@webpieces/http-routing 0.3.349 → 0.3.351

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.349",
+  "version": "0.3.351",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,9 +22,11 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.349",
-    "@webpieces/core-util": "0.3.349",
+    "@webpieces/core-context": "0.3.351",
+    "@webpieces/core-util": "0.3.351",
+    "@webpieces/gcp-identity": "0.3.351",
     "inversify": "7.10.4",
+    "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1"
   }
 }

package/src/AuthConfig.d.ts

@@ -1,4 +1,4 @@
-import { ContextTuple, JwtRequirement } from '@webpieces/core-util';
+import { ContextTuple } from '@webpieces/core-util';
 /**
  * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2
  * are accepted — this is what makes zero-downtime ROTATION possible:
@@ -15,7 +15,7 @@ export declare class SharedSecrets {
     constructor(secret1: string, secret2: string);
 }
 /**
- * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used
+ * AuthValues - what {@link JwtHook.parseJwt} returns: the authenticated user's id + roles (used
  * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context
  * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext
  * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).
@@ -28,44 +28,21 @@ export declare class AuthValues {
     constructor(userId: string, roles?: string[], entries?: ContextTuple[], claims?: Record<string, unknown>);
 }
 /**
- * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce
- * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)
- * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:
+ * AuthConfig - the app-provided SHARED-SECRET state the framework {@link AuthFilter} reads to
+ * enforce `@AuthSharedSecret(name)` endpoints. It holds ONLY the accepted secret values (STATE) —
+ * there is no verification code here. The verification MECHANISMS are separate optional hooks the
+ * app binds when it needs them:
  *
- *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).
- *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
- *                       exercise the shared-secret path (and a negative test with a wrong key).
- *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
- *                       context entries). The app owns the VERIFICATION — it picks the JWT library
- *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a
- *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller
- *                       concern (login), not here.
- *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
- *                       caller allow-list. Fully generic — the company base wires it to
- *                       @webpieces/gcp-identity once, so apps never customize OIDC.
+ *  - user JWT  → bind a {@link JwtHook} (parseJwt + authorizeJwt).
+ *  - OIDC      → bind an {@link OidcHook} to override the framework's default verifier; a server that
+ *                binds nothing still verifies Google OIDC via the built-in {@link DefaultOidcVerifier}.
  *
- * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403
- * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never
- * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds
- * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.
+ * So a zero-wiring server accepts service-to-service OIDC out of the box, and an app only binds the
+ * pieces it actually uses. This class is injected `@optional` into AuthFilter (rebindable in tests);
+ * when unbound, shared-secret endpoints simply have no accepted secret and fail fast (401).
  */
-export declare abstract class AuthConfig {
-    /**
-     * Accepted shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. Each entry
-     * is a {@link SharedSecrets} (secret1 + secret2, either accepted) so secrets can be ROTATED
-     * with zero dropped requests.
-     */
-    abstract readonly sharedSecrets: Record<string, SharedSecrets>;
-    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */
-    abstract parseJwt(token: string): AuthValues;
-    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */
-    abstract verifyOidc(token: string, callers: string[]): Promise<void>;
-    /**
-     * AUTHORIZATION: check the authenticated user against the endpoint's {@link JwtRequirement}.
-     * DEFAULT enforces `roles` (any-of; empty = any authenticated user). OVERRIDE to enforce
-     * app-defined requirements carried by `@Auth({...})` — e.g.
-     * `if (requirement['inOrg'] && !values.claims['orgId']) throw new HttpForbiddenError(...)`.
-     * Throw HttpForbiddenError to deny; return to allow. This is the pluggable seam.
-     */
-    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void;
+export declare class AuthConfig {
+    /** Accepted shared-secret values keyed by `@AuthSharedSecret(name)`. DEFAULT empty — pass to enable. */
+    readonly sharedSecrets: Record<string, SharedSecrets>;
+    constructor(sharedSecrets?: Record<string, SharedSecrets>);
 }

package/src/AuthConfig.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthConfig = exports.AuthValues = exports.SharedSecrets = void 0;
-const core_util_1 = require("@webpieces/core-util");
 /**
  * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2
  * are accepted — this is what makes zero-downtime ROTATION possible:
@@ -22,7 +21,7 @@ class SharedSecrets {
 }
 exports.SharedSecrets = SharedSecrets;
 /**
- * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used
+ * AuthValues - what {@link JwtHook.parseJwt} returns: the authenticated user's id + roles (used
  * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context
  * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext
  * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).
@@ -43,40 +42,24 @@ class AuthValues {
 }
 exports.AuthValues = AuthValues;
 /**
- * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce
- * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)
- * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:
+ * AuthConfig - the app-provided SHARED-SECRET state the framework {@link AuthFilter} reads to
+ * enforce `@AuthSharedSecret(name)` endpoints. It holds ONLY the accepted secret values (STATE) —
+ * there is no verification code here. The verification MECHANISMS are separate optional hooks the
+ * app binds when it needs them:
  *
- *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).
- *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
- *                       exercise the shared-secret path (and a negative test with a wrong key).
- *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
- *                       context entries). The app owns the VERIFICATION — it picks the JWT library
- *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a
- *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller
- *                       concern (login), not here.
- *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
- *                       caller allow-list. Fully generic — the company base wires it to
- *                       @webpieces/gcp-identity once, so apps never customize OIDC.
+ *  - user JWT  → bind a {@link JwtHook} (parseJwt + authorizeJwt).
+ *  - OIDC      → bind an {@link OidcHook} to override the framework's default verifier; a server that
+ *                binds nothing still verifies Google OIDC via the built-in {@link DefaultOidcVerifier}.
  *
- * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403
- * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never
- * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds
- * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.
+ * So a zero-wiring server accepts service-to-service OIDC out of the box, and an app only binds the
+ * pieces it actually uses. This class is injected `@optional` into AuthFilter (rebindable in tests);
+ * when unbound, shared-secret endpoints simply have no accepted secret and fail fast (401).
  */
 class AuthConfig {
-    /**
-     * AUTHORIZATION: check the authenticated user against the endpoint's {@link JwtRequirement}.
-     * DEFAULT enforces `roles` (any-of; empty = any authenticated user). OVERRIDE to enforce
-     * app-defined requirements carried by `@Auth({...})` — e.g.
-     * `if (requirement['inOrg'] && !values.claims['orgId']) throw new HttpForbiddenError(...)`.
-     * Throw HttpForbiddenError to deny; return to allow. This is the pluggable seam.
-     */
-    authorizeJwt(values, requirement) {
-        const roles = requirement.roles ?? [];
-        if (roles.length > 0 && !roles.some((role) => values.roles.includes(role))) {
-            throw new core_util_1.HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);
-        }
+    /** Accepted shared-secret values keyed by `@AuthSharedSecret(name)`. DEFAULT empty — pass to enable. */
+    sharedSecrets;
+    constructor(sharedSecrets = {}) {
+        this.sharedSecrets = sharedSecrets;
     }
 }
 exports.AuthConfig = AuthConfig;

package/src/AuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAAA,oDAAwF;AAExF;;;;;;;;;GASG;AACH,MAAa,aAAa;IAEF;IACA;IAFpB,YACoB,OAAe,EACf,OAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;IAChC,CAAC;CACP;AALD,sCAKC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAEC;IACA;IACA;IAEA;IALpB,YACoB,MAAc,EACd,QAAkB,EAAE,EACpB,UAA0B,EAAE;IAC5C,wGAAwG;IACxF,SAAkC,EAAE;QAJpC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QACpB,YAAO,GAAP,OAAO,CAAqB;QAE5B,WAAM,GAAN,MAAM,CAA8B;IACrD,CAAC;CACP;AARD,gCAQC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAsB,UAAU;IAc5B;;;;;;OAMG;IACH,YAAY,CAAC,MAAkB,EAAE,WAA2B;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAkB,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ;AA3BD,gCA2BC","sourcesContent":["import { ContextTuple, JwtRequirement, HttpForbiddenError } from '@webpieces/core-util';\n\n/**\n * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2\n * are accepted — this is what makes zero-downtime ROTATION possible:\n *\n *   to rotate: shift secret2 → secret1, and put the NEW secret in secret2. Callers cut over from\n *   the old value to the new during the window; once every caller sends the new one, the stale\n *   value falls out on the next shift. At all times EITHER key works, so no request is dropped.\n *\n * Data-only structure (a class, per the guidelines). Leave secret2 empty for a single secret.\n */\nexport class SharedSecrets {\n    constructor(\n        public readonly secret1: string,\n        public readonly secret2: string,\n    ) {}\n}\n\n/**\n * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used\n * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context\n * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext\n * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).\n */\nexport class AuthValues {\n    constructor(\n        public readonly userId: string,\n        public readonly roles: string[] = [],\n        public readonly entries: ContextTuple[] = [],\n        // webpieces-disable no-any-unknown -- raw JWT claims for app-defined authorization (inOrg, tenant, ...)\n        public readonly claims: Record<string, unknown> = {},\n    ) {}\n}\n\n/**\n * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce\n * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)\n * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:\n *\n *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).\n *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then\n *                       exercise the shared-secret path (and a negative test with a wrong key).\n *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,\n *                       context entries). The app owns the VERIFICATION — it picks the JWT library\n *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a\n *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller\n *                       concern (login), not here.\n *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's\n *                       caller allow-list. Fully generic — the company base wires it to\n *                       @webpieces/gcp-identity once, so apps never customize OIDC.\n *\n * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403\n * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never\n * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds\n * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.\n */\nexport abstract class AuthConfig {\n    /**\n     * Accepted shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. Each entry\n     * is a {@link SharedSecrets} (secret1 + secret2, either accepted) so secrets can be ROTATED\n     * with zero dropped requests.\n     */\n    abstract readonly sharedSecrets: Record<string, SharedSecrets>;\n\n    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */\n    abstract parseJwt(token: string): AuthValues;\n\n    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n\n    /**\n     * AUTHORIZATION: check the authenticated user against the endpoint's {@link JwtRequirement}.\n     * DEFAULT enforces `roles` (any-of; empty = any authenticated user). OVERRIDE to enforce\n     * app-defined requirements carried by `@Auth({...})` — e.g.\n     * `if (requirement['inOrg'] && !values.claims['orgId']) throw new HttpForbiddenError(...)`.\n     * Throw HttpForbiddenError to deny; return to allow. This is the pluggable seam.\n     */\n    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void {\n        const roles = requirement.roles ?? [];\n        if (roles.length > 0 && !roles.some((role: string) => values.roles.includes(role))) {\n            throw new HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);\n        }\n    }\n}\n"]}
+{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACH,MAAa,aAAa;IAEF;IACA;IAFpB,YACoB,OAAe,EACf,OAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;IAChC,CAAC;CACP;AALD,sCAKC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAEC;IACA;IACA;IAEA;IALpB,YACoB,MAAc,EACd,QAAkB,EAAE,EACpB,UAA0B,EAAE;IAC5C,wGAAwG;IACxF,SAAkC,EAAE;QAJpC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QACpB,YAAO,GAAP,OAAO,CAAqB;QAE5B,WAAM,GAAN,MAAM,CAA8B;IACrD,CAAC;CACP;AARD,gCAQC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,UAAU;IACnB,wGAAwG;IAC/F,aAAa,CAAgC;IAEtD,YAAY,gBAA+C,EAAE;QACzD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACvC,CAAC;CACJ;AAPD,gCAOC","sourcesContent":["import { ContextTuple } from '@webpieces/core-util';\n\n/**\n * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2\n * are accepted — this is what makes zero-downtime ROTATION possible:\n *\n *   to rotate: shift secret2 → secret1, and put the NEW secret in secret2. Callers cut over from\n *   the old value to the new during the window; once every caller sends the new one, the stale\n *   value falls out on the next shift. At all times EITHER key works, so no request is dropped.\n *\n * Data-only structure (a class, per the guidelines). Leave secret2 empty for a single secret.\n */\nexport class SharedSecrets {\n    constructor(\n        public readonly secret1: string,\n        public readonly secret2: string,\n    ) {}\n}\n\n/**\n * AuthValues - what {@link JwtHook.parseJwt} returns: the authenticated user's id + roles (used\n * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context\n * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext\n * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).\n */\nexport class AuthValues {\n    constructor(\n        public readonly userId: string,\n        public readonly roles: string[] = [],\n        public readonly entries: ContextTuple[] = [],\n        // webpieces-disable no-any-unknown -- raw JWT claims for app-defined authorization (inOrg, tenant, ...)\n        public readonly claims: Record<string, unknown> = {},\n    ) {}\n}\n\n/**\n * AuthConfig - the app-provided SHARED-SECRET state the framework {@link AuthFilter} reads to\n * enforce `@AuthSharedSecret(name)` endpoints. It holds ONLY the accepted secret values (STATE) —\n * there is no verification code here. The verification MECHANISMS are separate optional hooks the\n * app binds when it needs them:\n *\n *  - user JWT  → bind a {@link JwtHook} (parseJwt + authorizeJwt).\n *  - OIDC      → bind an {@link OidcHook} to override the framework's default verifier; a server that\n *                binds nothing still verifies Google OIDC via the built-in {@link DefaultOidcVerifier}.\n *\n * So a zero-wiring server accepts service-to-service OIDC out of the box, and an app only binds the\n * pieces it actually uses. This class is injected `@optional` into AuthFilter (rebindable in tests);\n * when unbound, shared-secret endpoints simply have no accepted secret and fail fast (401).\n */\nexport class AuthConfig {\n    /** Accepted shared-secret values keyed by `@AuthSharedSecret(name)`. DEFAULT empty — pass to enable. */\n    readonly sharedSecrets: Record<string, SharedSecrets>;\n\n    constructor(sharedSecrets: Record<string, SharedSecrets> = {}) {\n        this.sharedSecrets = sharedSecrets;\n    }\n}\n"]}

package/src/AuthHooks.d.ts

@@ -0,0 +1,35 @@
+import { JwtRequirement } from '@webpieces/core-util';
+import { AuthValues } from './AuthConfig';
+/**
+ * JwtHook - the OPTIONAL user-JWT mechanism. Bind one (inject by type, per no-symbol-di-tokens;
+ * rebindable in tests) to turn on `@AuthJwt(...)` endpoints. When NO JwtHook is bound, the framework
+ * {@link AuthFilter} treats every jwt endpoint as "not enabled" and fails fast (401) — there is no
+ * default JWT verification because it needs an app secret + payload shape the framework can't guess.
+ *
+ *  - `parseJwt`     — AUTHENTICATION: decode/verify a user JWT into {@link AuthValues}, or throw. The
+ *                     app owns the strategy (HS256 secret, RS256 + JWKS, a provider SDK, ...).
+ *  - `authorizeJwt` — AUTHORIZATION: check the authenticated user against the endpoint's
+ *                     {@link JwtRequirement}. The DEFAULT enforces `roles` (any-of; empty = any
+ *                     authenticated user); override for app-defined requirements carried by
+ *                     `@Auth({...})` — e.g. `if (requirement['inOrg'] && !values.claims['orgId']) ...`.
+ */
+export declare abstract class JwtHook {
+    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */
+    abstract parseJwt(token: string): AuthValues;
+    /**
+     * DEFAULT authorization: enforce `roles` (any-of; empty = any authenticated user). Override to
+     * enforce app-defined requirements. Throw HttpForbiddenError to deny; return to allow.
+     */
+    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void;
+}
+/**
+ * OidcHook - the OPTIONAL override for Google OIDC service-to-service verification. Bind one (inject
+ * by type; rebindable in tests) ONLY to customize the caller policy — e.g. an app that reads an
+ * `ALLOWED_OIDC_CALLERS` env var at its composition root and enforces that allow-list. When NO
+ * OidcHook is bound, the framework {@link AuthFilter} runs the built-in {@link DefaultOidcVerifier}
+ * directly, so a server that wires nothing still verifies Google OIDC from its `@AuthOidc(...callers)`
+ * (else `['self']`). `verifyOidc` verifies the token against `callers`; throw on failure.
+ */
+export declare abstract class OidcHook {
+    abstract verifyOidc(token: string, callers: string[]): Promise<void>;
+}

package/src/AuthHooks.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcHook = exports.JwtHook = void 0;
+const core_util_1 = require("@webpieces/core-util");
+/**
+ * JwtHook - the OPTIONAL user-JWT mechanism. Bind one (inject by type, per no-symbol-di-tokens;
+ * rebindable in tests) to turn on `@AuthJwt(...)` endpoints. When NO JwtHook is bound, the framework
+ * {@link AuthFilter} treats every jwt endpoint as "not enabled" and fails fast (401) — there is no
+ * default JWT verification because it needs an app secret + payload shape the framework can't guess.
+ *
+ *  - `parseJwt`     — AUTHENTICATION: decode/verify a user JWT into {@link AuthValues}, or throw. The
+ *                     app owns the strategy (HS256 secret, RS256 + JWKS, a provider SDK, ...).
+ *  - `authorizeJwt` — AUTHORIZATION: check the authenticated user against the endpoint's
+ *                     {@link JwtRequirement}. The DEFAULT enforces `roles` (any-of; empty = any
+ *                     authenticated user); override for app-defined requirements carried by
+ *                     `@Auth({...})` — e.g. `if (requirement['inOrg'] && !values.claims['orgId']) ...`.
+ */
+class JwtHook {
+    /**
+     * DEFAULT authorization: enforce `roles` (any-of; empty = any authenticated user). Override to
+     * enforce app-defined requirements. Throw HttpForbiddenError to deny; return to allow.
+     */
+    authorizeJwt(values, requirement) {
+        const roles = requirement.roles ?? [];
+        if (roles.length > 0 && !roles.some((role) => values.roles.includes(role))) {
+            throw new core_util_1.HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);
+        }
+    }
+}
+exports.JwtHook = JwtHook;
+/**
+ * OidcHook - the OPTIONAL override for Google OIDC service-to-service verification. Bind one (inject
+ * by type; rebindable in tests) ONLY to customize the caller policy — e.g. an app that reads an
+ * `ALLOWED_OIDC_CALLERS` env var at its composition root and enforces that allow-list. When NO
+ * OidcHook is bound, the framework {@link AuthFilter} runs the built-in {@link DefaultOidcVerifier}
+ * directly, so a server that wires nothing still verifies Google OIDC from its `@AuthOidc(...callers)`
+ * (else `['self']`). `verifyOidc` verifies the token against `callers`; throw on failure.
+ */
+class OidcHook {
+}
+exports.OidcHook = OidcHook;
+//# sourceMappingURL=AuthHooks.js.map

package/src/AuthHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthHooks.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthHooks.ts"],"names":[],"mappings":";;;AAAA,oDAA0E;AAG1E;;;;;;;;;;;;GAYG;AACH,MAAsB,OAAO;IAIzB;;;OAGG;IACH,YAAY,CAAC,MAAkB,EAAE,WAA2B;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAkB,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ;AAdD,0BAcC;AAED;;;;;;;GAOG;AACH,MAAsB,QAAQ;CAE7B;AAFD,4BAEC","sourcesContent":["import { JwtRequirement, HttpForbiddenError } from '@webpieces/core-util';\nimport { AuthValues } from './AuthConfig';\n\n/**\n * JwtHook - the OPTIONAL user-JWT mechanism. Bind one (inject by type, per no-symbol-di-tokens;\n * rebindable in tests) to turn on `@AuthJwt(...)` endpoints. When NO JwtHook is bound, the framework\n * {@link AuthFilter} treats every jwt endpoint as \"not enabled\" and fails fast (401) — there is no\n * default JWT verification because it needs an app secret + payload shape the framework can't guess.\n *\n *  - `parseJwt`     — AUTHENTICATION: decode/verify a user JWT into {@link AuthValues}, or throw. The\n *                     app owns the strategy (HS256 secret, RS256 + JWKS, a provider SDK, ...).\n *  - `authorizeJwt` — AUTHORIZATION: check the authenticated user against the endpoint's\n *                     {@link JwtRequirement}. The DEFAULT enforces `roles` (any-of; empty = any\n *                     authenticated user); override for app-defined requirements carried by\n *                     `@Auth({...})` — e.g. `if (requirement['inOrg'] && !values.claims['orgId']) ...`.\n */\nexport abstract class JwtHook {\n    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */\n    abstract parseJwt(token: string): AuthValues;\n\n    /**\n     * DEFAULT authorization: enforce `roles` (any-of; empty = any authenticated user). Override to\n     * enforce app-defined requirements. Throw HttpForbiddenError to deny; return to allow.\n     */\n    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void {\n        const roles = requirement.roles ?? [];\n        if (roles.length > 0 && !roles.some((role: string) => values.roles.includes(role))) {\n            throw new HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);\n        }\n    }\n}\n\n/**\n * OidcHook - the OPTIONAL override for Google OIDC service-to-service verification. Bind one (inject\n * by type; rebindable in tests) ONLY to customize the caller policy — e.g. an app that reads an\n * `ALLOWED_OIDC_CALLERS` env var at its composition root and enforces that allow-list. When NO\n * OidcHook is bound, the framework {@link AuthFilter} runs the built-in {@link DefaultOidcVerifier}\n * directly, so a server that wires nothing still verifies Google OIDC from its `@AuthOidc(...callers)`\n * (else `['self']`). `verifyOidc` verifies the token against `callers`; throw on failure.\n */\nexport abstract class OidcHook {\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n}\n"]}

package/src/DefaultJwtHook.d.ts

@@ -0,0 +1,20 @@
+import { JwtHook } from './AuthHooks';
+import { AuthValues } from './AuthConfig';
+/**
+ * DefaultJwtHook - a batteries-included {@link JwtHook} for the common case: HS256 user JWTs signed
+ * with ONE shared secret. Construct it with the secret and bind it — `new DefaultJwtHook(secret)` —
+ * and `@AuthJwt` endpoints work with NO custom verification code.
+ *
+ * `parseJwt` verifies the signature + expiry (jsonwebtoken, HS256 only) and maps standard claims:
+ * `sub` → userId, a string[] `roles` claim → roles, the whole payload → claims. `authorizeJwt`
+ * (role enforcement) is inherited from JwtHook. For RS256 + JWKS, a provider SDK, or a non-standard
+ * payload, write your own JwtHook subclass instead.
+ */
+export declare class DefaultJwtHook extends JwtHook {
+    private readonly secret;
+    constructor(secret: string);
+    parseJwt(token: string): AuthValues;
+    /** Verify HS256 signature + expiry; translate jsonwebtoken's raw error into a framework 401. */
+    private verifyToken;
+    private extractRoles;
+}

package/src/DefaultJwtHook.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultJwtHook = void 0;
+const jsonwebtoken_1 = require("jsonwebtoken");
+const core_util_1 = require("@webpieces/core-util");
+const AuthHooks_1 = require("./AuthHooks");
+const AuthConfig_1 = require("./AuthConfig");
+/**
+ * DefaultJwtHook - a batteries-included {@link JwtHook} for the common case: HS256 user JWTs signed
+ * with ONE shared secret. Construct it with the secret and bind it — `new DefaultJwtHook(secret)` —
+ * and `@AuthJwt` endpoints work with NO custom verification code.
+ *
+ * `parseJwt` verifies the signature + expiry (jsonwebtoken, HS256 only) and maps standard claims:
+ * `sub` → userId, a string[] `roles` claim → roles, the whole payload → claims. `authorizeJwt`
+ * (role enforcement) is inherited from JwtHook. For RS256 + JWKS, a provider SDK, or a non-standard
+ * payload, write your own JwtHook subclass instead.
+ */
+class DefaultJwtHook extends AuthHooks_1.JwtHook {
+    secret;
+    constructor(secret) {
+        super();
+        this.secret = secret;
+    }
+    parseJwt(token) {
+        const payload = this.verifyToken(token);
+        const userId = payload.sub;
+        if (!userId) {
+            throw new core_util_1.HttpUnauthorizedError('JWT is missing the required "sub" (subject) claim');
+        }
+        return new AuthConfig_1.AuthValues(userId, this.extractRoles(payload), [], payload);
+    }
+    /** Verify HS256 signature + expiry; translate jsonwebtoken's raw error into a framework 401. */
+    verifyToken(token) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- AUTH TRANSLATION CHOKEPOINT: jsonwebtoken.verify throws on a bad/expired token; that must surface as a 401 Unauthorized, not bubble to the global handler as a 500. The original error is chained via cause.
+        try {
+            const decoded = (0, jsonwebtoken_1.verify)(token, this.secret, { algorithms: ['HS256'] });
+            if (typeof decoded === 'string') {
+                throw new core_util_1.HttpUnauthorizedError('JWT payload must be a JSON object, not a string');
+            }
+            return decoded;
+        }
+        catch (err) {
+            const error = (0, core_util_1.toError)(err);
+            if (error instanceof core_util_1.HttpUnauthorizedError) {
+                throw error;
+            }
+            throw new core_util_1.HttpUnauthorizedError('JWT verification failed', undefined, error);
+        }
+    }
+    extractRoles(payload) {
+        const roles = payload['roles'];
+        if (Array.isArray(roles)) {
+            return roles.filter((role) => typeof role === 'string');
+        }
+        return [];
+    }
+}
+exports.DefaultJwtHook = DefaultJwtHook;
+//# sourceMappingURL=DefaultJwtHook.js.map

package/src/DefaultJwtHook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DefaultJwtHook.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/DefaultJwtHook.ts"],"names":[],"mappings":";;;AAAA,+CAAkD;AAClD,oDAAsE;AACtE,2CAAsC;AACtC,6CAA0C;AAE1C;;;;;;;;;GASG;AACH,MAAa,cAAe,SAAQ,mBAAO;IACtB,MAAM,CAAS;IAEhC,YAAY,MAAc;QACtB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAEQ,QAAQ,CAAC,KAAa;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,iCAAqB,CAAC,mDAAmD,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,IAAI,uBAAU,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,gGAAgG;IACxF,WAAW,CAAC,KAAa;QAC7B,8QAA8Q;QAC9Q,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,iCAAqB,CAAC,iDAAiD,CAAC,CAAC;YACvF,CAAC;YACD,OAAO,OAAO,CAAC;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;gBACzC,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,MAAM,IAAI,iCAAqB,CAAC,yBAAyB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,OAAmB;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;CACJ;AA1CD,wCA0CC","sourcesContent":["import { verify, JwtPayload } from 'jsonwebtoken';\nimport { HttpUnauthorizedError, toError } from '@webpieces/core-util';\nimport { JwtHook } from './AuthHooks';\nimport { AuthValues } from './AuthConfig';\n\n/**\n * DefaultJwtHook - a batteries-included {@link JwtHook} for the common case: HS256 user JWTs signed\n * with ONE shared secret. Construct it with the secret and bind it — `new DefaultJwtHook(secret)` —\n * and `@AuthJwt` endpoints work with NO custom verification code.\n *\n * `parseJwt` verifies the signature + expiry (jsonwebtoken, HS256 only) and maps standard claims:\n * `sub` → userId, a string[] `roles` claim → roles, the whole payload → claims. `authorizeJwt`\n * (role enforcement) is inherited from JwtHook. For RS256 + JWKS, a provider SDK, or a non-standard\n * payload, write your own JwtHook subclass instead.\n */\nexport class DefaultJwtHook extends JwtHook {\n    private readonly secret: string;\n\n    constructor(secret: string) {\n        super();\n        this.secret = secret;\n    }\n\n    override parseJwt(token: string): AuthValues {\n        const payload = this.verifyToken(token);\n        const userId = payload.sub;\n        if (!userId) {\n            throw new HttpUnauthorizedError('JWT is missing the required \"sub\" (subject) claim');\n        }\n        return new AuthValues(userId, this.extractRoles(payload), [], payload);\n    }\n\n    /** Verify HS256 signature + expiry; translate jsonwebtoken's raw error into a framework 401. */\n    private verifyToken(token: string): JwtPayload {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- AUTH TRANSLATION CHOKEPOINT: jsonwebtoken.verify throws on a bad/expired token; that must surface as a 401 Unauthorized, not bubble to the global handler as a 500. The original error is chained via cause.\n        try {\n            const decoded = verify(token, this.secret, { algorithms: ['HS256'] });\n            if (typeof decoded === 'string') {\n                throw new HttpUnauthorizedError('JWT payload must be a JSON object, not a string');\n            }\n            return decoded;\n        } catch (err: unknown) {\n            const error = toError(err);\n            if (error instanceof HttpUnauthorizedError) {\n                throw error;\n            }\n            throw new HttpUnauthorizedError('JWT verification failed', undefined, error);\n        }\n    }\n\n    private extractRoles(payload: JwtPayload): string[] {\n        const roles = payload['roles'];\n        if (Array.isArray(roles)) {\n            return roles.filter((role: string) => typeof role === 'string');\n        }\n        return [];\n    }\n}\n"]}

package/src/DefaultOidcVerifier.d.ts

@@ -0,0 +1,15 @@
+/**
+ * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into
+ * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes
+ * OIDC "just work" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a
+ * server that binds nothing still verifies service-to-service OIDC.
+ *
+ * `verify` checks the token against the endpoint's `@AuthOidc(...callers)` allow-list, falling back
+ * to `['self']` (this service's own runtime SA) when the endpoint named none. Off-GCP, gcp-identity
+ * mints + accepts a dev token so local dev needs no GCP. Framework code reads NO process.env — an app
+ * that wants an env-driven allow-list binds an {@link OidcHook} instead (env read at its composition
+ * root), which keeps this default env-free and tests parallel-safe.
+ */
+export declare class DefaultOidcVerifier {
+    verify(token: string, callers: string[]): Promise<void>;
+}

package/src/DefaultOidcVerifier.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultOidcVerifier = void 0;
+const tslib_1 = require("tslib");
+const inversify_1 = require("inversify");
+const core_context_1 = require("@webpieces/core-context");
+const core_util_1 = require("@webpieces/core-util");
+const gcp_identity_1 = require("@webpieces/gcp-identity");
+/**
+ * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into
+ * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes
+ * OIDC "just work" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a
+ * server that binds nothing still verifies service-to-service OIDC.
+ *
+ * `verify` checks the token against the endpoint's `@AuthOidc(...callers)` allow-list, falling back
+ * to `['self']` (this service's own runtime SA) when the endpoint named none. Off-GCP, gcp-identity
+ * mints + accepts a dev token so local dev needs no GCP. Framework code reads NO process.env — an app
+ * that wants an env-driven allow-list binds an {@link OidcHook} instead (env read at its composition
+ * root), which keeps this default env-free and tests parallel-safe.
+ */
+let DefaultOidcVerifier = class DefaultOidcVerifier {
+    async verify(token, callers) {
+        const allow = callers.length > 0 ? callers : ['self'];
+        const result = await (0, gcp_identity_1.verifyOidcFromCallers)(token, allow);
+        if (!result.ok) {
+            throw new core_util_1.HttpUnauthorizedError(`OIDC rejected: ${result.reason ?? 'not an allowed caller'}`);
+        }
+    }
+};
+exports.DefaultOidcVerifier = DefaultOidcVerifier;
+exports.DefaultOidcVerifier = DefaultOidcVerifier = tslib_1.__decorate([
+    (0, core_context_1.provideFrameworkSingleton)(),
+    (0, inversify_1.injectable)()
+], DefaultOidcVerifier);
+//# sourceMappingURL=DefaultOidcVerifier.js.map

package/src/DefaultOidcVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DefaultOidcVerifier.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/DefaultOidcVerifier.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,0DAAoE;AACpE,oDAA6D;AAC7D,0DAAgE;AAEhE;;;;;;;;;;;GAWG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAiB;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAqB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,kBAAkB,MAAM,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;QAClG,CAAC;IACL,CAAC;CACJ,CAAA;AARY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;GACA,mBAAmB,CAQ/B","sourcesContent":["import { injectable } from 'inversify';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\nimport { HttpUnauthorizedError } from '@webpieces/core-util';\nimport { verifyOidcFromCallers } from '@webpieces/gcp-identity';\n\n/**\n * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into\n * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes\n * OIDC \"just work\" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a\n * server that binds nothing still verifies service-to-service OIDC.\n *\n * `verify` checks the token against the endpoint's `@AuthOidc(...callers)` allow-list, falling back\n * to `['self']` (this service's own runtime SA) when the endpoint named none. Off-GCP, gcp-identity\n * mints + accepts a dev token so local dev needs no GCP. Framework code reads NO process.env — an app\n * that wants an env-driven allow-list binds an {@link OidcHook} instead (env read at its composition\n * root), which keeps this default env-free and tests parallel-safe.\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class DefaultOidcVerifier {\n    async verify(token: string, callers: string[]): Promise<void> {\n        const allow = callers.length > 0 ? callers : ['self'];\n        const result = await verifyOidcFromCallers(token, allow);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC rejected: ${result.reason ?? 'not an allowed caller'}`);\n        }\n    }\n}\n"]}

package/src/MethodMeta.d.ts

@@ -1,4 +1,4 @@
-import { RouteMetadata, AuthMeta } from '@webpieces/core-util';
+import { RouteMetadata } from '@webpieces/core-util';
 /**
  * Metadata about the method being invoked.
  * Passed to filters and contains request information.
@@ -13,10 +13,13 @@ import { RouteMetadata, AuthMeta } from '@webpieces/core-util';
  * in any express dependency.
  *
  * Fields:
- * - routeMeta: Static route information (httpMethod, path, methodName)
+ * - routeMeta: Static route information (httpMethod, path, methodName, authMeta)
  * - requestDto: The deserialized request body
- * - authMeta: Auth mode from @Authentication/@AuthOidc/... decorators
  * - metadata: Request-scoped data for filters to communicate
+ *
+ * Auth mode lives on {@link RouteMetadata.authMeta} (the one source of truth for fixed route
+ * metadata); read it via `methodMeta.routeMeta.authMeta`. MethodMeta itself carries only the
+ * static route reference + the request-scoped body/bag.
  */
 export declare class MethodMeta {
     /**
@@ -27,17 +30,12 @@ export declare class MethodMeta {
      * The deserialized request DTO.
      */
     requestDto?: unknown;
-    /**
-     * Auth metadata from @Public/@Authenticated/@Roles decorators.
-     * Populated by ApiRoutingFactory so filters can read auth requirements.
-     */
-    authMeta?: AuthMeta;
     /**
      * Additional metadata for storing request-scoped data.
      * Used by filters to pass data to other filters/controllers.
      */
     metadata: Map<string, unknown>;
-    constructor(routeMeta: RouteMetadata, requestDto?: unknown, metadata?: Map<string, unknown>, authMeta?: AuthMeta);
+    constructor(routeMeta: RouteMetadata, requestDto?: unknown, metadata?: Map<string, unknown>);
     /**
      * Get the HTTP method (convenience accessor).
      */

package/src/MethodMeta.js

@@ -15,10 +15,13 @@ exports.MethodMeta = void 0;
  * in any express dependency.
  *
  * Fields:
- * - routeMeta: Static route information (httpMethod, path, methodName)
+ * - routeMeta: Static route information (httpMethod, path, methodName, authMeta)
  * - requestDto: The deserialized request body
- * - authMeta: Auth mode from @Authentication/@AuthOidc/... decorators
  * - metadata: Request-scoped data for filters to communicate
+ *
+ * Auth mode lives on {@link RouteMetadata.authMeta} (the one source of truth for fixed route
+ * metadata); read it via `methodMeta.routeMeta.authMeta`. MethodMeta itself carries only the
+ * static route reference + the request-scoped body/bag.
  */
 class MethodMeta {
     /**
@@ -30,11 +33,6 @@ class MethodMeta {
      */
     // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary
     requestDto;
-    /**
-     * Auth metadata from @Public/@Authenticated/@Roles decorators.
-     * Populated by ApiRoutingFactory so filters can read auth requirements.
-     */
-    authMeta;
     /**
      * Additional metadata for storing request-scoped data.
      * Used by filters to pass data to other filters/controllers.
@@ -45,11 +43,10 @@ class MethodMeta {
     // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary
     requestDto, 
     // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data
-    metadata, authMeta) {
+    metadata) {
         this.routeMeta = routeMeta;
         this.requestDto = requestDto;
         this.metadata = metadata ?? new Map();
-        this.authMeta = authMeta ?? routeMeta.authMeta;
     }
     /**
      * Get the HTTP method (convenience accessor).

package/src/MethodMeta.js.map

@@ -1 +1 @@
-{"version":3,"file":"MethodMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/MethodMeta.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,UAAU;IACnB;;OAEG;IACH,SAAS,CAAgB;IAEzB;;OAEG;IACH,wFAAwF;IACxF,UAAU,CAAW;IAErB;;;OAGG;IACH,QAAQ,CAAY;IAEpB;;;OAGG;IACH,yFAAyF;IACzF,QAAQ,CAAuB;IAE/B,YACI,SAAwB;IACxB,wFAAwF;IACxF,UAAoB;IACpB,yFAAyF;IACzF,QAA+B,EAC/B,QAAmB;QAEnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;CACJ;AA3DD,gCA2DC","sourcesContent":["import { RouteMetadata, AuthMeta } from '@webpieces/core-util';\n\n/**\n * Metadata about the method being invoked.\n * Passed to filters and contains request information.\n *\n * MethodMeta is DTO-only - it does NOT contain Express req/res, nor the raw headers. The raw\n * inbound request (headers/method/path) lives on the transport-neutral {@link HttpRequest} in\n * RequestContext (read via `RequestContext.getRequest()`); MethodMeta carries only the typed\n * body + route/auth metadata that flow as the chain's call argument.\n *\n * It is the meta type every `Filter<MethodMeta, …>` is parameterized over. It lives in\n * @webpieces/http-routing and is express-free, so filter authors reference it without pulling\n * in any express dependency.\n *\n * Fields:\n * - routeMeta: Static route information (httpMethod, path, methodName)\n * - requestDto: The deserialized request body\n * - authMeta: Auth mode from @Authentication/@AuthOidc/... decorators\n * - metadata: Request-scoped data for filters to communicate\n */\nexport class MethodMeta {\n    /**\n     * Route metadata (httpMethod, path, methodName, parameterTypes)\n     */\n    routeMeta: RouteMetadata;\n\n    /**\n     * The deserialized request DTO.\n     */\n    // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n    requestDto?: unknown;\n\n    /**\n     * Auth metadata from @Public/@Authenticated/@Roles decorators.\n     * Populated by ApiRoutingFactory so filters can read auth requirements.\n     */\n    authMeta?: AuthMeta;\n\n    /**\n     * Additional metadata for storing request-scoped data.\n     * Used by filters to pass data to other filters/controllers.\n     */\n    // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n    metadata: Map<string, unknown>;\n\n    constructor(\n        routeMeta: RouteMetadata,\n        // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n        requestDto?: unknown,\n        // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n        metadata?: Map<string, unknown>,\n        authMeta?: AuthMeta,\n    ) {\n        this.routeMeta = routeMeta;\n        this.requestDto = requestDto;\n        this.metadata = metadata ?? new Map();\n        this.authMeta = authMeta ?? routeMeta.authMeta;\n    }\n\n    /**\n     * Get the HTTP method (convenience accessor).\n     */\n    get httpMethod(): string {\n        return this.routeMeta.httpMethod;\n    }\n\n    /**\n     * Get the request path (convenience accessor).\n     */\n    get path(): string {\n        return this.routeMeta.path;\n    }\n\n    /**\n     * Get the method name (convenience accessor).\n     */\n    get methodName(): string {\n        return this.routeMeta.methodName;\n    }\n}\n"]}
+{"version":3,"file":"MethodMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/MethodMeta.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAa,UAAU;IACnB;;OAEG;IACH,SAAS,CAAgB;IAEzB;;OAEG;IACH,wFAAwF;IACxF,UAAU,CAAW;IAErB;;;OAGG;IACH,yFAAyF;IACzF,QAAQ,CAAuB;IAE/B,YACI,SAAwB;IACxB,wFAAwF;IACxF,UAAoB;IACpB,yFAAyF;IACzF,QAA+B;QAE/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;CACJ;AAnDD,gCAmDC","sourcesContent":["import { RouteMetadata } from '@webpieces/core-util';\n\n/**\n * Metadata about the method being invoked.\n * Passed to filters and contains request information.\n *\n * MethodMeta is DTO-only - it does NOT contain Express req/res, nor the raw headers. The raw\n * inbound request (headers/method/path) lives on the transport-neutral {@link HttpRequest} in\n * RequestContext (read via `RequestContext.getRequest()`); MethodMeta carries only the typed\n * body + route/auth metadata that flow as the chain's call argument.\n *\n * It is the meta type every `Filter<MethodMeta, …>` is parameterized over. It lives in\n * @webpieces/http-routing and is express-free, so filter authors reference it without pulling\n * in any express dependency.\n *\n * Fields:\n * - routeMeta: Static route information (httpMethod, path, methodName, authMeta)\n * - requestDto: The deserialized request body\n * - metadata: Request-scoped data for filters to communicate\n *\n * Auth mode lives on {@link RouteMetadata.authMeta} (the one source of truth for fixed route\n * metadata); read it via `methodMeta.routeMeta.authMeta`. MethodMeta itself carries only the\n * static route reference + the request-scoped body/bag.\n */\nexport class MethodMeta {\n    /**\n     * Route metadata (httpMethod, path, methodName, parameterTypes)\n     */\n    routeMeta: RouteMetadata;\n\n    /**\n     * The deserialized request DTO.\n     */\n    // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n    requestDto?: unknown;\n\n    /**\n     * Additional metadata for storing request-scoped data.\n     * Used by filters to pass data to other filters/controllers.\n     */\n    // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n    metadata: Map<string, unknown>;\n\n    constructor(\n        routeMeta: RouteMetadata,\n        // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n        requestDto?: unknown,\n        // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n        metadata?: Map<string, unknown>,\n    ) {\n        this.routeMeta = routeMeta;\n        this.requestDto = requestDto;\n        this.metadata = metadata ?? new Map();\n    }\n\n    /**\n     * Get the HTTP method (convenience accessor).\n     */\n    get httpMethod(): string {\n        return this.routeMeta.httpMethod;\n    }\n\n    /**\n     * Get the request path (convenience accessor).\n     */\n    get path(): string {\n        return this.routeMeta.path;\n    }\n\n    /**\n     * Get the method name (convenience accessor).\n     */\n    get methodName(): string {\n        return this.routeMeta.methodName;\n    }\n}\n"]}

package/src/filters/AuthFilter.d.ts

@@ -1,26 +1,33 @@
 import { Filter, WpResponse, Service } from '../Filter';
 import { MethodMeta } from '../MethodMeta';
 import { AuthConfig } from '../AuthConfig';
+import { JwtHook, OidcHook } from '../AuthHooks';
+import { DefaultOidcVerifier } from '../DefaultOidcVerifier';
 /**
  * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every
  * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in
  * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
  *
- * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:
- *  - shared-secret → constant-time compare vs the bound secret VALUE (state).
- *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).
- *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).
- *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a
- *                    logged-out page still knows who is logged in; never fails.
+ * It enforces the endpoint's AuthMode from separately-bound pieces, each OPTIONAL except the OIDC
+ * default:
+ *  - shared-secret → constant-time compare vs the {@link AuthConfig} secret VALUE (state). No
+ *                    AuthConfig bound → no accepted secret → fail fast (401).
+ *  - jwt           → the bound {@link JwtHook} (`parseJwt` + `authorizeJwt`). No JwtHook bound →
+ *                    "not enabled" (401): JWT needs an app secret + payload shape.
+ *  - oidc          → the bound {@link OidcHook} if any, else the framework {@link DefaultOidcVerifier}
+ *                    run DIRECTLY — so a server that wires NOTHING still verifies Google OIDC.
+ *  - public        → BEST-EFFORT jwt parse (only if a JwtHook is bound): stamp the user's context so
+ *                    a logged-out page still knows who is logged in; never fails.
  *
- * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no
- * jsonwebtoken / gcp-identity.
+ * Zero wiring = OIDC just works; an app only binds the hooks it actually uses.
  */
 export declare class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {
+    private readonly oidcVerifier;
     private readonly authConfig?;
-    constructor(authConfig?: AuthConfig | undefined);
+    private readonly jwtHook?;
+    private readonly oidcHook?;
+    constructor(oidcVerifier: DefaultOidcVerifier, authConfig?: AuthConfig | undefined, jwtHook?: JwtHook | undefined, oidcHook?: OidcHook | undefined);
     filter(meta: MethodMeta, nextFilter: Service<MethodMeta, WpResponse<unknown>>): Promise<WpResponse<unknown>>;
-    private requireAuthConfig;
     private enforceJwt;
     private enforceOidc;
     /** `provided` is the Authorization bearer value — the secret itself, same header as a JWT. */

package/src/filters/AuthFilter.js

@@ -8,6 +8,8 @@ const core_context_1 = require("@webpieces/core-context");
 const core_util_1 = require("@webpieces/core-util");
 const Filter_1 = require("../Filter");
 const AuthConfig_1 = require("../AuthConfig");
+const AuthHooks_1 = require("../AuthHooks");
+const DefaultOidcVerifier_1 = require("../DefaultOidcVerifier");
 const log = core_util_1.LogManager.getLogger('AuthFilter');
 /**
  * The ONE credential header, read straight off the inbound HttpRequest.
@@ -35,25 +37,34 @@ const PRINCIPAL_KEY = '__webpieces_principal__';
  * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in
  * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.
  *
- * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:
- *  - shared-secret → constant-time compare vs the bound secret VALUE (state).
- *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).
- *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).
- *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a
- *                    logged-out page still knows who is logged in; never fails.
+ * It enforces the endpoint's AuthMode from separately-bound pieces, each OPTIONAL except the OIDC
+ * default:
+ *  - shared-secret → constant-time compare vs the {@link AuthConfig} secret VALUE (state). No
+ *                    AuthConfig bound → no accepted secret → fail fast (401).
+ *  - jwt           → the bound {@link JwtHook} (`parseJwt` + `authorizeJwt`). No JwtHook bound →
+ *                    "not enabled" (401): JWT needs an app secret + payload shape.
+ *  - oidc          → the bound {@link OidcHook} if any, else the framework {@link DefaultOidcVerifier}
+ *                    run DIRECTLY — so a server that wires NOTHING still verifies Google OIDC.
+ *  - public        → BEST-EFFORT jwt parse (only if a JwtHook is bound): stamp the user's context so
+ *                    a logged-out page still knows who is logged in; never fails.
  *
- * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no
- * jsonwebtoken / gcp-identity.
+ * Zero wiring = OIDC just works; an app only binds the hooks it actually uses.
  */
 let AuthFilter = class AuthFilter extends Filter_1.Filter {
+    oidcVerifier;
     authConfig;
-    constructor(authConfig) {
+    jwtHook;
+    oidcHook;
+    constructor(oidcVerifier, authConfig, jwtHook, oidcHook) {
         super();
+        this.oidcVerifier = oidcVerifier;
         this.authConfig = authConfig;
+        this.jwtHook = jwtHook;
+        this.oidcHook = oidcHook;
     }
     // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility
     async filter(meta, nextFilter) {
-        const mode = meta.authMeta?.mode;
+        const mode = meta.routeMeta.authMeta?.mode;
         const authHeader = core_context_1.RequestContext.getRequest()?.getHeader(AUTHORIZATION_HEADER);
         if (!mode || mode.kind === 'public') {
             // Public: best-effort parse so a logged-out page can still know the logged-in user.
@@ -73,32 +84,34 @@ let AuthFilter = class AuthFilter extends Filter_1.Filter {
         }
         return nextFilter.invoke(meta);
     }
-    requireAuthConfig() {
-        if (!this.authConfig) {
-            throw new core_util_1.HttpUnauthorizedError('No AuthConfig bound — cannot enforce a non-public endpoint');
-        }
-        return this.authConfig;
-    }
     enforceJwt(header, requirement) {
         const token = this.credential(header, BEARER_SCHEME);
         if (!token) {
             throw new core_util_1.HttpUnauthorizedError('Authentication required');
         }
-        const config = this.requireAuthConfig();
-        const values = config.parseJwt(token); // AUTHENTICATE — throws HttpUnauthorizedError if invalid
+        if (!this.jwtHook) {
+            throw new core_util_1.HttpUnauthorizedError('User-JWT auth is not enabled on this server');
+        }
+        const values = this.jwtHook.parseJwt(token); // AUTHENTICATE — throws HttpUnauthorizedError if invalid
         this.applyAuthValues(values);
-        config.authorizeJwt(values, requirement); // AUTHORIZE — app policy; throws HttpForbiddenError to deny
+        this.jwtHook.authorizeJwt(values, requirement); // AUTHORIZE — app policy; throws HttpForbiddenError to deny
     }
     async enforceOidc(header, callers) {
         const token = this.credential(header, BEARER_SCHEME);
         if (!token) {
             throw new core_util_1.HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');
         }
-        await this.requireAuthConfig().verifyOidc(token, callers);
+        // App-bound OidcHook overrides the caller policy; otherwise the framework default runs directly.
+        if (this.oidcHook) {
+            await this.oidcHook.verifyOidc(token, callers);
+        }
+        else {
+            await this.oidcVerifier.verify(token, callers);
+        }
     }
     /** `provided` is the Authorization bearer value — the secret itself, same header as a JWT. */
     enforceSharedSecret(provided, secretKey) {
-        const accepted = this.requireAuthConfig().sharedSecrets[secretKey];
+        const accepted = this.authConfig?.sharedSecrets[secretKey];
         if (!accepted || !provided || !this.matchesEither(provided, accepted)) {
             throw new core_util_1.HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');
         }
@@ -111,12 +124,12 @@ let AuthFilter = class AuthFilter extends Filter_1.Filter {
     /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */
     bestEffortJwt(header) {
         const token = this.credential(header, BEARER_SCHEME);
-        if (!this.authConfig || !token) {
+        if (!this.jwtHook || !token) {
             return;
         }
         // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- best-effort on a public route: a bad/absent token just means "not logged in", must not fail the request
         try {
-            this.applyAuthValues(this.authConfig.parseJwt(token));
+            this.applyAuthValues(this.jwtHook.parseJwt(token));
         }
         catch (err) {
             const error = (0, core_util_1.toError)(err);
@@ -158,8 +171,16 @@ exports.AuthFilter = AuthFilter = tslib_1.__decorate([
     (0, inversify_1.injectable)()
     // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility
     ,
-    tslib_1.__param(0, (0, inversify_1.optional)()),
-    tslib_1.__param(0, (0, inversify_1.inject)(AuthConfig_1.AuthConfig)),
-    tslib_1.__metadata("design:paramtypes", [AuthConfig_1.AuthConfig])
+    tslib_1.__param(0, (0, inversify_1.inject)(DefaultOidcVerifier_1.DefaultOidcVerifier)),
+    tslib_1.__param(1, (0, inversify_1.optional)()),
+    tslib_1.__param(1, (0, inversify_1.inject)(AuthConfig_1.AuthConfig)),
+    tslib_1.__param(2, (0, inversify_1.optional)()),
+    tslib_1.__param(2, (0, inversify_1.inject)(AuthHooks_1.JwtHook)),
+    tslib_1.__param(3, (0, inversify_1.optional)()),
+    tslib_1.__param(3, (0, inversify_1.inject)(AuthHooks_1.OidcHook)),
+    tslib_1.__metadata("design:paramtypes", [DefaultOidcVerifier_1.DefaultOidcVerifier,
+        AuthConfig_1.AuthConfig,
+        AuthHooks_1.JwtHook,
+        AuthHooks_1.OidcHook])
 ], AuthFilter);
 //# sourceMappingURL=AuthFilter.js.map

package/src/filters/AuthFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-routing/src/filters/AuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAyD;AACzD,mCAAyC;AACzC,0DAAoF;AACpF,oDAAkG;AAClG,sCAAwD;AAExD,8CAAsE;AAEtE,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC,qGAAqG;AACrG,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;;;;;;GAcG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAuC;IAId;IAHrD,YAGqD,UAAuB;QAExE,KAAK,EAAE,CAAC;QAFyC,eAAU,GAAV,UAAU,CAAa;IAG5E,CAAC;IAED,iGAAiG;IACxF,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;QACjC,MAAM,UAAU,GAAG,6BAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAEhF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,oFAAoF;YACpF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,KAAK;gBACN,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC9C,MAAM;YACV,KAAK,MAAM;gBACP,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM;YACV,KAAK,eAAe;gBAChB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5F,MAAM;QACd,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,iCAAqB,CAAC,4DAA4D,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,UAAU,CAAC,MAA0B,EAAE,WAA2B;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,yDAAyD;QAChG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,4DAA4D;IAC1G,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAA0B,EAAE,OAAiB;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,8FAA8F;IACtF,mBAAmB,CAAC,QAA4B,EAAE,SAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,aAAa,CAAC,QAAgB,EAAE,QAAuB;QAC3D,OAAO,CACH,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChF,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CACnF,CAAC;IACN,CAAC;IAED,4FAA4F;IACpF,aAAa,CAAC,MAA0B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7B,OAAO;QACX,CAAC;QACD,yKAAyK;QACzK,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,6EAA6E,EAAE,KAAK,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IAED,uFAAuF;IAC/E,eAAe,CAAC,MAAkB;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,6BAAc,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,6BAAc,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,MAA0B,EAAE,MAAc;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QAC5B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AA5HY,gCAAU;qBAAV,UAAU;IAHtB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,iGAAiG;;IAKxF,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,uBAAU,CAAC,CAAA;6CAA+B,uBAAU;GAJnE,UAAU,CA4HtB","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { HttpUnauthorizedError, JwtRequirement, LogManager, toError } from '@webpieces/core-util';\nimport { Filter, WpResponse, Service } from '../Filter';\nimport { MethodMeta } from '../MethodMeta';\nimport { AuthConfig, AuthValues, SharedSecrets } from '../AuthConfig';\n\nconst log = LogManager.getLogger('AuthFilter');\n\n/**\n * The ONE credential header, read straight off the inbound HttpRequest.\n *\n * Deliberately NOT a ContextKey: a ContextKey with an httpHeader is a TRANSFERRED key, which would\n * put the caller's credential into RequestContext and hence onto every outbound call this service\n * makes, and onto every Cloud Task it enqueues. A credential belongs to ONE request hop.\n */\nconst AUTHORIZATION_HEADER = 'authorization';\n\n/**\n * The scheme (first word of the Authorization value) names WHICH credential follows, so a secret\n * can never be mistaken for a token, nor accepted where the other was expected:\n *\n *   Authorization: Bearer <user JWT | service OIDC token>\n *   Authorization: Webpieces <@AuthSharedSecret value>\n *\n * The scheme is REQUIRED. A bare value with no scheme is rejected.\n */\nconst BEARER_SCHEME = 'Bearer';\nconst SHARED_SECRET_SCHEME = 'Webpieces';\n\n/** Reserved context key holding the authenticated {@link AuthValues} (stamped after a jwt parse). */\nconst PRINCIPAL_KEY = '__webpieces_principal__';\n\n/**\n * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every\n * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in\n * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.\n *\n * It enforces the endpoint's AuthMode using the injected app-bound {@link AuthConfig}:\n *  - shared-secret → constant-time compare vs the bound secret VALUE (state).\n *  - jwt           → `parseJwt` → stamp the user's context values + enforce @AuthJwt(...roles).\n *  - oidc          → `verifyOidc` (delegates to gcp-identity in the company layer).\n *  - public        → BEST-EFFORT jwt parse: if a token is present, stamp the user's context so a\n *                    logged-out page still knows who is logged in; never fails.\n *\n * The verifiers/secrets are app-provided (rebindable in tests), so http-routing needs no\n * jsonwebtoken / gcp-identity.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\nexport class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    constructor(\n        // @optional: a public-only server need not bind an AuthConfig; a non-public route then\n        // fails fast in requireAuthConfig().\n        @optional() @inject(AuthConfig) private readonly authConfig?: AuthConfig,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const mode = meta.authMeta?.mode;\n        const authHeader = RequestContext.getRequest()?.getHeader(AUTHORIZATION_HEADER);\n\n        if (!mode || mode.kind === 'public') {\n            // Public: best-effort parse so a logged-out page can still know the logged-in user.\n            this.bestEffortJwt(authHeader);\n            return nextFilter.invoke(meta);\n        }\n\n        switch (mode.kind) {\n            case 'jwt':\n                this.enforceJwt(authHeader, mode.requirement);\n                break;\n            case 'oidc':\n                await this.enforceOidc(authHeader, mode.callers);\n                break;\n            case 'shared-secret':\n                this.enforceSharedSecret(this.credential(authHeader, SHARED_SECRET_SCHEME), mode.secretKey);\n                break;\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    private requireAuthConfig(): AuthConfig {\n        if (!this.authConfig) {\n            throw new HttpUnauthorizedError('No AuthConfig bound — cannot enforce a non-public endpoint');\n        }\n        return this.authConfig;\n    }\n\n    private enforceJwt(header: string | undefined, requirement: JwtRequirement): void {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!token) {\n            throw new HttpUnauthorizedError('Authentication required');\n        }\n        const config = this.requireAuthConfig();\n        const values = config.parseJwt(token); // AUTHENTICATE — throws HttpUnauthorizedError if invalid\n        this.applyAuthValues(values);\n        config.authorizeJwt(values, requirement); // AUTHORIZE — app policy; throws HttpForbiddenError to deny\n    }\n\n    private async enforceOidc(header: string | undefined, callers: string[]): Promise<void> {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        await this.requireAuthConfig().verifyOidc(token, callers);\n    }\n\n    /** `provided` is the Authorization bearer value — the secret itself, same header as a JWT. */\n    private enforceSharedSecret(provided: string | undefined, secretKey: string): void {\n        const accepted = this.requireAuthConfig().sharedSecrets[secretKey];\n        if (!accepted || !provided || !this.matchesEither(provided, accepted)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    /** EITHER secret1 or secret2 passes — the rotation window. Constant-time on each non-empty slot. */\n    private matchesEither(provided: string, accepted: SharedSecrets): boolean {\n        return (\n            (accepted.secret1 !== '' && this.constantTimeEquals(provided, accepted.secret1)) ||\n            (accepted.secret2 !== '' && this.constantTimeEquals(provided, accepted.secret2))\n        );\n    }\n\n    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */\n    private bestEffortJwt(header: string | undefined): void {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!this.authConfig || !token) {\n            return;\n        }\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- best-effort on a public route: a bad/absent token just means \"not logged in\", must not fail the request\n        try {\n            this.applyAuthValues(this.authConfig.parseJwt(token));\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.debug('Best-effort JWT parse on a public endpoint failed (treating as anonymous): ', error);\n        }\n    }\n\n    /** Stamp the parsed user's context entries + the principal into the RequestContext. */\n    private applyAuthValues(values: AuthValues): void {\n        for (const entry of values.entries) {\n            RequestContext.putHeader(entry.key, entry.value);\n        }\n        RequestContext.put(PRINCIPAL_KEY, values);\n    }\n\n    /**\n     * The credential value IF the header carries the expected scheme, else undefined.\n     *\n     * Strict: a bare value with no scheme, or a value under the WRONG scheme (a shared secret sent\n     * where a JWT is expected), yields undefined and the caller 401s.\n     */\n    private credential(header: string | undefined, scheme: string): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = `${scheme} `;\n        return header.startsWith(prefix) ? header.substring(prefix.length) : undefined;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}
+{"version":3,"file":"AuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-routing/src/filters/AuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAyD;AACzD,mCAAyC;AACzC,0DAAoF;AACpF,oDAAkG;AAClG,sCAAwD;AAExD,8CAAsE;AACtE,4CAAiD;AACjD,gEAA6D;AAE7D,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC,qGAAqG;AACrG,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AAII,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAuC;IAIjB;IAGG;IAGH;IAGC;IAZnD,YAGkD,YAAiC,EAG9B,UAAuB,EAG1B,OAAiB,EAGhB,QAAmB;QAElE,KAAK,EAAE,CAAC;QAXsC,iBAAY,GAAZ,YAAY,CAAqB;QAG9B,eAAU,GAAV,UAAU,CAAa;QAG1B,YAAO,GAAP,OAAO,CAAU;QAGhB,aAAQ,GAAR,QAAQ,CAAW;IAGtE,CAAC;IAED,iGAAiG;IACxF,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC3C,MAAM,UAAU,GAAG,6BAAc,CAAC,UAAU,EAAE,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAEhF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,oFAAoF;YACpF,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC/B,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,KAAK;gBACN,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC9C,MAAM;YACV,KAAK,MAAM;gBACP,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACjD,MAAM;YACV,KAAK,eAAe;gBAChB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,oBAAoB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC5F,MAAM;QACd,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,UAAU,CAAC,MAA0B,EAAE,WAA2B;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,iCAAqB,CAAC,6CAA6C,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,yDAAyD;QACtG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,4DAA4D;IAChH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAA0B,EAAE,OAAiB;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,iGAAiG;QACjG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAED,8FAA8F;IACtF,mBAAmB,CAAC,QAA4B,EAAE,SAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,aAAa,CAAC,QAAgB,EAAE,QAAuB;QAC3D,OAAO,CACH,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChF,CAAC,QAAQ,CAAC,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CACnF,CAAC;IACN,CAAC;IAED,4FAA4F;IACpF,aAAa,CAAC,MAA0B;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO;QACX,CAAC;QACD,yKAAyK;QACzK,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,6EAA6E,EAAE,KAAK,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IAED,uFAAuF;IAC/E,eAAe,CAAC,MAAkB;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,6BAAc,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,6BAAc,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACK,UAAU,CAAC,MAA0B,EAAE,MAAc;QACzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QAC5B,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AArIY,gCAAU;qBAAV,UAAU;IAHtB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,iGAAiG;;IAKxF,mBAAA,IAAA,kBAAM,EAAC,yCAAmB,CAAC,CAAA;IAG3B,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,uBAAU,CAAC,CAAA;IAG9B,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,mBAAO,CAAC,CAAA;IAG3B,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,oBAAQ,CAAC,CAAA;6CAT+B,yCAAmB;QAGjB,uBAAU;QAGhB,mBAAO;QAGL,oBAAQ;GAb7D,UAAU,CAqItB","sourcesContent":["import { inject, injectable, optional } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { HttpUnauthorizedError, JwtRequirement, LogManager, toError } from '@webpieces/core-util';\nimport { Filter, WpResponse, Service } from '../Filter';\nimport { MethodMeta } from '../MethodMeta';\nimport { AuthConfig, AuthValues, SharedSecrets } from '../AuthConfig';\nimport { JwtHook, OidcHook } from '../AuthHooks';\nimport { DefaultOidcVerifier } from '../DefaultOidcVerifier';\n\nconst log = LogManager.getLogger('AuthFilter');\n\n/**\n * The ONE credential header, read straight off the inbound HttpRequest.\n *\n * Deliberately NOT a ContextKey: a ContextKey with an httpHeader is a TRANSFERRED key, which would\n * put the caller's credential into RequestContext and hence onto every outbound call this service\n * makes, and onto every Cloud Task it enqueues. A credential belongs to ONE request hop.\n */\nconst AUTHORIZATION_HEADER = 'authorization';\n\n/**\n * The scheme (first word of the Authorization value) names WHICH credential follows, so a secret\n * can never be mistaken for a token, nor accepted where the other was expected:\n *\n *   Authorization: Bearer <user JWT | service OIDC token>\n *   Authorization: Webpieces <@AuthSharedSecret value>\n *\n * The scheme is REQUIRED. A bare value with no scheme is rejected.\n */\nconst BEARER_SCHEME = 'Bearer';\nconst SHARED_SECRET_SCHEME = 'Webpieces';\n\n/** Reserved context key holding the authenticated {@link AuthValues} (stamped after a jwt parse). */\nconst PRINCIPAL_KEY = '__webpieces_principal__';\n\n/**\n * AuthFilter - the ONE framework auth filter, auto-installed just below the error filter on every\n * route. It is TRANSPORT-NEUTRAL: it reads the raw credential from the {@link HttpRequest} in\n * RequestContext (never express), so the SAME check runs over HTTP and via createApiClient.\n *\n * It enforces the endpoint's AuthMode from separately-bound pieces, each OPTIONAL except the OIDC\n * default:\n *  - shared-secret → constant-time compare vs the {@link AuthConfig} secret VALUE (state). No\n *                    AuthConfig bound → no accepted secret → fail fast (401).\n *  - jwt           → the bound {@link JwtHook} (`parseJwt` + `authorizeJwt`). No JwtHook bound →\n *                    \"not enabled\" (401): JWT needs an app secret + payload shape.\n *  - oidc          → the bound {@link OidcHook} if any, else the framework {@link DefaultOidcVerifier}\n *                    run DIRECTLY — so a server that wires NOTHING still verifies Google OIDC.\n *  - public        → BEST-EFFORT jwt parse (only if a JwtHook is bound): stamp the user's context so\n *                    a logged-out page still knows who is logged in; never fails.\n *\n * Zero wiring = OIDC just works; an app only binds the hooks it actually uses.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\nexport class AuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    constructor(\n        // Framework default, always available — verifies Google OIDC with zero app wiring.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- AuthFilter is DI-resolved via the esbuild/vitest path, which elides type-only imports (no design:paramtypes), so every param needs its explicit token\n        @inject(DefaultOidcVerifier) private readonly oidcVerifier: DefaultOidcVerifier,\n        // @optional: only bind an AuthConfig to enable @AuthSharedSecret endpoints.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- see above: explicit token required for DI-resolved param\n        @optional() @inject(AuthConfig) private readonly authConfig?: AuthConfig,\n        // @optional: only bind a JwtHook to enable @AuthJwt endpoints.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- see above: explicit token required for DI-resolved param\n        @optional() @inject(JwtHook) private readonly jwtHook?: JwtHook,\n        // @optional: only bind an OidcHook to OVERRIDE the DefaultOidcVerifier caller policy.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- see above: explicit token required for DI-resolved param\n        @optional() @inject(OidcHook) private readonly oidcHook?: OidcHook,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const mode = meta.routeMeta.authMeta?.mode;\n        const authHeader = RequestContext.getRequest()?.getHeader(AUTHORIZATION_HEADER);\n\n        if (!mode || mode.kind === 'public') {\n            // Public: best-effort parse so a logged-out page can still know the logged-in user.\n            this.bestEffortJwt(authHeader);\n            return nextFilter.invoke(meta);\n        }\n\n        switch (mode.kind) {\n            case 'jwt':\n                this.enforceJwt(authHeader, mode.requirement);\n                break;\n            case 'oidc':\n                await this.enforceOidc(authHeader, mode.callers);\n                break;\n            case 'shared-secret':\n                this.enforceSharedSecret(this.credential(authHeader, SHARED_SECRET_SCHEME), mode.secretKey);\n                break;\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    private enforceJwt(header: string | undefined, requirement: JwtRequirement): void {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!token) {\n            throw new HttpUnauthorizedError('Authentication required');\n        }\n        if (!this.jwtHook) {\n            throw new HttpUnauthorizedError('User-JWT auth is not enabled on this server');\n        }\n        const values = this.jwtHook.parseJwt(token); // AUTHENTICATE — throws HttpUnauthorizedError if invalid\n        this.applyAuthValues(values);\n        this.jwtHook.authorizeJwt(values, requirement); // AUTHORIZE — app policy; throws HttpForbiddenError to deny\n    }\n\n    private async enforceOidc(header: string | undefined, callers: string[]): Promise<void> {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        // App-bound OidcHook overrides the caller policy; otherwise the framework default runs directly.\n        if (this.oidcHook) {\n            await this.oidcHook.verifyOidc(token, callers);\n        } else {\n            await this.oidcVerifier.verify(token, callers);\n        }\n    }\n\n    /** `provided` is the Authorization bearer value — the secret itself, same header as a JWT. */\n    private enforceSharedSecret(provided: string | undefined, secretKey: string): void {\n        const accepted = this.authConfig?.sharedSecrets[secretKey];\n        if (!accepted || !provided || !this.matchesEither(provided, accepted)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    /** EITHER secret1 or secret2 passes — the rotation window. Constant-time on each non-empty slot. */\n    private matchesEither(provided: string, accepted: SharedSecrets): boolean {\n        return (\n            (accepted.secret1 !== '' && this.constantTimeEquals(provided, accepted.secret1)) ||\n            (accepted.secret2 !== '' && this.constantTimeEquals(provided, accepted.secret2))\n        );\n    }\n\n    /** Parse a JWT if one is present, else do nothing — used on public routes; never throws. */\n    private bestEffortJwt(header: string | undefined): void {\n        const token = this.credential(header, BEARER_SCHEME);\n        if (!this.jwtHook || !token) {\n            return;\n        }\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- best-effort on a public route: a bad/absent token just means \"not logged in\", must not fail the request\n        try {\n            this.applyAuthValues(this.jwtHook.parseJwt(token));\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.debug('Best-effort JWT parse on a public endpoint failed (treating as anonymous): ', error);\n        }\n    }\n\n    /** Stamp the parsed user's context entries + the principal into the RequestContext. */\n    private applyAuthValues(values: AuthValues): void {\n        for (const entry of values.entries) {\n            RequestContext.putHeader(entry.key, entry.value);\n        }\n        RequestContext.put(PRINCIPAL_KEY, values);\n    }\n\n    /**\n     * The credential value IF the header carries the expected scheme, else undefined.\n     *\n     * Strict: a bare value with no scheme, or a value under the WRONG scheme (a shared secret sent\n     * where a JWT is expected), yields undefined and the caller 401s.\n     */\n    private credential(header: string | undefined, scheme: string): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = `${scheme} `;\n        return header.startsWith(prefix) ? header.substring(prefix.length) : undefined;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}

package/src/index.d.ts

@@ -14,6 +14,9 @@ export { FilterMatcher, HttpFilter } from './FilterMatcher';
 export { ApiFactory } from './ApiFactory';
 export { ApiClient, ApiClientProxy } from './ApiClient';
 export { AuthConfig, AuthValues, SharedSecrets } from './AuthConfig';
+export { JwtHook, OidcHook } from './AuthHooks';
+export { DefaultOidcVerifier } from './DefaultOidcVerifier';
+export { DefaultJwtHook } from './DefaultJwtHook';
 export { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';
 export { setupRuntime, RuntimeSetupOptions } from './setupRuntime';
 export { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';

package/src/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.SharedSecrets = exports.AuthValues = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonDefaultForApi = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
-exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = void 0;
+exports.OidcHook = exports.JwtHook = exports.SharedSecrets = exports.AuthValues = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonDefaultForApi = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
+exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.DefaultJwtHook = exports.DefaultOidcVerifier = void 0;
 // Re-export API decorators from core-util for convenience
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "ApiPath", { enumerable: true, get: function () { return core_util_1.ApiPath; } });
@@ -73,11 +73,22 @@ var FilterMatcher_1 = require("./FilterMatcher");
 Object.defineProperty(exports, "FilterMatcher", { enumerable: true, get: function () { return FilterMatcher_1.FilterMatcher; } });
 var ApiClient_1 = require("./ApiClient");
 Object.defineProperty(exports, "ApiClient", { enumerable: true, get: function () { return ApiClient_1.ApiClient; } });
-// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.
+// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.
+//  - AuthConfig: shared-secret STATE (@AuthSharedSecret values).
+//  - JwtHook / OidcHook: OPTIONAL verification mechanisms (bind only what you use).
+//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.
 var AuthConfig_1 = require("./AuthConfig");
 Object.defineProperty(exports, "AuthConfig", { enumerable: true, get: function () { return AuthConfig_1.AuthConfig; } });
 Object.defineProperty(exports, "AuthValues", { enumerable: true, get: function () { return AuthConfig_1.AuthValues; } });
 Object.defineProperty(exports, "SharedSecrets", { enumerable: true, get: function () { return AuthConfig_1.SharedSecrets; } });
+var AuthHooks_1 = require("./AuthHooks");
+Object.defineProperty(exports, "JwtHook", { enumerable: true, get: function () { return AuthHooks_1.JwtHook; } });
+Object.defineProperty(exports, "OidcHook", { enumerable: true, get: function () { return AuthHooks_1.OidcHook; } });
+var DefaultOidcVerifier_1 = require("./DefaultOidcVerifier");
+Object.defineProperty(exports, "DefaultOidcVerifier", { enumerable: true, get: function () { return DefaultOidcVerifier_1.DefaultOidcVerifier; } });
+// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.
+var DefaultJwtHook_1 = require("./DefaultJwtHook");
+Object.defineProperty(exports, "DefaultJwtHook", { enumerable: true, get: function () { return DefaultJwtHook_1.DefaultJwtHook; } });
 // Above-boundary context setup shared by every transport adapter.
 // Node-only router (the express-free heart: container + filter chain + in-process client)
 var WebpiecesRouter_1 = require("./WebpiecesRouter");

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAA4G;AAAnG,gHAAA,gBAAgB,OAAA;AAAE,6HAAA,6BAA6B,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC1E,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,uFAAuF;AACvF,2CAAqE;AAA5D,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE9C,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonDefaultForApi, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.\nexport { AuthConfig, AuthValues, SharedSecrets } from './AuthConfig';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAA4G;AAAnG,gHAAA,gBAAgB,OAAA;AAAE,6HAAA,6BAA6B,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC1E,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,mFAAmF;AACnF,iEAAiE;AACjE,oFAAoF;AACpF,4FAA4F;AAC5F,2CAAqE;AAA5D,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,2GAAA,aAAa,OAAA;AAC9C,yCAAgD;AAAvC,oGAAA,OAAO,OAAA;AAAE,qGAAA,QAAQ,OAAA;AAC1B,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,0FAA0F;AAC1F,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAEvB,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonDefaultForApi, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.\n//  - AuthConfig: shared-secret STATE (@AuthSharedSecret values).\n//  - JwtHook / OidcHook: OPTIONAL verification mechanisms (bind only what you use).\n//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.\nexport { AuthConfig, AuthValues, SharedSecrets } from './AuthConfig';\nexport { JwtHook, OidcHook } from './AuthHooks';\nexport { DefaultOidcVerifier } from './DefaultOidcVerifier';\n// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.\nexport { DefaultJwtHook } from './DefaultJwtHook';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}