@vorionsys/platform-core 0.1.0

package/dist/auth/piv-cac/piv-middleware.d.ts

@@ -0,0 +1,95 @@
+/**
+ * PIV/CAC Fastify Middleware
+ *
+ * Fastify middleware and plugin for PIV/CAC smart card authentication.
+ *
+ * Features:
+ * - Certificate extraction from headers
+ * - Certificate validation
+ * - User identity mapping
+ * - Session binding
+ * - Card removal monitoring
+ *
+ * @packageDocumentation
+ */
+import type { FastifyRequest, FastifyPluginCallback, preHandlerHookHandler } from 'fastify';
+import { type PIVCACConfig, type PIVAuthContext, type PIVMiddlewareOptions, type MappedUserIdentity } from './types.js';
+import { CertificateAuthService } from './certificate-auth.js';
+import { OCSPValidator } from './ocsp-validator.js';
+import { CRLValidator } from './crl-validator.js';
+import { CertificateMapper } from './certificate-mapper.js';
+import { CardRemovalHandler } from './card-removal-handler.js';
+/**
+ * PIV authentication service bundle
+ */
+export interface PIVAuthServices {
+    certAuth: CertificateAuthService;
+    ocspValidator: OCSPValidator;
+    crlValidator: CRLValidator;
+    certificateMapper: CertificateMapper;
+    cardRemovalHandler: CardRemovalHandler;
+}
+/**
+ * PIV plugin options
+ */
+export interface PIVPluginOptions extends PIVMiddlewareOptions {
+    /** PIV/CAC configuration */
+    config?: Partial<PIVCACConfig>;
+    /** Pre-initialized services */
+    services?: Partial<PIVAuthServices>;
+    /** Enable metrics */
+    enableMetrics?: boolean;
+}
+declare module 'fastify' {
+    interface FastifyRequest {
+        pivAuth?: PIVAuthContext;
+    }
+    interface FastifyInstance {
+        pivAuthServices?: PIVAuthServices;
+    }
+}
+/**
+ * Create PIV authentication middleware
+ */
+export declare function pivAuthMiddleware(services: PIVAuthServices, config: PIVCACConfig, options?: PIVMiddlewareOptions): preHandlerHookHandler;
+/**
+ * PIV authentication Fastify plugin
+ */
+export declare const pivAuthPlugin: FastifyPluginCallback<PIVPluginOptions>;
+/**
+ * Require PIV authentication middleware
+ */
+export declare function requirePIVAuth(): preHandlerHookHandler;
+/**
+ * Require specific certificate attribute middleware
+ */
+export declare function requireCertificateAttribute(attribute: string, pattern?: RegExp): preHandlerHookHandler;
+/**
+ * Require EDIPI (DoD ID) middleware
+ */
+export declare function requireEDIPI(): preHandlerHookHandler;
+/**
+ * Get PIV auth context from request
+ */
+export declare function getPIVAuth(request: FastifyRequest): PIVAuthContext | undefined;
+/**
+ * Check if request has PIV authentication
+ */
+export declare function hasPIVAuth(request: FastifyRequest): boolean;
+/**
+ * Get PIV user from request
+ */
+export declare function getPIVUser(request: FastifyRequest): MappedUserIdentity | undefined;
+/**
+ * Get PIV user ID from request
+ */
+export declare function getPIVUserId(request: FastifyRequest): string | undefined;
+/**
+ * Get certificate fingerprint from request
+ */
+export declare function getCertificateFingerprint(request: FastifyRequest): string | undefined;
+/**
+ * Get EDIPI from request
+ */
+export declare function getEDIPI(request: FastifyRequest): string | undefined;
+//# sourceMappingURL=piv-middleware.d.ts.map

package/dist/auth/piv-cac/piv-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piv-middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/piv-cac/piv-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAEV,cAAc,EAEd,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,SAAS,CAAC;AAKjB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EAMxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAmB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAuC,MAAM,2BAA2B,CAAC;AAkCpG;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,sBAAsB,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,oBAAoB;IAC5D,4BAA4B;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC,qBAAqB;IACrB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B;IAED,UAAU,eAAe;QACvB,eAAe,CAAC,EAAE,eAAe,CAAC;KACnC;CACF;AAMD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,oBAAyB,GACjC,qBAAqB,CA6MvB;AAwPD;;GAEG;AACH,eAAO,MAAM,aAAa,yCAGxB,CAAC;AAMH;;GAEG;AACH,wBAAgB,cAAc,IAAI,qBAAqB,CAWtD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,qBAAqB,CA+BvB;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,qBAAqB,CAoBpD;AAMD;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAE9E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAE3D;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAElF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAErF;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAEpE"}

package/dist/auth/piv-cac/piv-middleware.js

@@ -0,0 +1,524 @@
+/**
+ * PIV/CAC Fastify Middleware
+ *
+ * Fastify middleware and plugin for PIV/CAC smart card authentication.
+ *
+ * Features:
+ * - Certificate extraction from headers
+ * - Certificate validation
+ * - User identity mapping
+ * - Session binding
+ * - Card removal monitoring
+ *
+ * @packageDocumentation
+ */
+import fp from 'fastify-plugin';
+import { Counter, Histogram } from 'prom-client';
+import { createLogger } from '../../common/logger.js';
+import { vorionRegistry } from '../../common/metrics-registry.js';
+import { CertificateValidationStatus, RevocationCheckMethod, PIVErrorCode, DEFAULT_PIVCAC_CONFIG, } from './types.js';
+import { parseCertificate, parseCertificateChain, getCertificateAuthService, } from './certificate-auth.js';
+import { getOCSPValidator } from './ocsp-validator.js';
+import { getCRLValidator } from './crl-validator.js';
+import { getCertificateMapper } from './certificate-mapper.js';
+import { getCardRemovalHandler } from './card-removal-handler.js';
+const logger = createLogger({ component: 'piv-middleware' });
+// =============================================================================
+// Metrics
+// =============================================================================
+const pivAuthAttempts = new Counter({
+    name: 'vorion_piv_auth_attempts_total',
+    help: 'Total PIV/CAC authentication attempts',
+    labelNames: ['status', 'error_code'],
+    registers: [vorionRegistry],
+});
+const pivAuthDuration = new Histogram({
+    name: 'vorion_piv_auth_duration_seconds',
+    help: 'Duration of PIV/CAC authentication',
+    labelNames: ['status'],
+    buckets: [0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+    registers: [vorionRegistry],
+});
+const certificateValidation = new Counter({
+    name: 'vorion_piv_certificate_validation_total',
+    help: 'Certificate validation results',
+    labelNames: ['status', 'revocation_method'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Middleware
+// =============================================================================
+/**
+ * Create PIV authentication middleware
+ */
+export function pivAuthMiddleware(services, config, options = {}) {
+    const skipPaths = new Set(options.skipPaths ?? []);
+    const requiredPaths = new Set(options.requiredPaths ?? []);
+    const certHeader = options.certificateHeader ?? 'x-client-certificate';
+    const chainHeader = options.certificateChainHeader ?? 'x-client-certificate-chain';
+    return async (request, reply) => {
+        const startTime = Date.now();
+        const path = request.routeOptions.url ?? request.url;
+        // Initialize context
+        request.pivAuth = {
+            isPIVAuthenticated: false,
+        };
+        // Skip if path is in skip list
+        if (skipPaths.has(path)) {
+            return;
+        }
+        // Check if PIV is required for this path
+        const isRequired = requiredPaths.size === 0 || requiredPaths.has(path);
+        try {
+            // Extract certificate from headers
+            const certPem = extractCertificateFromRequest(request, certHeader);
+            const chainPem = request.headers[chainHeader];
+            if (!certPem) {
+                if (isRequired) {
+                    pivAuthAttempts.inc({ status: 'missing', error_code: 'CERTIFICATE_MISSING' });
+                    return reply.status(401).send({
+                        error: {
+                            code: PIVErrorCode.CERTIFICATE_MISSING,
+                            message: 'Client certificate required',
+                        },
+                    });
+                }
+                return;
+            }
+            // Parse certificate
+            const certificate = parseCertificate(certPem);
+            const chain = chainPem ? parseCertificateChain(chainPem) : [];
+            // Validate certificate
+            const validation = await services.certAuth.validateCertificate(certificate, chain);
+            // Check revocation status if validation passed
+            if (validation.isValid) {
+                await checkRevocationStatus(services, config, certificate, chain, validation);
+            }
+            // Update metrics
+            certificateValidation.inc({
+                status: validation.status,
+                revocation_method: config.revocationMethod,
+            });
+            if (!validation.isValid) {
+                pivAuthAttempts.inc({
+                    status: 'invalid',
+                    error_code: validation.status,
+                });
+                if (isRequired) {
+                    const errorResponse = createValidationErrorResponse(validation);
+                    if (options.onFailure) {
+                        await options.onFailure(new Error(validation.errors[0] || 'Certificate validation failed'), request, reply);
+                        return;
+                    }
+                    return reply.status(401).send(errorResponse);
+                }
+                // Not required, continue with partial context
+                request.pivAuth = {
+                    isPIVAuthenticated: false,
+                    certificate,
+                    validation,
+                };
+                return;
+            }
+            // Map certificate to user identity
+            let user;
+            try {
+                user = services.certificateMapper.mapCertificate(certificate);
+                // Custom user lookup if provided
+                if (options.userLookup) {
+                    const userData = await options.userLookup(user);
+                    if (!userData) {
+                        throw new Error('User not found');
+                    }
+                    // Merge additional user data
+                    user.attributes = { ...user.attributes, ...userData };
+                }
+            }
+            catch (error) {
+                pivAuthAttempts.inc({ status: 'mapping_failed', error_code: 'USER_MAPPING_FAILED' });
+                if (isRequired) {
+                    if (options.onFailure) {
+                        await options.onFailure(error instanceof Error ? error : new Error('User mapping failed'), request, reply);
+                        return;
+                    }
+                    return reply.status(401).send({
+                        error: {
+                            code: PIVErrorCode.USER_MAPPING_FAILED,
+                            message: 'Failed to map certificate to user identity',
+                        },
+                    });
+                }
+                request.pivAuth = {
+                    isPIVAuthenticated: false,
+                    certificate,
+                    validation,
+                };
+                return;
+            }
+            // Check for existing session binding
+            const sessionId = request.headers['x-piv-session-id'];
+            let sessionBinding;
+            if (sessionId) {
+                try {
+                    services.cardRemovalHandler.validateSession(sessionId);
+                    sessionBinding = services.cardRemovalHandler.getSessionBinding(sessionId);
+                    services.cardRemovalHandler.updateSessionActivity(sessionId);
+                }
+                catch (error) {
+                    // Session invalid, will create new one if needed
+                    logger.debug({ sessionId, error }, 'PIV session validation failed');
+                }
+            }
+            // Build auth context
+            request.pivAuth = {
+                isPIVAuthenticated: true,
+                user,
+                certificate,
+                validation,
+                sessionBinding,
+            };
+            // Call success handler if provided
+            if (options.onSuccess) {
+                await options.onSuccess(request.pivAuth, request);
+            }
+            pivAuthAttempts.inc({ status: 'success', error_code: 'none' });
+            const duration = (Date.now() - startTime) / 1000;
+            pivAuthDuration.observe({ status: 'success' }, duration);
+            logger.info({
+                userId: user.userId,
+                fingerprint: certificate.fingerprint.substring(0, 16),
+                sessionId,
+            }, 'PIV authentication successful');
+        }
+        catch (error) {
+            const duration = (Date.now() - startTime) / 1000;
+            pivAuthDuration.observe({ status: 'error' }, duration);
+            pivAuthAttempts.inc({
+                status: 'error',
+                error_code: 'INTERNAL_ERROR',
+            });
+            logger.error({ error }, 'PIV authentication error');
+            if (options.onFailure) {
+                await options.onFailure(error instanceof Error ? error : new Error(String(error)), request, reply);
+                return;
+            }
+            if (isRequired) {
+                return reply.status(500).send({
+                    error: {
+                        code: PIVErrorCode.INTERNAL_ERROR,
+                        message: 'Authentication processing error',
+                    },
+                });
+            }
+        }
+    };
+}
+/**
+ * Check revocation status using OCSP and/or CRL
+ */
+async function checkRevocationStatus(services, config, certificate, chain, validation) {
+    // Find issuer certificate
+    const issuer = chain.find((c) => c.subject.full === certificate.issuer.full);
+    if (!issuer) {
+        validation.warnings.push('Issuer certificate not in chain, skipping revocation check');
+        return;
+    }
+    switch (config.revocationMethod) {
+        case RevocationCheckMethod.OCSP:
+            await checkOCSP(services.ocspValidator, certificate, issuer, validation);
+            break;
+        case RevocationCheckMethod.CRL:
+            await checkCRL(services.crlValidator, certificate, issuer, validation);
+            break;
+        case RevocationCheckMethod.BOTH:
+            await Promise.all([
+                checkOCSP(services.ocspValidator, certificate, issuer, validation),
+                checkCRL(services.crlValidator, certificate, issuer, validation),
+            ]);
+            break;
+        case RevocationCheckMethod.OCSP_WITH_CRL_FALLBACK:
+            try {
+                await checkOCSP(services.ocspValidator, certificate, issuer, validation);
+            }
+            catch (error) {
+                logger.warn({ error }, 'OCSP check failed, falling back to CRL');
+                await checkCRL(services.crlValidator, certificate, issuer, validation);
+            }
+            break;
+        case RevocationCheckMethod.NONE:
+            validation.warnings.push('Revocation checking is disabled');
+            break;
+    }
+}
+/**
+ * Check OCSP revocation status
+ */
+async function checkOCSP(validator, certificate, issuer, validation) {
+    try {
+        const ocspResponse = await validator.checkRevocationStatus(certificate, issuer);
+        if (ocspResponse.status === 'revoked') {
+            validation.isValid = false;
+            validation.status = CertificateValidationStatus.REVOKED;
+            validation.errors.push(`Certificate revoked via OCSP: ${ocspResponse.revocationReason || 'unknown reason'}`);
+        }
+    }
+    catch (error) {
+        if (!validator.getConfig().softFail) {
+            throw error;
+        }
+        logger.warn({ error }, 'OCSP check failed (soft-fail mode)');
+    }
+}
+/**
+ * Check CRL revocation status
+ */
+async function checkCRL(validator, certificate, issuer, validation) {
+    try {
+        const result = await validator.checkRevocationStatus(certificate, issuer);
+        if (result.revoked) {
+            validation.isValid = false;
+            validation.status = CertificateValidationStatus.REVOKED;
+            validation.errors.push(`Certificate revoked via CRL: ${result.entry?.reason || 'unknown reason'}`);
+        }
+    }
+    catch (error) {
+        if (!validator.getConfig().softFail) {
+            throw error;
+        }
+        logger.warn({ error }, 'CRL check failed (soft-fail mode)');
+    }
+}
+/**
+ * Extract certificate from request
+ */
+function extractCertificateFromRequest(request, headerName) {
+    // Check header
+    let certValue = request.headers[headerName.toLowerCase()];
+    if (!certValue) {
+        // Check TLS connection for client certificate
+        const tlsSocket = request.raw?.socket;
+        if (tlsSocket?.getPeerCertificate) {
+            const peerCert = tlsSocket.getPeerCertificate(true);
+            if (peerCert?.raw) {
+                certValue = `-----BEGIN CERTIFICATE-----\n${peerCert.raw.toString('base64')}\n-----END CERTIFICATE-----`;
+            }
+        }
+    }
+    if (!certValue) {
+        return undefined;
+    }
+    // URL decode if necessary
+    if (certValue.includes('%')) {
+        certValue = decodeURIComponent(certValue);
+    }
+    return certValue;
+}
+/**
+ * Create error response for validation failure
+ */
+function createValidationErrorResponse(validation) {
+    const errorCode = mapValidationStatusToErrorCode(validation.status);
+    return {
+        error: {
+            code: errorCode,
+            message: getValidationErrorMessage(validation.status),
+            details: validation.errors.length > 0 ? validation.errors : undefined,
+        },
+    };
+}
+/**
+ * Map validation status to error code
+ */
+function mapValidationStatusToErrorCode(status) {
+    switch (status) {
+        case CertificateValidationStatus.EXPIRED:
+            return PIVErrorCode.CERTIFICATE_EXPIRED;
+        case CertificateValidationStatus.NOT_YET_VALID:
+            return PIVErrorCode.CERTIFICATE_NOT_YET_VALID;
+        case CertificateValidationStatus.REVOKED:
+            return PIVErrorCode.CERTIFICATE_REVOKED;
+        case CertificateValidationStatus.CHAIN_INVALID:
+            return PIVErrorCode.CERTIFICATE_CHAIN_INVALID;
+        case CertificateValidationStatus.SIGNATURE_INVALID:
+            return PIVErrorCode.CERTIFICATE_SIGNATURE_INVALID;
+        default:
+            return PIVErrorCode.INTERNAL_ERROR;
+    }
+}
+/**
+ * Get user-friendly error message
+ */
+function getValidationErrorMessage(status) {
+    switch (status) {
+        case CertificateValidationStatus.EXPIRED:
+            return 'Certificate has expired';
+        case CertificateValidationStatus.NOT_YET_VALID:
+            return 'Certificate is not yet valid';
+        case CertificateValidationStatus.REVOKED:
+            return 'Certificate has been revoked';
+        case CertificateValidationStatus.CHAIN_INVALID:
+            return 'Certificate chain validation failed';
+        case CertificateValidationStatus.SIGNATURE_INVALID:
+            return 'Certificate signature is invalid';
+        default:
+            return 'Certificate validation failed';
+    }
+}
+// =============================================================================
+// Fastify Plugin
+// =============================================================================
+/**
+ * PIV authentication Fastify plugin
+ */
+const pivAuthPluginCallback = (fastify, options, done) => {
+    try {
+        // Merge configuration
+        const config = {
+            ...DEFAULT_PIVCAC_CONFIG,
+            ...options.config,
+        };
+        // Initialize services
+        const services = {
+            certAuth: options.services?.certAuth ?? getCertificateAuthService(config),
+            ocspValidator: options.services?.ocspValidator ?? getOCSPValidator(config.ocsp),
+            crlValidator: options.services?.crlValidator ?? getCRLValidator(config.crl),
+            certificateMapper: options.services?.certificateMapper ?? getCertificateMapper(config.mappingRules),
+            cardRemovalHandler: options.services?.cardRemovalHandler ?? getCardRemovalHandler(config.cardRemovalPolicy),
+        };
+        // Decorate fastify with services
+        fastify.decorate('pivAuthServices', services);
+        // Add pre-handler hook
+        if (config.enabled) {
+            fastify.addHook('preHandler', pivAuthMiddleware(services, config, options));
+        }
+        logger.info({
+            enabled: config.enabled,
+            revocationMethod: config.revocationMethod,
+            dodPkiCompatibility: config.dodPkiCompatibility,
+        }, 'PIV authentication plugin registered');
+        done();
+    }
+    catch (error) {
+        done(error instanceof Error ? error : new Error(String(error)));
+    }
+};
+/**
+ * PIV authentication Fastify plugin
+ */
+export const pivAuthPlugin = fp(pivAuthPluginCallback, {
+    name: 'vorion-piv-auth',
+    fastify: '5.x',
+});
+// =============================================================================
+// Helper Middleware
+// =============================================================================
+/**
+ * Require PIV authentication middleware
+ */
+export function requirePIVAuth() {
+    return async (request, reply) => {
+        if (!request.pivAuth?.isPIVAuthenticated) {
+            return reply.status(401).send({
+                error: {
+                    code: PIVErrorCode.CERTIFICATE_MISSING,
+                    message: 'PIV/CAC authentication required',
+                },
+            });
+        }
+    };
+}
+/**
+ * Require specific certificate attribute middleware
+ */
+export function requireCertificateAttribute(attribute, pattern) {
+    return async (request, reply) => {
+        if (!request.pivAuth?.isPIVAuthenticated) {
+            return reply.status(401).send({
+                error: {
+                    code: PIVErrorCode.CERTIFICATE_MISSING,
+                    message: 'PIV/CAC authentication required',
+                },
+            });
+        }
+        const value = request.pivAuth.user?.attributes[attribute];
+        if (!value) {
+            return reply.status(403).send({
+                error: {
+                    code: 'MISSING_ATTRIBUTE',
+                    message: `Required certificate attribute "${attribute}" not found`,
+                },
+            });
+        }
+        if (pattern && !pattern.test(value)) {
+            return reply.status(403).send({
+                error: {
+                    code: 'INVALID_ATTRIBUTE',
+                    message: `Certificate attribute "${attribute}" does not match required pattern`,
+                },
+            });
+        }
+    };
+}
+/**
+ * Require EDIPI (DoD ID) middleware
+ */
+export function requireEDIPI() {
+    return async (request, reply) => {
+        if (!request.pivAuth?.isPIVAuthenticated) {
+            return reply.status(401).send({
+                error: {
+                    code: PIVErrorCode.CERTIFICATE_MISSING,
+                    message: 'PIV/CAC authentication required',
+                },
+            });
+        }
+        if (!request.pivAuth.user?.edipi) {
+            return reply.status(403).send({
+                error: {
+                    code: 'EDIPI_REQUIRED',
+                    message: 'DoD EDIPI (Electronic Data Interchange Personal Identifier) required',
+                },
+            });
+        }
+    };
+}
+// =============================================================================
+// Request Helpers
+// =============================================================================
+/**
+ * Get PIV auth context from request
+ */
+export function getPIVAuth(request) {
+    return request.pivAuth;
+}
+/**
+ * Check if request has PIV authentication
+ */
+export function hasPIVAuth(request) {
+    return request.pivAuth?.isPIVAuthenticated ?? false;
+}
+/**
+ * Get PIV user from request
+ */
+export function getPIVUser(request) {
+    return request.pivAuth?.user;
+}
+/**
+ * Get PIV user ID from request
+ */
+export function getPIVUserId(request) {
+    return request.pivAuth?.user?.userId;
+}
+/**
+ * Get certificate fingerprint from request
+ */
+export function getCertificateFingerprint(request) {
+    return request.pivAuth?.certificate?.fingerprint;
+}
+/**
+ * Get EDIPI from request
+ */
+export function getEDIPI(request) {
+    return request.pivAuth?.user?.edipi;
+}
+//# sourceMappingURL=piv-middleware.js.map

package/dist/auth/piv-cac/piv-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"piv-middleware.js","sourceRoot":"","sources":["../../../src/auth/piv-cac/piv-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAML,2BAA2B,EAC3B,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,gBAAgB,EAChB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAiB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAgB,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAqB,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAsB,qBAAqB,EAAgB,MAAM,2BAA2B,CAAC;AAEpG,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAE7D,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC;IAClC,IAAI,EAAE,gCAAgC;IACtC,IAAI,EAAE,uCAAuC;IAC7C,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAU;IAC7C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,IAAI,SAAS,CAAC;IACpC,IAAI,EAAE,kCAAkC;IACxC,IAAI,EAAE,oCAAoC;IAC1C,UAAU,EAAE,CAAC,QAAQ,CAAU;IAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,IAAI,OAAO,CAAC;IACxC,IAAI,EAAE,yCAAyC;IAC/C,IAAI,EAAE,gCAAgC;IACtC,UAAU,EAAE,CAAC,QAAQ,EAAE,mBAAmB,CAAU;IACpD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AA2CH,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyB,EACzB,MAAoB,EACpB,UAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;IACvE,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,IAAI,4BAA4B,CAAC;IAEnF,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QAErD,qBAAqB;QACrB,OAAO,CAAC,OAAO,GAAG;YAChB,kBAAkB,EAAE,KAAK;SAC1B,CAAC;QAEF,+BAA+B;QAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvE,IAAI,CAAC;YACH,mCAAmC;YACnC,MAAM,OAAO,GAAG,6BAA6B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;YAEpE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,UAAU,EAAE,CAAC;oBACf,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBAE9E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE;4BACL,IAAI,EAAE,YAAY,CAAC,mBAAmB;4BACtC,OAAO,EAAE,6BAA6B;yBACvC;qBACF,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;YACT,CAAC;YAED,oBAAoB;YACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE9D,uBAAuB;YACvB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAEnF,+CAA+C;YAC/C,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YAChF,CAAC;YAED,iBAAiB;YACjB,qBAAqB,CAAC,GAAG,CAAC;gBACxB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,iBAAiB,EAAE,MAAM,CAAC,gBAAgB;aAC3C,CAAC,CAAC;YAEH,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,eAAe,CAAC,GAAG,CAAC;oBAClB,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,UAAU,CAAC,MAAM;iBAC9B,CAAC,CAAC;gBAEH,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,aAAa,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;oBAEhE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;wBACtB,MAAM,OAAO,CAAC,SAAS,CACrB,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,+BAA+B,CAAC,EAClE,OAAO,EACP,KAAK,CACN,CAAC;wBACF,OAAO;oBACT,CAAC;oBAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC/C,CAAC;gBAED,8CAA8C;gBAC9C,OAAO,CAAC,OAAO,GAAG;oBAChB,kBAAkB,EAAE,KAAK;oBACzB,WAAW;oBACX,UAAU;iBACX,CAAC;gBACF,OAAO;YACT,CAAC;YAED,mCAAmC;YACnC,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,GAAG,QAAQ,CAAC,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAE9D,iCAAiC;gBACjC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBACpC,CAAC;oBACD,6BAA6B;oBAC7B,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,EAA4B,CAAC;gBAClF,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBAErF,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;wBACtB,MAAM,OAAO,CAAC,SAAS,CACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,EACjE,OAAO,EACP,KAAK,CACN,CAAC;wBACF,OAAO;oBACT,CAAC;oBAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE;4BACL,IAAI,EAAE,YAAY,CAAC,mBAAmB;4BACtC,OAAO,EAAE,4CAA4C;yBACtD;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,CAAC,OAAO,GAAG;oBAChB,kBAAkB,EAAE,KAAK;oBACzB,WAAW;oBACX,UAAU;iBACX,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qCAAqC;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAuB,CAAC;YAC5E,IAAI,cAA8C,CAAC;YAEnD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC;oBACH,QAAQ,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;oBACvD,cAAc,GAAG,QAAQ,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;oBAC1E,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,iDAAiD;oBACjD,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,qBAAqB;YACrB,OAAO,CAAC,OAAO,GAAG;gBAChB,kBAAkB,EAAE,IAAI;gBACxB,IAAI;gBACJ,WAAW;gBACX,UAAU;gBACV,cAAc;aACf,CAAC;YAEF,mCAAmC;YACnC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC;YAED,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAE/D,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzD,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;gBACrD,SAAS;aACV,EACD,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACjD,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEvD,eAAe,CAAC,GAAG,CAAC;gBAClB,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,gBAAgB;aAC7B,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAEpD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,OAAO,CAAC,SAAS,CACrB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,OAAO,EACP,KAAK,CACN,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC5B,KAAK,EAAE;wBACL,IAAI,EAAE,YAAY,CAAC,cAAc;wBACjC,OAAO,EAAE,iCAAiC;qBAC3C;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAAyB,EACzB,MAAoB,EACpB,WAAgD,EAChD,KAA+C,EAC/C,UAA2G;IAE3G,0BAA0B;IAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,QAAQ,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAChC,KAAK,qBAAqB,CAAC,IAAI;YAC7B,MAAM,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACzE,MAAM;QAER,KAAK,qBAAqB,CAAC,GAAG;YAC5B,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACvE,MAAM;QAER,KAAK,qBAAqB,CAAC,IAAI;YAC7B,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;gBAClE,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC;aACjE,CAAC,CAAC;YACH,MAAM;QAER,KAAK,qBAAqB,CAAC,sBAAsB;YAC/C,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,wCAAwC,CAAC,CAAC;gBACjE,MAAM,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACzE,CAAC;YACD,MAAM;QAER,KAAK,qBAAqB,CAAC,IAAI;YAC7B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC5D,MAAM;IACV,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CACtB,SAAwB,EACxB,WAAgD,EAChD,MAA2C,EAC3C,UAAuF;IAEvF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAEhF,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,UAAU,CAAC,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC;YACxD,UAAU,CAAC,MAAM,CAAC,IAAI,CACpB,iCAAiC,YAAY,CAAC,gBAAgB,IAAI,gBAAgB,EAAE,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CACrB,SAAuB,EACvB,WAAgD,EAChD,MAA2C,EAC3C,UAAuF;IAEvF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAE1E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,UAAU,CAAC,OAAO,GAAG,KAAK,CAAC;YAC3B,UAAU,CAAC,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC;YACxD,UAAU,CAAC,MAAM,CAAC,IAAI,CACpB,gCAAgC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,gBAAgB,EAAE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,6BAA6B,CACpC,OAAuB,EACvB,UAAkB;IAElB,eAAe;IACf,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAuB,CAAC;IAEhF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,8CAA8C;QAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,MAA6C,CAAC;QAC7E,IAAI,SAAS,EAAE,kBAAkB,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,QAAQ,EAAE,GAAG,EAAE,CAAC;gBAClB,SAAS,GAAG,gCAAgC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YAC3G,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,0BAA0B;IAC1B,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,6BAA6B,CAAC,UAGtC;IACC,MAAM,SAAS,GAAG,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEpE,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC;YACrD,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SACtE;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B,CAAC,MAAmC;IACzE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,2BAA2B,CAAC,OAAO;YACtC,OAAO,YAAY,CAAC,mBAAmB,CAAC;QAC1C,KAAK,2BAA2B,CAAC,aAAa;YAC5C,OAAO,YAAY,CAAC,yBAAyB,CAAC;QAChD,KAAK,2BAA2B,CAAC,OAAO;YACtC,OAAO,YAAY,CAAC,mBAAmB,CAAC;QAC1C,KAAK,2BAA2B,CAAC,aAAa;YAC5C,OAAO,YAAY,CAAC,yBAAyB,CAAC;QAChD,KAAK,2BAA2B,CAAC,iBAAiB;YAChD,OAAO,YAAY,CAAC,6BAA6B,CAAC;QACpD;YACE,OAAO,YAAY,CAAC,cAAc,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,MAAmC;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,2BAA2B,CAAC,OAAO;YACtC,OAAO,yBAAyB,CAAC;QACnC,KAAK,2BAA2B,CAAC,aAAa;YAC5C,OAAO,8BAA8B,CAAC;QACxC,KAAK,2BAA2B,CAAC,OAAO;YACtC,OAAO,8BAA8B,CAAC;QACxC,KAAK,2BAA2B,CAAC,aAAa;YAC5C,OAAO,qCAAqC,CAAC;QAC/C,KAAK,2BAA2B,CAAC,iBAAiB;YAChD,OAAO,kCAAkC,CAAC;QAC5C;YACE,OAAO,+BAA+B,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,qBAAqB,GAA4C,CACrE,OAAwB,EACxB,OAAyB,EACzB,IAA2B,EAC3B,EAAE;IACF,IAAI,CAAC;QACH,sBAAsB;QACtB,MAAM,MAAM,GAAiB;YAC3B,GAAG,qBAAqB;YACxB,GAAG,OAAO,CAAC,MAAM;SAClB,CAAC;QAEF,sBAAsB;QACtB,MAAM,QAAQ,GAAoB;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,IAAI,yBAAyB,CAAC,MAAM,CAAC;YACzE,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;YAC/E,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3E,iBAAiB,EACf,OAAO,CAAC,QAAQ,EAAE,iBAAiB,IAAI,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC;YAClF,kBAAkB,EAChB,OAAO,CAAC,QAAQ,EAAE,kBAAkB,IAAI,qBAAqB,CAAC,MAAM,CAAC,iBAAiB,CAAC;SAC1F,CAAC;QAEF,iCAAiC;QACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QAE9C,uBAAuB;QACvB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;SAChD,EACD,sCAAsC,CACvC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,qBAAqB,EAAE;IACrD,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,YAAY,CAAC,mBAAmB;oBACtC,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAiB,EACjB,OAAgB;IAEhB,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,YAAY,CAAC,mBAAmB;oBACtC,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mCAAmC,SAAS,aAAa;iBACnE;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,0BAA0B,SAAS,mCAAmC;iBAChF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAiB,EAAE;QAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,YAAY,CAAC,mBAAmB;oBACtC,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,sEAAsE;iBAChF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,OAAO,OAAO,CAAC,OAAO,EAAE,kBAAkB,IAAI,KAAK,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB;IAChD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB;IAClD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAuB;IAC/D,OAAO,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAuB;IAC9C,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;AACtC,CAAC"}

package/dist/auth/piv-cac/piv-routes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * PIV/CAC Authentication Routes
+ *
+ * Fastify routes for PIV/CAC smart card authentication endpoints.
+ *
+ * Endpoints:
+ * - POST /auth/piv/authenticate - Authenticate with certificate
+ * - POST /auth/piv/challenge - Generate challenge for card
+ * - POST /auth/piv/verify - Verify signed challenge
+ * - GET /auth/piv/session - Get session info
+ * - DELETE /auth/piv/session - Terminate session
+ * - GET /auth/piv/status - Check PIV auth status
+ *
+ * @packageDocumentation
+ */
+import type { FastifyInstance } from 'fastify';
+/**
+ * Register PIV/CAC authentication routes
+ */
+export declare function registerPIVRoutes(fastify: FastifyInstance, options?: {
+    prefix?: string;
+}): Promise<void>;
+/**
+ * PIV routes plugin
+ */
+export declare function pivRoutesPlugin(fastify: FastifyInstance, options?: {
+    prefix?: string;
+}): Promise<void>;
+//# sourceMappingURL=piv-routes.d.ts.map