@webpieces/http-routing 0.3.305 → 0.3.306

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.305",
+  "version": "0.3.306",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,8 +22,8 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.305",
-    "@webpieces/core-util": "0.3.305",
+    "@webpieces/core-context": "0.3.306",
+    "@webpieces/core-util": "0.3.306",
     "inversify": "7.10.4",
     "minimatch": "10.0.1"
   }

package/src/AuthConfig.d.ts

@@ -1,30 +1,48 @@
+import { ContextKey } from '@webpieces/core-util';
 /**
- * Principal - the authenticated caller established by {@link AuthConfig.verifyJwt}.
- * Data-only structure (a class, per the webpieces guidelines).
+ * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the
+ * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).
  */
-export declare class Principal {
+export declare class ContextValue {
+    readonly key: ContextKey;
+    readonly value: unknown;
+    constructor(key: ContextKey, value: unknown);
+}
+/**
+ * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used
+ * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context
+ * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext
+ * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).
+ */
+export declare class AuthValues {
     readonly userId: string;
-    readonly claims: Record<string, unknown>;
-    constructor(userId: string, claims?: Record<string, unknown>);
+    readonly roles: string[];
+    readonly entries: ContextValue[];
+    constructor(userId: string, roles?: string[], entries?: ContextValue[]);
 }
 /**
- * AuthConfig - the app-provided verifiers the framework {@link AuthFilter} injects to enforce
- * each endpoint's AuthMode. It is an ABSTRACT CLASS (not a Symbol) so it is injected by type
- * (per the webpieces no-symbol-di-tokens guidance) and rebindable in tests.
+ * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce
+ * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)
+ * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:
  *
- * It is BOUND IN THE APP CONTAINER (appBindings) — remember the two containers: the framework
- * AuthFilter is resolved from the app child container, so the app's binding (or a test's
- * appOverrides rebind) is what it sees. Keeping the concrete verifiers here (not in http-routing)
- * means http-routing needs NO crypto / gcp-identity — it stays transport- and provider-neutral.
+ *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).
+ *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
+ *                       exercise the shared-secret path (and a negative test with a wrong key).
+ *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
+ *                       context entries). Minting a JWT is a controller concern (login), not here.
+ *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
+ *                       caller allow-list. Fully generic — the company base wires it to
+ *                       @webpieces/gcp-identity once, so apps never customize OIDC.
  *
- * A public-only server need not bind one (AuthFilter injects it @optional); a non-public route
- * with no AuthConfig bound fails fast.
+ * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter
+ * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig
+ * (or no value/plugin for its mode) fails fast.
  */
 export declare abstract class AuthConfig {
-    /** Verify a user JWT (kind:'jwt'); return the principal or throw HttpUnauthorizedError. */
-    abstract verifyJwt(token: string): Principal;
-    /** Verify a Google OIDC token from an allowed caller SA (kind:'oidc'); throw on failure. */
+    /** Expected shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. */
+    abstract readonly sharedSecrets: Record<string, string>;
+    /** Parse a user JWT (kind:'jwt'); return the auth values or throw HttpUnauthorizedError. */
+    abstract parseJwt(token: string): AuthValues;
+    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */
     abstract verifyOidc(token: string, callers: string[]): Promise<void>;
-    /** The expected shared secret for the given env var name (kind:'shared-secret'). */
-    abstract sharedSecret(secretEnv: string): string | undefined;
 }

package/src/AuthConfig.js

@@ -1,33 +1,55 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthConfig = exports.Principal = void 0;
+exports.AuthConfig = exports.AuthValues = exports.ContextValue = void 0;
 /**
- * Principal - the authenticated caller established by {@link AuthConfig.verifyJwt}.
- * Data-only structure (a class, per the webpieces guidelines).
+ * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the
+ * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).
  */
-class Principal {
+class ContextValue {
+    key;
+    value;
+    constructor(key, 
+    // webpieces-disable no-any-unknown -- context values are arbitrary app-defined data
+    value) {
+        this.key = key;
+        this.value = value;
+    }
+}
+exports.ContextValue = ContextValue;
+/**
+ * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used
+ * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context
+ * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext
+ * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).
+ */
+class AuthValues {
     userId;
-    claims;
-    constructor(userId, 
-    // webpieces-disable no-any-unknown -- JWT claims are an arbitrary provider-defined bag
-    claims = {}) {
+    roles;
+    entries;
+    constructor(userId, roles = [], entries = []) {
         this.userId = userId;
-        this.claims = claims;
+        this.roles = roles;
+        this.entries = entries;
     }
 }
-exports.Principal = Principal;
+exports.AuthValues = AuthValues;
 /**
- * AuthConfig - the app-provided verifiers the framework {@link AuthFilter} injects to enforce
- * each endpoint's AuthMode. It is an ABSTRACT CLASS (not a Symbol) so it is injected by type
- * (per the webpieces no-symbol-di-tokens guidance) and rebindable in tests.
+ * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce
+ * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)
+ * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:
  *
- * It is BOUND IN THE APP CONTAINER (appBindings) — remember the two containers: the framework
- * AuthFilter is resolved from the app child container, so the app's binding (or a test's
- * appOverrides rebind) is what it sees. Keeping the concrete verifiers here (not in http-routing)
- * means http-routing needs NO crypto / gcp-identity — it stays transport- and provider-neutral.
+ *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).
+ *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
+ *                       exercise the shared-secret path (and a negative test with a wrong key).
+ *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
+ *                       context entries). Minting a JWT is a controller concern (login), not here.
+ *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
+ *                       caller allow-list. Fully generic — the company base wires it to
+ *                       @webpieces/gcp-identity once, so apps never customize OIDC.
  *
- * A public-only server need not bind one (AuthFilter injects it @optional); a non-public route
- * with no AuthConfig bound fails fast.
+ * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter
+ * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig
+ * (or no value/plugin for its mode) fails fast.
  */
 class AuthConfig {
 }

package/src/AuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,SAAS;IAEE;IAEA;IAHpB,YACoB,MAAc;IAC9B,uFAAuF;IACvE,SAAkC,EAAE;QAFpC,WAAM,GAAN,MAAM,CAAQ;QAEd,WAAM,GAAN,MAAM,CAA8B;IACrD,CAAC;CACP;AAND,8BAMC;AAED;;;;;;;;;;;;GAYG;AACH,MAAsB,UAAU;CAS/B;AATD,gCASC","sourcesContent":["/**\n * Principal - the authenticated caller established by {@link AuthConfig.verifyJwt}.\n * Data-only structure (a class, per the webpieces guidelines).\n */\nexport class Principal {\n    constructor(\n        public readonly userId: string,\n        // webpieces-disable no-any-unknown -- JWT claims are an arbitrary provider-defined bag\n        public readonly claims: Record<string, unknown> = {},\n    ) {}\n}\n\n/**\n * AuthConfig - the app-provided verifiers the framework {@link AuthFilter} injects to enforce\n * each endpoint's AuthMode. It is an ABSTRACT CLASS (not a Symbol) so it is injected by type\n * (per the webpieces no-symbol-di-tokens guidance) and rebindable in tests.\n *\n * It is BOUND IN THE APP CONTAINER (appBindings) — remember the two containers: the framework\n * AuthFilter is resolved from the app child container, so the app's binding (or a test's\n * appOverrides rebind) is what it sees. Keeping the concrete verifiers here (not in http-routing)\n * means http-routing needs NO crypto / gcp-identity — it stays transport- and provider-neutral.\n *\n * A public-only server need not bind one (AuthFilter injects it @optional); a non-public route\n * with no AuthConfig bound fails fast.\n */\nexport abstract class AuthConfig {\n    /** Verify a user JWT (kind:'jwt'); return the principal or throw HttpUnauthorizedError. */\n    abstract verifyJwt(token: string): Principal;\n\n    /** Verify a Google OIDC token from an allowed caller SA (kind:'oidc'); throw on failure. */\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n\n    /** The expected shared secret for the given env var name (kind:'shared-secret'). */\n    abstract sharedSecret(secretEnv: string): string | undefined;\n}\n"]}
+{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACH,MAAa,YAAY;IAED;IAEA;IAHpB,YACoB,GAAe;IAC/B,oFAAoF;IACpE,KAAc;QAFd,QAAG,GAAH,GAAG,CAAY;QAEf,UAAK,GAAL,KAAK,CAAS;IAC/B,CAAC;CACP;AAND,oCAMC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAEC;IACA;IACA;IAHpB,YACoB,MAAc,EACd,QAAkB,EAAE,EACpB,UAA0B,EAAE;QAF5B,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QACpB,YAAO,GAAP,OAAO,CAAqB;IAC7C,CAAC;CACP;AAND,gCAMC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAsB,UAAU;CAS/B;AATD,gCASC","sourcesContent":["import { ContextKey } from '@webpieces/core-util';\n\n/**\n * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the\n * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).\n */\nexport class ContextValue {\n    constructor(\n        public readonly key: ContextKey,\n        // webpieces-disable no-any-unknown -- context values are arbitrary app-defined data\n        public readonly value: unknown,\n    ) {}\n}\n\n/**\n * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used\n * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context\n * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext\n * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).\n */\nexport class AuthValues {\n    constructor(\n        public readonly userId: string,\n        public readonly roles: string[] = [],\n        public readonly entries: ContextValue[] = [],\n    ) {}\n}\n\n/**\n * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce\n * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)\n * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:\n *\n *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).\n *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then\n *                       exercise the shared-secret path (and a negative test with a wrong key).\n *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,\n *                       context entries). Minting a JWT is a controller concern (login), not here.\n *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's\n *                       caller allow-list. Fully generic — the company base wires it to\n *                       @webpieces/gcp-identity once, so apps never customize OIDC.\n *\n * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter\n * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig\n * (or no value/plugin for its mode) fails fast.\n */\nexport abstract class AuthConfig {\n    /** Expected shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. */\n    abstract readonly sharedSecrets: Record<string, string>;\n\n    /** Parse a user JWT (kind:'jwt'); return the auth values or throw HttpUnauthorizedError. */\n    abstract parseJwt(token: string): AuthValues;\n\n    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n}\n"]}

package/src/filters/AuthFilter.d.ts

@@ -2,14 +2,19 @@ import { Filter, WpResponse, Service } from '../Filter';
 import { MethodMeta } from '../MethodMeta';
 import { AuthConfig } from '../AuthConfig';
 /**
- * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on
- * every route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest}
- * in RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
+ * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every
+ * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in
+ * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
  *
- * It enforces the endpoint's AuthMode (public/jwt/oidc/shared-secret) using the injected
- * {@link AuthConfig} — the concrete verifiers are app-provided and container-bound (rebindable
- * in tests), so http-routing needs no crypto / gcp-identity. Replaces the old app AuthFilter +
- * framework ServiceAuthFilter and removes the express/api filter tier.
+ * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:
+ *  - shared-secret → constant-time compare vs the bound secret VALUE (state).
+ *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).
+ *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).
+ *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a
+ *                    logged-out page still knows who is logged in; never fails.
+ *
+ * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no
+ * jsonwebtoken / gcp-identity.
  */
 export declare class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {
     private readonly authConfig?;
@@ -19,6 +24,10 @@ export declare class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>>
     private enforceJwt;
     private enforceOidc;
     private enforceSharedSecret;
+    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */
+    private bestEffortJwt;
+    /** Stamp the parsed user's context entries + the principal into the RequestContext. */
+    private applyAuthValues;
     private stripBearer;
     private constantTimeEquals;
 }

package/src/filters/AuthFilter.js

@@ -8,17 +8,23 @@ const core_context_1 = require("@webpieces/core-context");
 const core_util_1 = require("@webpieces/core-util");
 const Filter_1 = require("../Filter");
 const AuthConfig_1 = require("../AuthConfig");
-/** Reserved context key holding the authenticated Principal (stamped after a jwt verify). */
+const log = core_util_1.LogManager.getLogger('AuthFilter');
+/** Reserved context key holding the authenticated {@link AuthValues} (stamped after a jwt parse). */
 const PRINCIPAL_KEY = '__webpieces_principal__';
 /**
- * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on
- * every route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest}
- * in RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
+ * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every
+ * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in
+ * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
  *
- * It enforces the endpoint's AuthMode (public/jwt/oidc/shared-secret) using the injected
- * {@link AuthConfig} — the concrete verifiers are app-provided and container-bound (rebindable
- * in tests), so http-routing needs no crypto / gcp-identity. Replaces the old app AuthFilter +
- * framework ServiceAuthFilter and removes the express/api filter tier.
+ * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:
+ *  - shared-secret → constant-time compare vs the bound secret VALUE (state).
+ *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).
+ *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).
+ *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a
+ *                    logged-out page still knows who is logged in; never fails.
+ *
+ * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no
+ * jsonwebtoken / gcp-identity.
  */
 let AuthFilter = class AuthFilter extends Filter_1.Filter {
     authConfig;
@@ -29,19 +35,21 @@ let AuthFilter = class AuthFilter extends Filter_1.Filter {
     // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility
     async filter(meta, nextFilter) {
         const mode = meta.authMeta?.mode;
+        const authHeader = core_context_1.RequestContext.getRequest()?.getHeader(core_util_1.WebpiecesCoreHeaders.AUTHORIZATION);
         if (!mode || mode.kind === 'public') {
+            // Public: best-effort parse so a logged-out page can still know the logged-in user.
+            this.bestEffortJwt(authHeader);
             return nextFilter.invoke(meta);
         }
-        const request = core_context_1.RequestContext.getRequest();
         switch (mode.kind) {
             case 'jwt':
-                this.enforceJwt(request?.getHeader(core_util_1.WebpiecesCoreHeaders.AUTHORIZATION));
+                this.enforceJwt(authHeader, mode.roles);
                 break;
             case 'oidc':
-                await this.enforceOidc(request?.getHeader(core_util_1.WebpiecesCoreHeaders.AUTHORIZATION), mode.callers);
+                await this.enforceOidc(authHeader, mode.callers);
                 break;
             case 'shared-secret':
-                this.enforceSharedSecret(request?.getHeader(core_util_1.WebpiecesCoreHeaders.SHARED_SECRET), mode.secretEnv);
+                this.enforceSharedSecret(core_context_1.RequestContext.getRequest()?.getHeader(core_util_1.WebpiecesCoreHeaders.SHARED_SECRET), mode.secretEnv);
                 break;
         }
         return nextFilter.invoke(meta);
@@ -52,13 +60,17 @@ let AuthFilter = class AuthFilter extends Filter_1.Filter {
         }
         return this.authConfig;
     }
-    enforceJwt(header) {
+    enforceJwt(header, roles) {
         const token = this.stripBearer(header);
         if (!token) {
             throw new core_util_1.HttpUnauthorizedError('Authentication required');
         }
-        const principal = this.requireAuthConfig().verifyJwt(token);
-        core_context_1.RequestContext.put(PRINCIPAL_KEY, principal);
+        const values = this.requireAuthConfig().parseJwt(token); // throws HttpUnauthorizedError if invalid
+        this.applyAuthValues(values);
+        // @AuthJwt(...roles): empty = any authenticated user; non-empty = must hold at least one.
+        if (roles.length > 0 && !roles.some((role) => values.roles.includes(role))) {
+            throw new core_util_1.HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);
+        }
     }
     async enforceOidc(header, callers) {
         const token = this.stripBearer(header);
@@ -68,11 +80,33 @@ let AuthFilter = class AuthFilter extends Filter_1.Filter {
         await this.requireAuthConfig().verifyOidc(token, callers);
     }
     enforceSharedSecret(provided, secretEnv) {
-        const expected = this.requireAuthConfig().sharedSecret(secretEnv);
+        const expected = this.requireAuthConfig().sharedSecrets[secretEnv];
         if (!expected || !provided || !this.constantTimeEquals(provided, expected)) {
             throw new core_util_1.HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');
         }
     }
+    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */
+    bestEffortJwt(header) {
+        const token = this.stripBearer(header);
+        if (!this.authConfig || !token) {
+            return;
+        }
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- best-effort on a public route: a bad/absent token just means "not logged in", must not fail the request
+        try {
+            this.applyAuthValues(this.authConfig.parseJwt(token));
+        }
+        catch (err) {
+            const error = (0, core_util_1.toError)(err);
+            log.debug('Best-effort JWT parse on a public endpoint failed (treating as anonymous): ', error);
+        }
+    }
+    /** Stamp the parsed user's context entries + the principal into the RequestContext. */
+    applyAuthValues(values) {
+        for (const entry of values.entries) {
+            core_context_1.RequestContext.putHeader(entry.key, entry.value);
+        }
+        core_context_1.RequestContext.put(PRINCIPAL_KEY, values);
+    }
     stripBearer(header) {
         if (!header) {
             return undefined;

package/src/filters/AuthFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-routing/src/filters/AuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAyD;AACzD,mCAAyC;AACzC,0DAAoF;AACpF,oDAAmF;AACnF,sCAAwD;AAExD,8CAA2C;AAE3C,6FAA6F;AAC7F,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;GASG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAuC;IAId;IAHrD,YAGqD,UAAuB;QAExE,KAAK,EAAE,CAAC;QAFyC,eAAU,GAAV,UAAU,CAAa;IAG5E,CAAC;IAED,iGAAiG;IACxF,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,6BAAc,CAAC,UAAU,EAAE,CAAC;QAC5C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,KAAK;gBACN,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAC,CAAC,CAAC;gBACxE,MAAM;YACV,KAAK,MAAM;gBACP,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7F,MAAM;YACV,KAAK,eAAe;gBAChB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjG,MAAM;QACd,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAqB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,UAAU,CAAC,MAA0B;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5D,6BAAc,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAA0B,EAAE,OAAiB;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,QAA4B,EAAE,SAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AAjFY,gCAAU;qBAAV,UAAU;IAHtB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,iGAAiG;;IAKxF,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,uBAAU,CAAC,CAAA;6CAA+B,uBAAU;GAJnE,UAAU,CAiFtB","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { WebpiecesCoreHeaders, HttpUnauthorizedError } from '@webpieces/core-util';\nimport { Filter, WpResponse, Service } from '../Filter';\nimport { MethodMeta } from '../MethodMeta';\nimport { AuthConfig } from '../AuthConfig';\n\n/** Reserved context key holding the authenticated Principal (stamped after a jwt verify). */\nconst PRINCIPAL_KEY = '__webpieces_principal__';\n\n/**\n * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on\n * every route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest}\n * in RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.\n *\n * It enforces the endpoint's AuthMode (public/jwt/oidc/shared-secret) using the injected\n * {@link AuthConfig} — the concrete verifiers are app-provided and container-bound (rebindable\n * in tests), so http-routing needs no crypto / gcp-identity. Replaces the old app AuthFilter +\n * framework ServiceAuthFilter and removes the express/api filter tier.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\nexport class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    constructor(\n        // @optional: a public-only server need not bind an AuthConfig; a non-public route\n        // then fails fast in requireAuthConfig().\n        @optional() @inject(AuthConfig) private readonly authConfig?: AuthConfig,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const mode = meta.authMeta?.mode;\n        if (!mode || mode.kind === 'public') {\n            return nextFilter.invoke(meta);\n        }\n\n        const request = RequestContext.getRequest();\n        switch (mode.kind) {\n            case 'jwt':\n                this.enforceJwt(request?.getHeader(WebpiecesCoreHeaders.AUTHORIZATION));\n                break;\n            case 'oidc':\n                await this.enforceOidc(request?.getHeader(WebpiecesCoreHeaders.AUTHORIZATION), mode.callers);\n                break;\n            case 'shared-secret':\n                this.enforceSharedSecret(request?.getHeader(WebpiecesCoreHeaders.SHARED_SECRET), mode.secretEnv);\n                break;\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    private requireAuthConfig(): AuthConfig {\n        if (!this.authConfig) {\n            throw new HttpUnauthorizedError('No AuthConfig bound — cannot enforce a non-public endpoint');\n        }\n        return this.authConfig;\n    }\n\n    private enforceJwt(header: string | undefined): void {\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Authentication required');\n        }\n        const principal = this.requireAuthConfig().verifyJwt(token);\n        RequestContext.put(PRINCIPAL_KEY, principal);\n    }\n\n    private async enforceOidc(header: string | undefined, callers: string[]): Promise<void> {\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        await this.requireAuthConfig().verifyOidc(token, callers);\n    }\n\n    private enforceSharedSecret(provided: string | undefined, secretEnv: string): void {\n        const expected = this.requireAuthConfig().sharedSecret(secretEnv);\n        if (!expected || !provided || !this.constantTimeEquals(provided, expected)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    private stripBearer(header: string | undefined): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = 'Bearer ';\n        return header.startsWith(prefix) ? header.substring(prefix.length) : header;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}
+{"version":3,"file":"AuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-routing/src/filters/AuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAyD;AACzD,mCAAyC;AACzC,0DAAoF;AACpF,oDAA4H;AAC5H,sCAAwD;AAExD,8CAAuD;AAEvD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AAE/C,qGAAqG;AACrG,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAuC;IAId;IAHrD,YAGqD,UAAuB;QAExE,KAAK,EAAE,CAAC;QAFyC,eAAU,GAAV,UAAU,CAAa;IAG5E,CAAC;IAED,iGAAiG;IACxF,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,6BAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAC,CAAC;QAE9F,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,oFAAoF;YACpF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,KAAK;gBACN,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM;YACV,KAAK,MAAM;gBACP,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM;YACV,KAAK,eAAe;gBAChB,IAAI,CAAC,mBAAmB,CACpB,6BAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAC,EAC1E,IAAI,CAAC,SAAS,CACjB,CAAC;gBACF,MAAM;QACd,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAqB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,UAAU,CAAC,MAA0B,EAAE,KAAe;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,0CAA0C;QACnG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,0FAA0F;QAC1F,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAkB,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAA0B,EAAE,OAAiB;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,QAA4B,EAAE,SAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,4FAA4F;IACpF,aAAa,CAAC,MAA0B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,OAAO;QACX,CAAC;QACD,yKAAyK;QACzK,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,6EAA6E,EAAE,KAAK,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IAED,uFAAuF;IAC/E,eAAe,CAAC,MAAkB;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,6BAAc,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,6BAAc,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEO,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AAlHY,gCAAU;qBAAV,UAAU;IAHtB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,iGAAiG;;IAKxF,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,uBAAU,CAAC,CAAA;6CAA+B,uBAAU;GAJnE,UAAU,CAkHtB","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { WebpiecesCoreHeaders, HttpUnauthorizedError, HttpForbiddenError, LogManager, toError } from '@webpieces/core-util';\nimport { Filter, WpResponse, Service } from '../Filter';\nimport { MethodMeta } from '../MethodMeta';\nimport { AuthConfig, AuthValues } from '../AuthConfig';\n\nconst log = LogManager.getLogger('AuthFilter');\n\n/** Reserved context key holding the authenticated {@link AuthValues} (stamped after a jwt parse). */\nconst PRINCIPAL_KEY = '__webpieces_principal__';\n\n/**\n * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every\n * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in\n * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.\n *\n * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:\n *  - shared-secret → constant-time compare vs the bound secret VALUE (state).\n *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).\n *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).\n *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a\n *                    logged-out page still knows who is logged in; never fails.\n *\n * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no\n * jsonwebtoken / gcp-identity.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\nexport class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    constructor(\n        // @optional: a public-only server need not bind an AuthConfig; a non-public route then\n        // fails fast in requireAuthConfig().\n        @optional() @inject(AuthConfig) private readonly authConfig?: AuthConfig,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const mode = meta.authMeta?.mode;\n        const authHeader = RequestContext.getRequest()?.getHeader(WebpiecesCoreHeaders.AUTHORIZATION);\n\n        if (!mode || mode.kind === 'public') {\n            // Public: best-effort parse so a logged-out page can still know the logged-in user.\n            this.bestEffortJwt(authHeader);\n            return nextFilter.invoke(meta);\n        }\n\n        switch (mode.kind) {\n            case 'jwt':\n                this.enforceJwt(authHeader, mode.roles);\n                break;\n            case 'oidc':\n                await this.enforceOidc(authHeader, mode.callers);\n                break;\n            case 'shared-secret':\n                this.enforceSharedSecret(\n                    RequestContext.getRequest()?.getHeader(WebpiecesCoreHeaders.SHARED_SECRET),\n                    mode.secretEnv,\n                );\n                break;\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    private requireAuthConfig(): AuthConfig {\n        if (!this.authConfig) {\n            throw new HttpUnauthorizedError('No AuthConfig bound — cannot enforce a non-public endpoint');\n        }\n        return this.authConfig;\n    }\n\n    private enforceJwt(header: string | undefined, roles: string[]): void {\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Authentication required');\n        }\n        const values = this.requireAuthConfig().parseJwt(token); // throws HttpUnauthorizedError if invalid\n        this.applyAuthValues(values);\n        // @AuthJwt(...roles): empty = any authenticated user; non-empty = must hold at least one.\n        if (roles.length > 0 && !roles.some((role: string) => values.roles.includes(role))) {\n            throw new HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);\n        }\n    }\n\n    private async enforceOidc(header: string | undefined, callers: string[]): Promise<void> {\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        await this.requireAuthConfig().verifyOidc(token, callers);\n    }\n\n    private enforceSharedSecret(provided: string | undefined, secretEnv: string): void {\n        const expected = this.requireAuthConfig().sharedSecrets[secretEnv];\n        if (!expected || !provided || !this.constantTimeEquals(provided, expected)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */\n    private bestEffortJwt(header: string | undefined): void {\n        const token = this.stripBearer(header);\n        if (!this.authConfig || !token) {\n            return;\n        }\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- best-effort on a public route: a bad/absent token just means \"not logged in\", must not fail the request\n        try {\n            this.applyAuthValues(this.authConfig.parseJwt(token));\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.debug('Best-effort JWT parse on a public endpoint failed (treating as anonymous): ', error);\n        }\n    }\n\n    /** Stamp the parsed user's context entries + the principal into the RequestContext. */\n    private applyAuthValues(values: AuthValues): void {\n        for (const entry of values.entries) {\n            RequestContext.putHeader(entry.key, entry.value);\n        }\n        RequestContext.put(PRINCIPAL_KEY, values);\n    }\n\n    private stripBearer(header: string | undefined): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = 'Bearer ';\n        return header.startsWith(prefix) ? header.substring(prefix.length) : header;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}

package/src/index.d.ts

@@ -13,7 +13,7 @@ export { RouteHandler } from './RouteHandler';
 export { FilterMatcher, HttpFilter } from './FilterMatcher';
 export { ApiFactory } from './ApiFactory';
 export { ApiClient, ApiClientProxy } from './ApiClient';
-export { AuthConfig, Principal } from './AuthConfig';
+export { AuthConfig, AuthValues, ContextValue } from './AuthConfig';
 export { fillContext } from './fillContext';
 export { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';
 export { setupRuntime, RuntimeSetupOptions } from './setupRuntime';

package/src/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.fillContext = exports.Principal = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonAs = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonAs = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
-exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RequestContextReader = exports.RuntimeSetupOptions = exports.setupRuntime = void 0;
+exports.WebpiecesRouter = exports.fillContext = exports.ContextValue = exports.AuthValues = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonAs = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonAs = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
+exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RequestContextReader = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = void 0;
 // Re-export API decorators from core-util for convenience
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "ApiPath", { enumerable: true, get: function () { return core_util_1.ApiPath; } });
@@ -73,10 +73,11 @@ var FilterMatcher_1 = require("./FilterMatcher");
 Object.defineProperty(exports, "FilterMatcher", { enumerable: true, get: function () { return FilterMatcher_1.FilterMatcher; } });
 var ApiClient_1 = require("./ApiClient");
 Object.defineProperty(exports, "ApiClient", { enumerable: true, get: function () { return ApiClient_1.ApiClient; } });
-// Auth: the app-provided, container-bound verifiers the framework AuthFilter injects.
+// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.
 var AuthConfig_1 = require("./AuthConfig");
 Object.defineProperty(exports, "AuthConfig", { enumerable: true, get: function () { return AuthConfig_1.AuthConfig; } });
-Object.defineProperty(exports, "Principal", { enumerable: true, get: function () { return AuthConfig_1.Principal; } });
+Object.defineProperty(exports, "AuthValues", { enumerable: true, get: function () { return AuthConfig_1.AuthValues; } });
+Object.defineProperty(exports, "ContextValue", { enumerable: true, get: function () { return AuthConfig_1.ContextValue; } });
 // Above-boundary context setup shared by every transport adapter.
 var fillContext_1 = require("./fillContext");
 Object.defineProperty(exports, "fillContext", { enumerable: true, get: function () { return fillContext_1.fillContext; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAAiG;AAAxF,gHAAA,gBAAgB,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC/D,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,sFAAsF;AACtF,2CAAqD;AAA5C,wGAAA,UAAU,OAAA;AAAE,uGAAA,SAAS,OAAA;AAE9B,kEAAkE;AAClE,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,oFAAoF;AACpF,wDAA+D;AAAtD,oHAAA,oBAAoB,OAAA;AAE7B,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonAs, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonAs,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound verifiers the framework AuthFilter injects.\nexport { AuthConfig, Principal } from './AuthConfig';\n\n// Above-boundary context setup shared by every transport adapter.\nexport { fillContext } from './fillContext';\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Context readers (Node.js only) moved to core-context; re-exported for back-compat\nexport { RequestContextReader } from '@webpieces/core-context';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAAiG;AAAxF,gHAAA,gBAAgB,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC/D,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,uFAAuF;AACvF,2CAAoE;AAA3D,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,0GAAA,YAAY,OAAA;AAE7C,kEAAkE;AAClE,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,oFAAoF;AACpF,wDAA+D;AAAtD,oHAAA,oBAAoB,OAAA;AAE7B,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonAs, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonAs,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.\nexport { AuthConfig, AuthValues, ContextValue } from './AuthConfig';\n\n// Above-boundary context setup shared by every transport adapter.\nexport { fillContext } from './fillContext';\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Context readers (Node.js only) moved to core-context; re-exported for back-compat\nexport { RequestContextReader } from '@webpieces/core-context';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}