@webpieces/http-routing 0.3.353 → 0.3.354

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.353",
+  "version": "0.3.354",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.353",
-    "@webpieces/core-util": "0.3.353",
-    "@webpieces/gcp-identity": "0.3.353",
+    "@webpieces/core-context": "0.3.354",
+    "@webpieces/core-util": "0.3.354",
+    "@webpieces/gcp-identity": "0.3.354",
     "inversify": "7.10.4",
     "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1"

package/src/DefaultOidcVerifier.d.ts

@@ -1,3 +1,4 @@
+import { GcpOidc } from '@webpieces/gcp-identity';
 /**
  * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into
  * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes
@@ -14,5 +15,7 @@
  * parallel-safe.
  */
 export declare class DefaultOidcVerifier {
+    private readonly gcpOidc;
+    constructor(gcpOidc: GcpOidc);
     verify(token: string, callers: string[]): Promise<void>;
 }

package/src/DefaultOidcVerifier.js

@@ -22,11 +22,15 @@ const gcp_identity_1 = require("@webpieces/gcp-identity");
  * parallel-safe.
  */
 let DefaultOidcVerifier = class DefaultOidcVerifier {
+    gcpOidc;
+    constructor(gcpOidc) {
+        this.gcpOidc = gcpOidc;
+    }
     async verify(token, callers) {
         // callers pass straight through: EMPTY (@AuthOidc() with no callers) = TRUST THE EDGE, a
         // non-empty list enforces the explicit allow-list. Do NOT inject a ['self'] default — that
         // would reject a legitimate cross-SA caller the edge already admitted.
-        const result = await (0, gcp_identity_1.verifyOidcFromCallers)(token, callers);
+        const result = await this.gcpOidc.verifyFromCallers(token, callers);
         if (!result.ok) {
             throw new core_util_1.HttpUnauthorizedError(`OIDC rejected: ${result.reason ?? 'not an allowed caller'}`);
         }
@@ -35,6 +39,8 @@ let DefaultOidcVerifier = class DefaultOidcVerifier {
 exports.DefaultOidcVerifier = DefaultOidcVerifier;
 exports.DefaultOidcVerifier = DefaultOidcVerifier = tslib_1.__decorate([
     (0, core_context_1.provideFrameworkSingleton)(),
-    (0, inversify_1.injectable)()
+    (0, inversify_1.injectable)(),
+    tslib_1.__param(0, (0, inversify_1.inject)(gcp_identity_1.GcpOidc)),
+    tslib_1.__metadata("design:paramtypes", [gcp_identity_1.GcpOidc])
 ], DefaultOidcVerifier);
 //# sourceMappingURL=DefaultOidcVerifier.js.map

package/src/DefaultOidcVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"DefaultOidcVerifier.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/DefaultOidcVerifier.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,0DAAoE;AACpE,oDAA6D;AAC7D,0DAAgE;AAEhE;;;;;;;;;;;;;;GAcG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAiB;QACzC,yFAAyF;QACzF,2FAA2F;QAC3F,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,kBAAkB,MAAM,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;QAClG,CAAC;IACL,CAAC;CACJ,CAAA;AAVY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;GACA,mBAAmB,CAU/B","sourcesContent":["import { injectable } from 'inversify';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\nimport { HttpUnauthorizedError } from '@webpieces/core-util';\nimport { verifyOidcFromCallers } from '@webpieces/gcp-identity';\n\n/**\n * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into\n * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes\n * OIDC \"just work\" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a\n * server that binds nothing still verifies service-to-service OIDC.\n *\n * `verify` honors the endpoint's `@AuthOidc(...callers)` contract exactly: EMPTY (a bare `@AuthOidc()`)\n * = TRUST THE EDGE — verify the token is genuinely Google-signed and let the deployment's `run.invoker`\n * IAM restrict WHO (gcp-identity warns loudly, once, if the service is actually public and thus the\n * edge is NOT the gate). A non-empty list (`@AuthOidc('svc-a')`) enforces that explicit app-level\n * allow-list as defense-in-depth. Off-GCP, gcp-identity mints + accepts a dev token so local dev needs\n * no GCP. Framework code reads NO process.env — an app that wants an env-driven allow-list binds an\n * {@link OidcHook} instead (env read at its composition root), keeping this default env-free and tests\n * parallel-safe.\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class DefaultOidcVerifier {\n    async verify(token: string, callers: string[]): Promise<void> {\n        // callers pass straight through: EMPTY (@AuthOidc() with no callers) = TRUST THE EDGE, a\n        // non-empty list enforces the explicit allow-list. Do NOT inject a ['self'] default — that\n        // would reject a legitimate cross-SA caller the edge already admitted.\n        const result = await verifyOidcFromCallers(token, callers);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC rejected: ${result.reason ?? 'not an allowed caller'}`);\n        }\n    }\n}\n"]}
+{"version":3,"file":"DefaultOidcVerifier.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/DefaultOidcVerifier.ts"],"names":[],"mappings":";;;;AAAA,yCAA+C;AAC/C,0DAAoE;AACpE,oDAA6D;AAC7D,0DAAkD;AAElD;;;;;;;;;;;;;;GAcG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAGU;IAFtC,YAEsC,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IACnD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,OAAiB;QACzC,yFAAyF;QACzF,2FAA2F;QAC3F,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,kBAAkB,MAAM,CAAC,MAAM,IAAI,uBAAuB,EAAE,CAAC,CAAC;QAClG,CAAC;IACL,CAAC;CACJ,CAAA;AAfY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IAIJ,mBAAA,IAAA,kBAAM,EAAC,sBAAO,CAAC,CAAA;6CAA2B,sBAAO;GAH7C,mBAAmB,CAe/B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\nimport { HttpUnauthorizedError } from '@webpieces/core-util';\nimport { GcpOidc } from '@webpieces/gcp-identity';\n\n/**\n * DefaultOidcVerifier - the framework's built-in Google OIDC verifier, injected into\n * {@link AuthFilter} and run directly whenever no app {@link OidcHook} is bound. It is what makes\n * OIDC \"just work\" with ZERO wiring: http-routing depends on @webpieces/gcp-identity ON PURPOSE so a\n * server that binds nothing still verifies service-to-service OIDC.\n *\n * `verify` honors the endpoint's `@AuthOidc(...callers)` contract exactly: EMPTY (a bare `@AuthOidc()`)\n * = TRUST THE EDGE — verify the token is genuinely Google-signed and let the deployment's `run.invoker`\n * IAM restrict WHO (gcp-identity warns loudly, once, if the service is actually public and thus the\n * edge is NOT the gate). A non-empty list (`@AuthOidc('svc-a')`) enforces that explicit app-level\n * allow-list as defense-in-depth. Off-GCP, gcp-identity mints + accepts a dev token so local dev needs\n * no GCP. Framework code reads NO process.env — an app that wants an env-driven allow-list binds an\n * {@link OidcHook} instead (env read at its composition root), keeping this default env-free and tests\n * parallel-safe.\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class DefaultOidcVerifier {\n    constructor(\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(GcpOidc) private readonly gcpOidc: GcpOidc,\n    ) {}\n\n    async verify(token: string, callers: string[]): Promise<void> {\n        // callers pass straight through: EMPTY (@AuthOidc() with no callers) = TRUST THE EDGE, a\n        // non-empty list enforces the explicit allow-list. Do NOT inject a ['self'] default — that\n        // would reject a legitimate cross-SA caller the edge already admitted.\n        const result = await this.gcpOidc.verifyFromCallers(token, callers);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC rejected: ${result.reason ?? 'not an allowed caller'}`);\n        }\n    }\n}\n"]}