@twasik4/pocket-service 1.0.0 → 1.0.1

package/README.md

@@ -222,6 +222,62 @@ addRoute(
 export { router as AuthRouter, routes as AuthRoutes };
 ```
 
+6. withAuthStrategy() / withAuthStrategies()
+
+Use these hooks to plug in JWT, mTLS, or custom auth behavior while keeping route-level `requireAuth` unchanged.
+
+```ts
+import {
+  Service,
+  createJoseJwtVerifier,
+  createJwtAuthStrategy,
+  createMtlsAuthStrategy,
+} from "@twasik4/pocket-service";
+
+const mtlsStrategy = createMtlsAuthStrategy({
+  requireAuthorized: true,
+});
+
+const jwtStrategy = createJwtAuthStrategy({
+  verifyToken: createJoseJwtVerifier({
+    jwksUri: "http://auth-service:3101/.well-known/jwks.json",
+    issuer: "auth-service",
+    audience: "gateway-service",
+  }),
+});
+
+const service = new Service()
+  .withAuthStrategies([mtlsStrategy, jwtStrategy])
+  .withoutDefaultHeaderAuthFallback()
+  .build();
+```
+
+If you use HMAC-signed tokens instead of JWKS:
+
+```ts
+import {
+  Service,
+  createJoseJwtVerifier,
+  createJwtAuthStrategy,
+} from "@twasik4/pocket-service";
+
+const jwtStrategy = createJwtAuthStrategy({
+  verifyToken: createJoseJwtVerifier({
+    secret: process.env.INTERNAL_JWT_SECRET!,
+    issuer: "auth-service",
+    audience: "gateway-service",
+    algorithms: ["HS256"],
+  }),
+});
+
+const service = new Service()
+  .withAuthStrategy(jwtStrategy)
+  .withoutDefaultHeaderAuthFallback()
+  .build();
+```
+
+Default behavior remains backward compatible. If no strategy authenticates and fallback is enabled, the service still reads `x-user-id` / `x-user-meta` headers.
+
 ### Methods
 
 1. shutdown()