@ttoss/http-server-auth 0.9.0 → 0.10.1

package/dist/index.cjs

@@ -23,7 +23,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
   value: mod,
   enumerable: true
 }) : target, mod));
@@ -356,13 +356,13 @@ var requireAuth = options => {
 
 //#endregion
 exports.authMiddleware = authMiddleware;
-Object.defineProperty(exports, 'createEmailAuthHandlers', {
+Object.defineProperty(exports, "createEmailAuthHandlers", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.createEmailAuthHandlers;
   }
 });
-Object.defineProperty(exports, 'createOAuthHandlers', {
+Object.defineProperty(exports, "createOAuthHandlers", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.createOAuthHandlers;
@@ -370,39 +370,39 @@ Object.defineProperty(exports, 'createOAuthHandlers', {
 });
 exports.createProtectedResourceMetadataMiddleware = createProtectedResourceMetadataMiddleware;
 exports.emailAuth = emailAuth;
-Object.defineProperty(exports, 'emailAuthErrorCodes', {
+Object.defineProperty(exports, "emailAuthErrorCodes", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.emailAuthErrorCodes;
   }
 });
-Object.defineProperty(exports, 'getWwwAuthenticateHeader', {
+Object.defineProperty(exports, "getWwwAuthenticateHeader", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.getWwwAuthenticateHeader;
   }
 });
 exports.isOriginAllowed = isOriginAllowed;
-Object.defineProperty(exports, 'normalizeEmail', {
+Object.defineProperty(exports, "normalizeEmail", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.normalizeEmail;
   }
 });
 exports.oauthServer = oauthServer;
-Object.defineProperty(exports, 'protectedResourceMetadataDocument', {
+Object.defineProperty(exports, "protectedResourceMetadataDocument", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataDocument;
   }
 });
-Object.defineProperty(exports, 'protectedResourceMetadataPaths', {
+Object.defineProperty(exports, "protectedResourceMetadataPaths", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataPaths;
   }
 });
-Object.defineProperty(exports, 'protectedResourceMetadataUrl', {
+Object.defineProperty(exports, "protectedResourceMetadataUrl", {
   enumerable: true,
   get: function () {
     return _ttoss_auth_core.protectedResourceMetadataUrl;

package/dist/index.d.cts

@@ -1,7 +1,6 @@
 
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
 import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
-
 //#region src/types.d.ts
 type AuthenticatedUser = {
   id: string;
@@ -31,7 +30,8 @@ type ApiTokenOptions = {
   lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
-  secret: string; /** User attached to ctx.state.user for system calls. */
+  secret: string;
+  /** User attached to ctx.state.user for system calls. */
   user: AuthenticatedUser;
 };
 type OAuthOptions = {
@@ -59,7 +59,8 @@ type OAuthOptions = {
   requiredScopes?: string[];
 };
 type AuthMiddlewareOptions = {
-  /** Ordered list of strategies to attempt. First match wins. */strategies: AuthStrategy[];
+  /** Ordered list of strategies to attempt. First match wins. */
+  strategies: AuthStrategy[];
   jwt?: JwtOptions;
   apiToken?: ApiTokenOptions;
   system?: SystemOptions;
@@ -91,7 +92,7 @@ type AuthMiddlewareOptions = {
  * header, RFC 9728 when `resourceMetadataUrl` is set) for missing/invalid
  * tokens, and `403` when a verified token is missing a required scope.
  */
-declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
+export declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
 //#region src/emailAuth.d.ts
 /**
@@ -128,7 +129,7 @@ declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context,
  * );
  * ```
  */
-declare const emailAuth: (options: EmailAuthOptions$1 & {
+export declare const emailAuth: (options: EmailAuthOptions$1 & {
   /**
    * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
    * versions its API and the engine's default paths are otherwise fine.
@@ -156,7 +157,7 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  * app.use(oauthServer({ issuer, clientStore, authCodeStore, issueTokens, onAuthorize }).routes());
  * ```
  */
-declare const oauthServer: (options: OAuthServerOptions$1) => Router;
+export declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
  * Koa middleware that serves the RFC 9728 Protected Resource Metadata
  * document. Mount it **before** `authMiddleware` so the discovery endpoint
@@ -166,9 +167,12 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
  * the resource identifier carries a path.
  */
-declare const createProtectedResourceMetadataMiddleware: (args: {
-  /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
-  authorizationServers: string[]; /** Scopes this resource accepts, advertised as `scopes_supported`. */
+export declare const createProtectedResourceMetadataMiddleware: (args: {
+  /** The protected resource's identifier URI. */
+  resource: string;
+  /** Authorization server issuer URIs that issue tokens for this resource. */
+  authorizationServers: string[];
+  /** Scopes this resource accepts, advertised as `scopes_supported`. */
   scopesSupported?: string[];
 }) => Middleware;
 //#endregion
@@ -177,7 +181,7 @@ declare const createProtectedResourceMetadataMiddleware: (args: {
  * Returns true if origin matches any entry in the allowlist.
  * Strings are compared exactly; RegExps are tested.
  */
-declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
+export declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
 //#endregion
 //#region src/requireAuth.d.ts
 /**
@@ -187,6 +191,6 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  * @example
  * router.get('/me', requireAuth({ strategies: ['jwt', 'apiToken'] }), handler);
  */
-declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
+export declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl };

package/dist/index.d.mts

@@ -1,7 +1,6 @@
 
 import { AuthCodeStore, AuthorizeRequest, ClientStore, EmailAuthDelivery, EmailAuthErrorCode, EmailAuthHandler, EmailAuthHandlers, EmailAuthHooks, EmailAuthMode, EmailAuthOptions, EmailAuthOptions as EmailAuthOptions$1, EmailAuthPaths, EmailAuthSession, EmailAuthTtl, EmailAuthUser, EmailAuthUserStore, EmailCodeOptions, IssueTokensArgs, IssuedTokens, OAuthClient, OAuthClientMetadata, OAuthHandlers, OAuthServerOptions, OAuthServerOptions as OAuthServerOptions$1, OnAuthorizeArgs, OnAuthorizeResult, OnRefreshTokenArgs, OnRefreshTokenResult, OneTimeTokenPurpose, OneTimeTokenStore, PasswordOptions, ProtectedResourceMetadata, RequestRateLimit, RequestRateLimitStore, StoredAuthorizationCode, StoredOneTimeToken, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl } from "@ttoss/auth-core";
 import { Context, Middleware, Next, Router } from "@ttoss/http-server";
-
 //#region src/types.d.ts
 type AuthenticatedUser = {
   id: string;
@@ -31,7 +30,8 @@ type ApiTokenOptions = {
   lookup: (tokenHash: string, ctx: Context) => Promise<AuthenticatedUser | null>;
 };
 type SystemOptions = {
-  secret: string; /** User attached to ctx.state.user for system calls. */
+  secret: string;
+  /** User attached to ctx.state.user for system calls. */
   user: AuthenticatedUser;
 };
 type OAuthOptions = {
@@ -59,7 +59,8 @@ type OAuthOptions = {
   requiredScopes?: string[];
 };
 type AuthMiddlewareOptions = {
-  /** Ordered list of strategies to attempt. First match wins. */strategies: AuthStrategy[];
+  /** Ordered list of strategies to attempt. First match wins. */
+  strategies: AuthStrategy[];
   jwt?: JwtOptions;
   apiToken?: ApiTokenOptions;
   system?: SystemOptions;
@@ -91,7 +92,7 @@ type AuthMiddlewareOptions = {
  * header, RFC 9728 when `resourceMetadataUrl` is set) for missing/invalid
  * tokens, and `403` when a verified token is missing a required scope.
  */
-declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
+export declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context, next: Next) => Promise<void>;
 //#endregion
 //#region src/emailAuth.d.ts
 /**
@@ -128,7 +129,7 @@ declare const authMiddleware: (options: AuthMiddlewareOptions) => (ctx: Context,
  * );
  * ```
  */
-declare const emailAuth: (options: EmailAuthOptions$1 & {
+export declare const emailAuth: (options: EmailAuthOptions$1 & {
   /**
    * Prefix applied to every mounted path, e.g. `/v1`. Useful when the app
    * versions its API and the engine's default paths are otherwise fine.
@@ -156,7 +157,7 @@ declare const emailAuth: (options: EmailAuthOptions$1 & {
  * app.use(oauthServer({ issuer, clientStore, authCodeStore, issueTokens, onAuthorize }).routes());
  * ```
  */
-declare const oauthServer: (options: OAuthServerOptions$1) => Router;
+export declare const oauthServer: (options: OAuthServerOptions$1) => Router;
 /**
  * Koa middleware that serves the RFC 9728 Protected Resource Metadata
  * document. Mount it **before** `authMiddleware` so the discovery endpoint
@@ -166,9 +167,12 @@ declare const oauthServer: (options: OAuthServerOptions$1) => Router;
  * the resource: the root, plus the path-derived location of RFC 9728 §3.1 when
  * the resource identifier carries a path.
  */
-declare const createProtectedResourceMetadataMiddleware: (args: {
-  /** The protected resource's identifier URI. */resource: string; /** Authorization server issuer URIs that issue tokens for this resource. */
-  authorizationServers: string[]; /** Scopes this resource accepts, advertised as `scopes_supported`. */
+export declare const createProtectedResourceMetadataMiddleware: (args: {
+  /** The protected resource's identifier URI. */
+  resource: string;
+  /** Authorization server issuer URIs that issue tokens for this resource. */
+  authorizationServers: string[];
+  /** Scopes this resource accepts, advertised as `scopes_supported`. */
   scopesSupported?: string[];
 }) => Middleware;
 //#endregion
@@ -177,7 +181,7 @@ declare const createProtectedResourceMetadataMiddleware: (args: {
  * Returns true if origin matches any entry in the allowlist.
  * Strings are compared exactly; RegExps are tested.
  */
-declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
+export declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | RegExp | undefined>) => boolean;
 //#endregion
 //#region src/requireAuth.d.ts
 /**
@@ -187,6 +191,6 @@ declare const isOriginAllowed: (origin: string, allowedOrigins: Array<string | R
  * @example
  * router.get('/me', requireAuth({ strategies: ['jwt', 'apiToken'] }), handler);
  */
-declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
+export declare const requireAuth: (options: AuthMiddlewareOptions) => ((ctx: Context, next: Next) => Promise<void>);
 //#endregion
-export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, authMiddleware, createEmailAuthHandlers, createOAuthHandlers, createProtectedResourceMetadataMiddleware, emailAuth, emailAuthErrorCodes, getWwwAuthenticateHeader, isOriginAllowed, normalizeEmail, oauthServer, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl, requireAuth };
+export { type ApiTokenOptions, type AuthCodeStore, type AuthMiddlewareOptions, type AuthStrategy, type AuthenticatedUser, type AuthorizeRequest, type ClientStore, type EmailAuthDelivery, type EmailAuthErrorCode, type EmailAuthHandler, type EmailAuthHandlers, type EmailAuthHooks, type EmailAuthMode, type EmailAuthOptions, type EmailAuthPaths, type EmailAuthSession, type EmailAuthTtl, type EmailAuthUser, type EmailAuthUserStore, type EmailCodeOptions, type IssueTokensArgs, type IssuedTokens, type JwtOptions, type OAuthClient, type OAuthClientMetadata, type OAuthHandlers, type OAuthOptions, type OAuthServerOptions, type OnAuthorizeArgs, type OnAuthorizeResult, type OnRefreshTokenArgs, type OnRefreshTokenResult, type OneTimeTokenPurpose, type OneTimeTokenStore, type PasswordOptions, type ProtectedResourceMetadata, type RequestRateLimit, type RequestRateLimitStore, type StoredAuthorizationCode, type StoredOneTimeToken, type SystemOptions, createEmailAuthHandlers, createOAuthHandlers, emailAuthErrorCodes, getWwwAuthenticateHeader, normalizeEmail, protectedResourceMetadataDocument, protectedResourceMetadataPaths, protectedResourceMetadataUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-auth",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Authentication middleware for @ttoss/http-server",
   "keywords": [
     "auth",
@@ -32,18 +32,18 @@
     "dist"
   ],
   "dependencies": {
-    "@ttoss/auth-core": "^0.18.0"
+    "@ttoss/auth-core": "^0.20.0"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",
-    "jest": "^30.4.2",
-    "supertest": "^7.2.2",
-    "tsdown": "^0.22.2",
-    "@ttoss/config": "^1.41.0",
-    "@ttoss/http-server": "^0.13.1"
+    "jest": "^30.5.2",
+    "supertest": "^7.3.1",
+    "tsdown": "^0.23.1",
+    "@ttoss/http-server": "^0.14.1",
+    "@ttoss/config": "^3.0.0"
   },
   "peerDependencies": {
-    "@ttoss/http-server": "^0.13.1"
+    "@ttoss/http-server": "^0.14.1"
   },
   "publishConfig": {
     "access": "public",