
 /**
@@ -128,7 +129,7 @@ declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context,
  * );
  * ```
  */
-declare const emailAuth: (options: EmailAuthOptions$1 & {
+export declare const emailAuth: (options: EmailAuthOptions$1 & {
   /**
    * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
    * versions its API and the engine's default paths are otherwise fine.
@@ -156,7 +157,7 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  * app.use(oauthServer({ issuer, clientStore, authCodeStore, issueTokens, onAuthorize }).routes());
  * ```
  */
-declare const oauthServer: (options: OAuthServerOptions$1) => Router;
+export declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
  * Koa middleware that serves the RFC 9728 Protected Resource Metadata
  * document. Mount it **before** `authMiddleware` so the discovery endpoint
@@ -166,9 +167,13 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
  * the resource identifier carries a path.
  */
-declare const createProtectedResourceMetadataMiddleware: (args: {
-  /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
+export declare const createProtectedResourceMetadataMiddleware: (args: {
+  /** The protected resource's identifier URI. */
+  resource: string;
+  /** Authorization server issuer URIs that issue tokens for this resource. */
   authorizationServers: string[];
+  /** Scopes this resource accepts, advertised as `scopes_supported`. */
+  scopesSupported?: string[];
 }) => Middleware;
 //#endregion
 //#region src/origin.d.ts
@@ -176,7 +181,7 @@ declare const createProtectedResourceMetadataMiddleware: (args: {
  * Returns true if origin matches any entry in the allowlist.
  * Strings are compared exactly; RegExps are tested.
  */
-declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
+export declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
 //#endregion
 //#region src/requireAuth.d.ts
 /**
@@ -186,6 +191,6 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  * @example
  * router.get('/me', requireAuth({ strategies: ['jwt', 'apiToken'] }), handler);
  */
-declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
+export declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl };

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 
 import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
-
 //#region src/types.d.ts
 type AuthenticatedUser = {
   id: string;
@@ -31,7 +30,8 @@ type ApiTokenOptions = {
   lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
-  secret: string; /** User attached to ctx.state.user for system calls. */
+  secret: string;
+  /** User attached to ctx.state.user for system calls. */
   user: AuthenticatedUser;
 };
 type OAuthOptions = {
@@ -59,7 +59,8 @@ type OAuthOptions = {
   requiredScopes?: string[];
 };
 type AuthMiddlewareOptions = {
-  /** Ordered list of strategies to attempt. First match wins. */strategies: AuthStrategy[];
+  /** Ordered list of strategies to attempt. First match wins. */
+  strategies: AuthStrategy[];
   jwt?: JwtOptions;
   apiToken?: ApiTokenOptions;
   system?: SystemOptions;
@@ -91,7 +92,7 @@ type AuthMiddlewareOptions = {
  * header, RFC 9728 when `resourceMetadataUrl` is set) for missing/invalid
  * tokens, and `403` when a verified token is missing a required scope.
  */
-declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
+export declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
 //#region src/emailAuth.d.ts
 /**
@@ -128,7 +129,7 @@ declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context,
  * );
  * ```
  */
-declare const emailAuth: (options: EmailAuthOptions$1 & {
+export declare const emailAuth: (options: EmailAuthOptions$1 & {
   /**
    * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
    * versions its API and the engine's default paths are otherwise fine.
@@ -156,7 +157,7 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  * app.use(oauthServer({ issuer, clientStore, authCodeStore, issueTokens, onAuthorize }).routes());
  * ```
  */
-declare const oauthServer: (options: OAuthServerOptions$1) => Router;
+export declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
  * Koa middleware that serves the RFC 9728 Protected Resource Metadata
  * document. Mount it **before** `authMiddleware` so the discovery endpoint
@@ -166,9 +167,13 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
  * the resource identifier carries a path.
  */
-declare const createProtectedResourceMetadataMiddleware: (args: {
-  /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
+export declare const createProtectedResourceMetadataMiddleware: (args: {
+  /** The protected resource's identifier URI. */
+  resource: string;
+  /** Authorization server issuer URIs that issue tokens for this resource. */
   authorizationServers: string[];
+  /** Scopes this resource accepts, advertised as `scopes_supported`. */
+  scopesSupported?: string[];
 }) => Middleware;
 //#endregion
 //#region src/origin.d.ts
@@ -176,7 +181,7 @@ declare const createProtectedResourceMetadataMiddleware: (args: {
  * Returns true if origin matches any entry in the allowlist.
  * Strings are compared exactly; RegExps are tested.
  */
-declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
+export declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
 //#endregion
 //#region src/requireAuth.d.ts
 /**
@@ -186,6 +191,6 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  * @example
  * router.get('/me', requireAuth({ strategies: ['jwt', 'apiToken'] }), handler);
  */
-declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
+export declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl };

package/dist/index.mjs

@@ -295,7 +295,8 @@ var createProtectedResourceMetadataMiddleware = args => {
   }));
   const body = protectedResourceMetadataDocument$1({
     resource: args.resource,
-    authorizationServers: args.authorizationServers
+    authorizationServers: args.authorizationServers,
+    scopesSupported: args.scopesSupported
   });
   return async (ctx, next) => {
     if (ctx.method === "GET" && metadataPaths.has(ctx.path)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.8.5",
+  "version": "0.10.0",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,18 +32,18 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.17.2"
+    "@ttoss/auth-core": "^0.19.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
-    "jest": "^30.4.2",
-    "supertest": "^7.2.2",
-    "tsdown": "^0.22.2",
-    "@ttoss/config": "^1.41.0",
-    "@ttoss/http-server": "^0.13.0"
+    "jest": "^30.5.2",
+    "supertest": "^7.3.1",
+    "tsdown": "^0.23.1",
+    "@ttoss/http-server": "^0.14.0",
+    "@ttoss/config": "^2.0.0"
   },
   "peerDependencies": {
-    "@ttoss/http-server": "^0.13.0"
+    "@ttoss/http-server": "^0.14.0"
   },
   "publishConfig": {
     "access": "public",