@winstonsayno/mcp-gateway 1.1.0 → 1.3.0

package/dist/auth/middleware.js

@@ -10,11 +10,19 @@
  *  - The client id attached to a request is a hash fingerprint of the key,
  *    never a prefix of the key itself (prefixes were leaking into logs and the
  *    /requests endpoint, and keys sharing a prefix shared a rate-limit bucket).
+ *  - Keys may be stored as SHA-256 digests (`sha256:<hex>`), so the config
+ *    file never holds a usable key. A digest key and its plain form produce
+ *    the same client id.
+ *  - Keys can expire (`expiresAt`) or be switched off (`disabled`).
+ *  - JWTs: HMAC secret, PEM public key or JWKS URL; algorithm allowlist that
+ *    never mixes HMAC and asymmetric algorithms; optional issuer / audience /
+ *    exp / max-age checks and clock tolerance.
  */
-import { createHash, timingSafeEqual } from 'crypto';
-import { jwtVerify } from 'jose';
+import { createHash, createPublicKey, timingSafeEqual } from 'crypto';
+import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { logger } from '../utils/logger.js';
 import { scopeFromJwt } from './scopes.js';
+import { oauthMiddleware } from './oauth.js';
 /** Normalise `auth.apiKeys` entries (plain strings or objects). */
 export function normalizeApiKeys(keys) {
     return (keys ?? [])
@@ -33,8 +41,38 @@ function scopeOf(entry) {
         scope.rateLimit = { ...entry.rateLimit, perKey: true };
     return Object.keys(scope).length > 0 ? scope : undefined;
 }
-const JWT_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
-export function createAuthMiddleware(config) {
+export const HMAC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+export const ASYMMETRIC_ALGORITHMS = [
+    'RS256', 'RS384', 'RS512',
+    'PS256', 'PS384', 'PS512',
+    'ES256', 'ES384', 'ES512',
+    'EdDSA',
+];
+const HASHED_KEY_RE = /^sha256:([0-9a-f]{64})$/i;
+/** Whether a configured key is a `sha256:<hex>` digest rather than the key itself. */
+export function isHashedKey(key) {
+    return HASHED_KEY_RE.test(key);
+}
+/** `sha256:<hex>` digest of a key, the form to store in the config file. */
+export function hashApiKey(key) {
+    return `sha256:${createHash('sha256').update(key, 'utf8').digest('hex')}`;
+}
+/** Expiry of a key entry as epoch ms (undefined = never; NaN for an unparsable date). */
+export function keyExpiry(entry) {
+    if (entry.expiresAt === undefined)
+        return undefined;
+    return Date.parse(entry.expiresAt);
+}
+/** Why a key is currently unusable, or undefined when it is active. */
+export function keyInactiveReason(entry, now = Date.now()) {
+    if (entry.disabled)
+        return 'disabled';
+    const exp = keyExpiry(entry);
+    if (exp !== undefined && !(exp > now))
+        return 'expired';
+    return undefined;
+}
+export function createAuthMiddleware(config, options = {}) {
     if (!config || config.strategy === 'none') {
         const none = (_req, _res, next) => next();
         none.resolveClient = () => ({ known: true });
@@ -56,15 +94,12 @@ export function createAuthMiddleware(config) {
             }
             return apiKeyMiddleware(keys);
         }
-        case 'jwt': {
-            if (!config.jwtSecret) {
-                throw new Error('auth.strategy is "jwt" but auth.jwtSecret is not configured');
-            }
-            if (config.jwtSecret.length < 32) {
-                logger.warn('auth.jwtSecret is shorter than 32 characters; use a longer random secret');
-            }
-            return jwtMiddleware(config.jwtSecret);
-        }
+        case 'jwt':
+            return jwtMiddleware(buildJwtVerifier(config));
+        case 'oauth2':
+            if (!config.oauth)
+                throw new Error('auth.strategy is "oauth2" but auth.oauth is not configured');
+            return oauthMiddleware(config.oauth, { mcpPath: options.mcpPath ?? (() => '/mcp'), fetch: options.fetch });
         default:
             // Fail closed. Previously this fell back to *no auth*, so configuring the
             // advertised-but-unimplemented "oauth2" strategy exposed every endpoint.
@@ -74,7 +109,15 @@ export function createAuthMiddleware(config) {
 function digest(value) {
     return createHash('sha256').update(value, 'utf8').digest();
 }
+/** Digest of a configured key: the stored digest for `sha256:` keys, else SHA-256 of the key. */
+function configuredDigest(key) {
+    const m = HASHED_KEY_RE.exec(key);
+    return m ? Buffer.from(m[1], 'hex') : digest(key);
+}
 export function fingerprint(key) {
+    const m = HASHED_KEY_RE.exec(key);
+    if (m)
+        return m[1].toLowerCase().slice(0, 12);
     return createHash('sha256').update(key, 'utf8').digest('hex').slice(0, 12);
 }
 /** Constant-time membership check against a pre-hashed key list. */
@@ -103,7 +146,12 @@ function extractKey(req) {
     return undefined;
 }
 function apiKeyMiddleware(entries) {
-    const keyDigests = entries.map((e) => digest(e.key));
+    for (const e of entries) {
+        if (e.expiresAt !== undefined && Number.isNaN(keyExpiry(e))) {
+            throw new Error(`auth.apiKeys: invalid expiresAt "${e.expiresAt}"${e.name ? ` (key "${e.name}")` : ''}`);
+        }
+    }
+    const keyDigests = entries.map((e) => configuredDigest(e.key));
     const clients = entries.map((e) => ({
         clientId: e.name ? `key:${e.name}` : `key:${fingerprint(e.key)}`,
         scope: scopeOf(e),
@@ -118,6 +166,12 @@ function apiKeyMiddleware(entries) {
             return;
         }
         const client = clients[index];
+        const inactive = keyInactiveReason(entries[index]);
+        if (inactive) {
+            logger.warn(`Unauthorized request from ${req.ip}: API key ${client.clientId} is ${inactive}`);
+            res.status(401).json({ error: 'Unauthorized', message: 'Valid API key required' });
+            return;
+        }
         req.clientId = client.clientId;
         if (client.scope)
             req.scope = client.scope;
@@ -125,12 +179,87 @@ function apiKeyMiddleware(entries) {
     };
     mw.resolveClient = (clientId) => {
         const c = clientId ? byClientId.get(clientId) : undefined;
-        return c ? { known: true, scope: c.scope } : { known: false };
+        if (!c || keyInactiveReason(entries[clients.indexOf(c)]))
+            return { known: false };
+        return { known: true, scope: c.scope };
     };
     return mw;
 }
-function jwtMiddleware(secret) {
-    const secretKey = new TextEncoder().encode(secret);
+const asList = (v) => (v === undefined ? undefined : Array.isArray(v) ? v : [v]);
+/**
+ * Key source + verification options for the `jwt` strategy. Throws on
+ * misconfiguration (missing / conflicting key sources, algorithms that do not
+ * fit the key type, non-HTTPS JWKS URL).
+ */
+export function buildJwtVerifier(config) {
+    const jwt = config.jwt ?? {};
+    const sources = [config.jwtSecret ? 'jwtSecret' : '', jwt.publicKey ? 'jwt.publicKey' : '', jwt.jwksUrl ? 'jwt.jwksUrl' : ''].filter(Boolean);
+    if (sources.length === 0) {
+        throw new Error('auth.strategy is "jwt" but none of auth.jwtSecret, auth.jwt.publicKey or auth.jwt.jwksUrl is configured');
+    }
+    if (sources.length > 1)
+        throw new Error(`auth: configure only one of ${sources.join(', ')}`);
+    const hmac = !!config.jwtSecret;
+    const allowed = hmac ? HMAC_ALGORITHMS : ASYMMETRIC_ALGORITHMS;
+    const algorithms = jwt.algorithms ?? allowed;
+    if (algorithms.length === 0)
+        throw new Error('auth.jwt.algorithms must not be empty');
+    const bad = algorithms.filter((a) => !allowed.includes(a));
+    if (bad.length > 0) {
+        throw new Error(`auth.jwt.algorithms: ${bad.join(', ')} cannot be used with ${sources[0]} (allowed: ${allowed.join(', ')})`);
+    }
+    let key;
+    if (config.jwtSecret) {
+        if (config.jwtSecret.length < 32) {
+            logger.warn('auth.jwtSecret is shorter than 32 characters; use a longer random secret');
+        }
+        key = new TextEncoder().encode(config.jwtSecret);
+    }
+    else if (jwt.publicKey) {
+        try {
+            key = createPublicKey(jwt.publicKey);
+        }
+        catch (err) {
+            throw new Error(`auth.jwt.publicKey is not a valid PEM public key: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    else {
+        let url;
+        try {
+            url = new URL(jwt.jwksUrl);
+        }
+        catch {
+            throw new Error(`auth.jwt.jwksUrl is not a valid URL: ${jwt.jwksUrl}`);
+        }
+        const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+        if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) {
+            throw new Error('auth.jwt.jwksUrl must use https:// (http:// is only allowed for localhost)');
+        }
+        key = createRemoteJWKSet(url, {
+            cacheMaxAge: (jwt.jwksCacheSeconds ?? 600) * 1000,
+            cooldownDuration: 30_000,
+            timeoutDuration: 5_000,
+        });
+    }
+    const options = { algorithms };
+    const issuer = asList(jwt.issuer);
+    const audience = asList(jwt.audience);
+    if (issuer)
+        options.issuer = issuer;
+    if (audience)
+        options.audience = audience;
+    if (jwt.clockToleranceSeconds)
+        options.clockTolerance = jwt.clockToleranceSeconds;
+    if (jwt.requireExp)
+        options.requiredClaims = ['exp'];
+    if (jwt.maxTokenAgeSeconds)
+        options.maxTokenAge = jwt.maxTokenAgeSeconds;
+    return { key, options };
+}
+function jwtMiddleware(verifier) {
+    const verify = (token) => typeof verifier.key === 'function'
+        ? jwtVerify(token, verifier.key, verifier.options)
+        : jwtVerify(token, verifier.key, verifier.options);
     return (req, res, next) => {
         const authHeader = req.headers.authorization;
         if (!authHeader || !/^Bearer /i.test(authHeader)) {
@@ -140,7 +269,7 @@ function jwtMiddleware(secret) {
         const token = authHeader.slice(7).trim();
         // Two-argument then(): an error thrown downstream of next() must not be
         // misreported as an auth failure.
-        jwtVerify(token, secretKey, { algorithms: JWT_ALGORITHMS }).then(({ payload }) => {
+        verify(token).then(({ payload }) => {
             req.jwtPayload = payload;
             req.clientId = `jwt:${String(payload.sub ?? 'unknown')}`;
             const scope = scopeFromJwt(payload);
@@ -148,7 +277,7 @@ function jwtMiddleware(secret) {
                 req.scope = scope;
             next();
         }, (err) => {
-            logger.warn(`JWT verification failed: ${err instanceof Error ? err.message : String(err)}`);
+            logger.warn(`JWT verification failed from ${req.ip}: ${err instanceof Error ? err.message : String(err)}`);
             if (!res.headersSent) {
                 res.status(401).json({ error: 'Unauthorized', message: 'Invalid or expired token' });
             }

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAmB7D,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEnD,MAAM,UAAU,oBAAoB,CAAC,MAAmB;IACtD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACvF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QACD;YACE,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,OAAO,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;KAClB,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,EAAE,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC9B,GAAqB,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK;YAAG,GAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,EAAE,CAAC,aAAa,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,wEAAwE;QACxE,kCAAkC;QAClC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAC9D,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACb,GAAqB,CAAC,UAAU,GAAG,OAAO,CAAC;YAC3C,GAAqB,CAAC,QAAQ,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAG,GAAqB,CAAC,KAAK,GAAG,KAAK,CAAC;YAChD,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,CAAC,IAAI,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAkB,MAAM,QAAQ,CAAC;AAEtF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAA+C,MAAM,MAAM,CAAC;AAElG,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAoB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAkB,MAAM,YAAY,CAAC;AA2B7D,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,IAA2B;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,KAAmB;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO,EAAE,OAAO,EAAE,OAAO;IACzB,OAAO;CACR,CAAC;AAEF,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,KAAmB;IAC3C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,KAAmB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACrE,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,UAAU,CAAC;IACtC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,UAAiC,EAAE;IAC3F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAmB,CAAC,IAAa,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;gBACvF,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,KAAK;YACR,OAAO,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACjG,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7G;YACE,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,iGAAiG;AACjG,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,OAAO,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAoB;IACnE,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,oFAAoF;IACpF,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACrF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;KAClB,CAAC,CAAC,CAAC;IACJ,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,EAAE,GAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,EAAE,aAAa,MAAM,CAAC,QAAQ,OAAO,QAAQ,EAAE,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACA,GAAqB,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK;YAAG,GAAqB,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,EAAE,CAAC,aAAa,GAAG,CAAC,QAAQ,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAOD,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhH;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,GAAG,GAAc,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9I,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,GAAuB,CAAC;IAC5B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE;YAC5B,WAAW,EAAE,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,GAAG,IAAI;YACjD,gBAAgB,EAAE,MAAM;YACxB,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,UAAU,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,IAAI,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1C,IAAI,GAAG,CAAC,qBAAqB;QAAE,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC,qBAAqB,CAAC;IAClF,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,kBAAkB;QAAE,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACzE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,QAAqB;IAC1C,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAC/B,OAAO,QAAQ,CAAC,GAAG,KAAK,UAAU;QAChC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzC,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAChB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YACb,GAAqB,CAAC,UAAU,GAAG,OAAO,CAAC;YAC3C,GAAqB,CAAC,QAAQ,GAAG,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,KAAK;gBAAG,GAAqB,CAAC,KAAK,GAAG,KAAK,CAAC;YAChD,IAAI,EAAE,CAAC;QACT,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,MAAM,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/oauth.d.ts

@@ -0,0 +1,86 @@
+/**
+ * OAuth 2.1 resource-server support, following the MCP authorization spec
+ * (2025-06-18): the gateway is an OAuth *protected resource*.
+ *
+ *  - `GET /.well-known/oauth-protected-resource[/<mcp path>]` serves RFC 9728
+ *    Protected Resource Metadata (resource, authorization_servers,
+ *    scopes_supported, bearer_methods_supported).
+ *  - Bearer access tokens are validated either as JWTs against the
+ *    authorization server's JWKS (configured `jwksUrl`, or the `jwks_uri`
+ *    discovered from RFC 8414 / OpenID metadata of the issuer) or through
+ *    RFC 7662 token introspection (opaque tokens). Introspection results are
+ *    cached until the token expires (at most `cacheSeconds`).
+ *  - The token must be issued for this resource (`aud` contains the resource
+ *    URI, RFC 8707) and by one of the configured authorization servers.
+ *  - Failures answer with RFC 6750 `WWW-Authenticate` challenges that point
+ *    clients at the metadata document: `401` + `error="invalid_token"` for a
+ *    missing / invalid token, `403` + `error="insufficient_scope"` when
+ *    `requiredScopes` are missing.
+ *
+ * @module auth/oauth
+ */
+import type { Request } from 'express';
+import type { OAuthConfig } from '../utils/types.js';
+import type { AuthMiddleware } from './middleware.js';
+export declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
+export interface TokenInfo {
+    subject?: string;
+    clientId?: string;
+    scopes: string[];
+    claims: Record<string, unknown>;
+    /** Expiry (epoch seconds) when known. */
+    exp?: number;
+}
+export declare class TokenError extends Error {
+    readonly code: 'invalid_token' | 'insufficient_scope';
+    constructor(message: string, code?: 'invalid_token' | 'insufficient_scope');
+}
+/** RFC 8414 §3 well-known URLs for an issuer (path-inserted form first, then OpenID Connect). */
+export declare function metadataUrls(issuer: string): string[];
+/** Space-separated `scope` claim (or `scp` array) of a token. */
+export declare function tokenScopes(claims: Record<string, unknown>): string[];
+export interface OAuthVerifierOptions {
+    fetch?: typeof fetch;
+    now?: () => number;
+}
+/** Validates bearer tokens for one protected resource. */
+export declare class OAuthVerifier {
+    readonly config: OAuthConfig;
+    private jwks?;
+    private jwksPromise?;
+    private readonly introspectionCache;
+    private readonly fetchImpl;
+    private readonly now;
+    constructor(config: OAuthConfig, options?: OAuthVerifierOptions);
+    private remoteJwks;
+    /** Issuers whose tokens are accepted. */
+    issuers(): string[];
+    /** Discover `jwks_uri` from the first authorization server's metadata (cached). */
+    private discoverJwks;
+    /** Validate a bearer token for `resource`. Throws `TokenError`. */
+    verify(token: string, resource: string): Promise<TokenInfo>;
+    private audiences;
+    private verifyJwt;
+    private introspect;
+}
+/** Public base URL of the request (scheme + host), honouring "trust proxy". */
+export declare function requestOrigin(req: Request): string;
+/** Canonical resource URI of the MCP endpoint (RFC 8707). */
+export declare function resourceUri(config: OAuthConfig, req: Request, mcpPath: string): string;
+/** URL of the protected-resource metadata document for this resource. */
+export declare function metadataUrl(config: OAuthConfig, req: Request, mcpPath: string): string;
+/** RFC 9728 metadata document. */
+export declare function protectedResourceMetadata(config: OAuthConfig, req: Request, mcpPath: string): Record<string, unknown>;
+/** `WWW-Authenticate` value for a failed request. */
+export declare function bearerChallenge(config: OAuthConfig, req: Request, mcpPath: string, err?: TokenError): string;
+export interface OAuthMiddlewareOptions extends OAuthVerifierOptions {
+    /** Path of the MCP endpoint (the protected resource). */
+    mcpPath: () => string;
+}
+/** Express middleware for `auth.strategy: oauth2`. */
+export declare function oauthMiddleware(config: OAuthConfig, options: OAuthMiddlewareOptions): AuthMiddleware & {
+    verifier: OAuthVerifier;
+};
+/** Decode a JWT's claims without verifying it (diagnostics only). */
+export declare function peekClaims(token: string): Record<string, unknown> | undefined;
+//# sourceMappingURL=oauth.d.ts.map

package/dist/auth/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGrE,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,UAAW,SAAQ,KAAK;IAGjC,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,oBAAoB;gBADrD,OAAO,EAAE,MAAM,EACN,IAAI,GAAE,eAAe,GAAG,oBAAsC;CAI1E;AAmBD,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrD;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAKrE;AAKD,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,0DAA0D;AAC1D,qBAAa,aAAa;IAQtB,QAAQ,CAAC,MAAM,EAAE,WAAW;IAP9B,OAAO,CAAC,IAAI,CAAC,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAuC;IAC3D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAyD;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAGxB,MAAM,EAAE,WAAW,EAC5B,OAAO,GAAE,oBAAyB;IAcpC,OAAO,CAAC,UAAU;IAQlB,yCAAyC;IACzC,OAAO,IAAI,MAAM,EAAE;IAInB,mFAAmF;YACrE,YAAY;IAyB1B,mEAAmE;IAC7D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAmBjE,OAAO,CAAC,SAAS;YAIH,SAAS;YAuBT,UAAU;CAsDzB;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAElD;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAItF;AAED,kCAAkC;AAClC,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrH;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,UAAU,GACf,MAAM,CASR;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,yDAAyD;IACzD,OAAO,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,sDAAsD;AACtD,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,GAAG,cAAc,GAAG;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAoClI;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAM7E"}