api-machine 1.2.1 → 1.4.0

package/authentication/authentication-scheme.d.ts

@@ -1,20 +1,23 @@
 import { RequestHandler } from 'express';
 import { SecuritySchemeObject, SecurityRequirementObject } from 'auto-oas/oas/v3.1';
+import { ApiRequest, BaseApiRouter } from '../router';
+import { SessionDriver } from '../session/session-driver';
+import { AuthFlow } from './auth-flow';
+import { ApiRoute } from '../router/base';
+export interface AuthenticationSchemeOptions {
+}
 /**
  * Abstract base class for authentication schemes
  * Extend this class to create custom authentication schemes that integrate
  * with both Express middleware and OpenAPI specification generation
  */
 export declare abstract class AuthenticationScheme {
+    constructor(options?: AuthenticationSchemeOptions);
     /**
      * Unique name for this authentication scheme
      * This will be used as the key in OpenAPI securitySchemes
      */
     abstract readonly schemeName: string;
-    /**
-     * The type of security scheme as defined by OpenAPI
-     */
-    abstract readonly type: 'http' | 'apiKey' | 'oauth2' | 'openIdConnect';
     /**
      * Generate the OpenAPI security scheme object
      * This will be added to components.securitySchemes in the OpenAPI spec
@@ -28,11 +31,60 @@ export declare abstract class AuthenticationScheme {
      * @returns SecurityRequirementObject compliant with OpenAPI 3.1
      */
     getSecurityRequirement(): SecurityRequirementObject;
+    /**
+     * Get the Express middleware for this authentication scheme
+     * For InlineAuthenticationScheme: runs endpoint
+     * For SessionAuthenticationScheme: verifies session
+     *
+     * @returns Express RequestHandler middleware
+     */
+    abstract getMiddleware(): RequestHandler;
+}
+export interface AuthenticationProtectionResult {
+    allowed: boolean;
+    retryAfterSeconds?: number;
+}
+export declare function throwIfAuthenticationBlocked(result: AuthenticationProtectionResult): void;
+export declare abstract class InlineAuthenticationScheme extends AuthenticationScheme {
+    abstract getCredentials(request: ApiRequest): unknown;
+    abstract authenticate(options: {
+        credentials: unknown;
+        request: ApiRequest;
+    }): Promise<void>;
     /**
      * Generate the Express middleware that enforces this authentication
      * The middleware should validate the authentication and throw appropriate
      * HTTPError instances if authentication fails
      * @returns Express RequestHandler middleware
      */
-    abstract getMiddleware(): RequestHandler;
+    getMiddleware(): RequestHandler;
+}
+export declare abstract class SessionAuthenticationScheme extends AuthenticationScheme {
+    protected sessionDriver: SessionDriver;
+    constructor(options: {
+        sessionDriver: SessionDriver;
+    });
+    /**
+     * Get the authentication flow for this scheme
+     * An AuthFlow is a named collection of steps
+     * (e.g., { challenge, authorization, tokenExchange })
+     *
+     * @returns AuthFlow defining all steps in the authentication process
+     */
+    abstract getAuthFlow(): AuthFlow;
+    /**
+     * Get all endpoints defined in the AuthFlow
+     *
+     * @returns ApiRoute array of all auth step endpoints
+     */
+    getEndpoints(): Array<ApiRoute>;
+    /**
+     * Generate a router that exposes all auth steps as API endpoints
+     * Each step in the AuthFlow becomes a route in the router
+     *
+     * @param basePath - Optional base path for the router (default: empty)
+     * @returns Router with all auth steps as endpoints
+     */
+    getAuthRouter(basePath?: string): BaseApiRouter;
+    getMiddleware(): RequestHandler;
 }

package/authentication/authentication-scheme.js

@@ -1,12 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationScheme = void 0;
+exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.throwIfAuthenticationBlocked = exports.AuthenticationScheme = void 0;
+const router_1 = require("../router");
+const error_1 = require("../error");
 /**
  * Abstract base class for authentication schemes
  * Extend this class to create custom authentication schemes that integrate
  * with both Express middleware and OpenAPI specification generation
  */
 class AuthenticationScheme {
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    constructor(options = {}) { }
     /**
      * Generate the OpenAPI security requirement
      * This defines which security scheme is required for an operation
@@ -18,4 +22,76 @@ class AuthenticationScheme {
     }
 }
 exports.AuthenticationScheme = AuthenticationScheme;
+function throwIfAuthenticationBlocked(result) {
+    if (result.allowed) {
+        return;
+    }
+    throw new error_1.TooManyRequestsError('Authentication temporarily unavailable', {
+        retryAfter: typeof result.retryAfterSeconds === 'number' &&
+            result.retryAfterSeconds > 0
+            ? result.retryAfterSeconds
+            : undefined,
+    });
+}
+exports.throwIfAuthenticationBlocked = throwIfAuthenticationBlocked;
+class InlineAuthenticationScheme extends AuthenticationScheme {
+    /**
+     * Generate the Express middleware that enforces this authentication
+     * The middleware should validate the authentication and throw appropriate
+     * HTTPError instances if authentication fails
+     * @returns Express RequestHandler middleware
+     */
+    getMiddleware() {
+        return async (request, response, next) => {
+            const credentials = this.getCredentials(request);
+            await this.authenticate({ credentials, request });
+            request.authenticated = true;
+            return next();
+        };
+    }
+}
+exports.InlineAuthenticationScheme = InlineAuthenticationScheme;
+class SessionAuthenticationScheme extends AuthenticationScheme {
+    sessionDriver;
+    constructor(options) {
+        super();
+        this.sessionDriver = options.sessionDriver;
+    }
+    /**
+     * Get all endpoints defined in the AuthFlow
+     *
+     * @returns ApiRoute array of all auth step endpoints
+     */
+    getEndpoints() {
+        const flow = this.getAuthFlow();
+        return Object.values(flow);
+    }
+    /**
+     * Generate a router that exposes all auth steps as API endpoints
+     * Each step in the AuthFlow becomes a route in the router
+     *
+     * @param basePath - Optional base path for the router (default: empty)
+     * @returns Router with all auth steps as endpoints
+     */
+    getAuthRouter(basePath = '') {
+        const endpoints = this.getEndpoints();
+        return new (class extends router_1.BaseApiRouter {
+            path = basePath;
+            async routes() {
+                return endpoints;
+            }
+        })();
+    }
+    getMiddleware() {
+        return async (request, response, next) => {
+            await this.sessionDriver.checkSession({
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                sessionId: request.sessionId,
+            });
+            request.authenticated = true;
+            return next();
+        };
+    }
+}
+exports.SessionAuthenticationScheme = SessionAuthenticationScheme;
 //# sourceMappingURL=authentication-scheme.js.map

package/authentication/authentication-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-scheme.js","sourceRoot":"","sources":["../../../src/authentication/authentication-scheme.ts"],"names":[],"mappings":";;;AAMA;;;;GAIG;AACH,MAAsB,oBAAoB;IAuBzC;;;;;OAKG;IACI,sBAAsB;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;CASD;AAxCD,oDAwCC"}
+{"version":3,"file":"authentication-scheme.js","sourceRoot":"","sources":["../../../src/authentication/authentication-scheme.ts"],"names":[],"mappings":";;;AAKA,sCAKmB;AAEnB,oCAAgD;AAQhD;;;;GAIG;AACH,MAAsB,oBAAoB;IACzC,6DAA6D;IAC7D,YAAmB,UAAuC,EAAE,IAAG,CAAC;IAehE;;;;;OAKG;IACI,sBAAsB;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;CAUD;AAnCD,oDAmCC;AAOD,SAAgB,4BAA4B,CAC3C,MAAsC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACR,CAAC;IAED,MAAM,IAAI,4BAAoB,CAAC,wCAAwC,EAAE;QACxE,UAAU,EACT,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,MAAM,CAAC,iBAAiB,GAAG,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,SAAS;KACb,CAAC,CAAC;AACJ,CAAC;AAdD,oEAcC;AAED,MAAsB,0BAA2B,SAAQ,oBAAoB;IAO5E;;;;;OAKG;IACI,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YAElD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAE7B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;CACD;AA3BD,gEA2BC;AAED,MAAsB,2BAA4B,SAAQ,oBAAoB;IACnE,aAAa,CAAgB;IAEvC,YAAmB,OAAyC;QAC3D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,CAAC;IAWD;;;;OAIG;IACI,YAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACI,aAAa,CAAC,QAAQ,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,OAAO,IAAI,CAAC,KAAM,SAAQ,sBAAa;YAC7B,IAAI,GAAG,QAAQ,CAAC;YAEzB,KAAK,CAAC,MAAM;gBACX,OAAO,SAAS,CAAC;YAClB,CAAC;SACD,CAAC,EAAE,CAAC;IACN,CAAC;IAEM,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;gBACrC,8DAA8D;gBAC9D,SAAS,EAAG,OAAe,CAAC,SAAS;aACrC,CAAC,CAAC;YAEH,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;CACD;AA7DD,kEA6DC"}

package/authentication/index.d.ts

@@ -1,4 +1,4 @@
 export { AuthenticatedRequest } from './authenticated-request';
-export { AuthenticationScheme } from './authentication-scheme';
-export * from './middleware';
+export { AuthenticationScheme, InlineAuthenticationScheme, SessionAuthenticationScheme, throwIfAuthenticationBlocked, AuthenticationProtectionResult, } from './authentication-scheme';
+export { AuthFlow } from './auth-flow';
 export * from './schemes';

package/authentication/index.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticationScheme = void 0;
+exports.throwIfAuthenticationBlocked = exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.AuthenticationScheme = void 0;
 const tslib_1 = require("tslib");
 var authentication_scheme_1 = require("./authentication-scheme");
 Object.defineProperty(exports, "AuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.AuthenticationScheme; } });
-tslib_1.__exportStar(require("./middleware"), exports);
+Object.defineProperty(exports, "InlineAuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.InlineAuthenticationScheme; } });
+Object.defineProperty(exports, "SessionAuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.SessionAuthenticationScheme; } });
+Object.defineProperty(exports, "throwIfAuthenticationBlocked", { enumerable: true, get: function () { return authentication_scheme_1.throwIfAuthenticationBlocked; } });
 tslib_1.__exportStar(require("./schemes"), exports);
 //# sourceMappingURL=index.js.map

package/authentication/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authentication/index.ts"],"names":[],"mappings":";;;;AACA,iEAA+D;AAAtD,6HAAA,oBAAoB,OAAA;AAC7B,uDAA6B;AAC7B,oDAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authentication/index.ts"],"names":[],"mappings":";;;;AACA,iEAMiC;AALhC,6HAAA,oBAAoB,OAAA;AACpB,mIAAA,0BAA0B,OAAA;AAC1B,oIAAA,2BAA2B,OAAA;AAC3B,qIAAA,4BAA4B,OAAA;AAI7B,oDAA0B"}

package/authentication/middleware/bearer-authentication.d.ts

@@ -1,12 +1,15 @@
-import { Response, NextFunction } from 'express';
-import { AuthenticatedRequest } from '../authenticated-request';
 import { LogInterface } from '../../log';
+/**
+ * @deprecated Use BearerAuthenticationScheme instead
+ */
 export interface BearerAuthenticationMiddlewareOptions {
     checkToken: (token: string) => Promise<boolean>;
     log?: LogInterface;
 }
 /**
+ * @deprecated Use BearerAuthenticationScheme instead
+ *
  * Bearer token authentication middleware
  * Validates the Authorization header against the configured bearer token
  */
-export declare function bearerAuthenticationMiddleware(options: BearerAuthenticationMiddlewareOptions): (req: AuthenticatedRequest, res: Response, next: NextFunction) => Promise<void>;
+export declare function bearerAuthenticationMiddleware(options: BearerAuthenticationMiddlewareOptions): import("express").RequestHandler<import("express-serve-static-core").ParamsDictionary, any, any, import("qs").ParsedQs, Record<string, any>>;

package/authentication/middleware/bearer-authentication.js

@@ -1,49 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bearerAuthenticationMiddleware = void 0;
-const error_1 = require("../../error");
-const valsan_1 = require("valsan");
+const __1 = require("../..");
 /**
+ * @deprecated Use BearerAuthenticationScheme instead
+ *
  * Bearer token authentication middleware
  * Validates the Authorization header against the configured bearer token
  */
 function bearerAuthenticationMiddleware(options) {
-    return async function (req, res, next) {
-        const authHeader = req.headers['authorization'] || req.headers['Authorization'];
-        if (!authHeader) {
-            options.log?.warn('Unauthorized access attempt from ' +
-                req.ip +
-                ' - No token provided');
-            throw new error_1.UnauthorizedError('Authorization header is missing', {
-                scheme: 'Bearer',
-            });
-        }
-        const validationResult = await new valsan_1.BearerTokenValSan().run(authHeader);
-        let token;
-        if (validationResult.success) {
-            token = validationResult.data;
-        }
-        else {
-            options.log?.warn('Unauthorized access attempt from ' +
-                req.ip +
-                ' - Invalid token format', JSON.stringify(validationResult.errors, null, 2));
-            throw new error_1.UnauthorizedError('Bearer token is empty or invalid', {
-                scheme: 'Bearer',
-                details: validationResult.errors,
-            });
-        }
-        if (!(await options.checkToken(token))) {
-            options.log?.warn('Unauthorized access attempt from ' +
-                req.ip +
-                ' - Check token failed');
-            throw new error_1.UnauthorizedError('Bearer token check failed', {
-                scheme: 'Bearer',
-            });
-        }
-        req.authenticated = true;
-        next();
-        return;
-    };
+    const scheme = new __1.BearerAuthenticationScheme({
+        checkToken: options.checkToken,
+        log: options.log,
+    });
+    return scheme.getMiddleware();
 }
 exports.bearerAuthenticationMiddleware = bearerAuthenticationMiddleware;
 //# sourceMappingURL=bearer-authentication.js.map

package/authentication/middleware/bearer-authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-authentication.js","sourceRoot":"","sources":["../../../../src/authentication/middleware/bearer-authentication.ts"],"names":[],"mappings":";;;AACA,uCAAgD;AAEhD,mCAA2C;AAQ3C;;;GAGG;AACH,SAAgB,8BAA8B,CAC7C,OAA8C;IAE9C,OAAO,KAAK,WACX,GAAyB,EACzB,GAAa,EACb,IAAkB;QAElB,MAAM,UAAU,GACf,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE9D,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,EAAE,IAAI,CAChB,mCAAmC;gBAClC,GAAG,CAAC,EAAE;gBACN,sBAAsB,CACvB,CAAC;YAEF,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,0BAAiB,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,KAAa,CAAC;QAElB,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,KAAK,GAAG,gBAAgB,CAAC,IAAK,CAAC;QAChC,CAAC;aACI,CAAC;YACL,OAAO,CAAC,GAAG,EAAE,IAAI,CAChB,mCAAmC;gBAClC,GAAG,CAAC,EAAE;gBACN,yBAAyB,EAC1B,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAChD,CAAC;YAEF,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,EAAE,IAAI,CAChB,mCAAmC;gBAClC,GAAG,CAAC,EAAE;gBACN,uBAAuB,CACxB,CAAC;YAEF,MAAM,IAAI,yBAAiB,CAAC,2BAA2B,EAAE;gBACxD,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,CAAC;QAEP,OAAO;IACR,CAAC,CAAC;AACH,CAAC;AA5DD,wEA4DC"}
+{"version":3,"file":"bearer-authentication.js","sourceRoot":"","sources":["../../../../src/authentication/middleware/bearer-authentication.ts"],"names":[],"mappings":";;;AACA,6BAAmD;AAUnD;;;;;GAKG;AACH,SAAgB,8BAA8B,CAC7C,OAA8C;IAE9C,MAAM,MAAM,GAAG,IAAI,8BAA0B,CAAC;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;KAChB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,aAAa,EAAE,CAAC;AAC/B,CAAC;AATD,wEASC"}

package/authentication/schemes/bearer-authentication-scheme.d.ts

@@ -1,8 +1,9 @@
-import { RequestHandler } from 'express';
-import { AuthenticationScheme } from '../authentication-scheme';
+import { AuthenticationSchemeOptions, InlineAuthenticationScheme } from '../authentication-scheme';
 import { SecuritySchemeObject } from 'auto-oas/oas/v3.1';
-import { BearerAuthenticationMiddlewareOptions } from '../middleware/bearer-authentication';
-export interface BearerAuthenticationSchemeOptions extends BearerAuthenticationMiddlewareOptions {
+import { LogInterface } from '../../log';
+import { ApiRequest } from '../../router';
+export type CheckTokenFunction = (token: string) => Promise<boolean>;
+export interface BearerAuthenticationSchemeOptions extends AuthenticationSchemeOptions {
     /**
      * The name of the security scheme in OpenAPI
      * @default 'BearerAuth'
@@ -19,19 +20,32 @@ export interface BearerAuthenticationSchemeOptions extends BearerAuthenticationM
      * Appears in the OpenAPI documentation
      */
     description?: string;
+    /**
+     * Function to validate the bearer token
+     * Should return true if the token is valid, false otherwise
+     */
+    checkToken: CheckTokenFunction;
+    /**
+     * Optional logger for security events
+     */
+    log?: LogInterface;
 }
 /**
  * Bearer token authentication scheme
  * Validates the Authorization header with Bearer token
  * Automatically generates OpenAPI security scheme documentation
  */
-export declare class BearerAuthenticationScheme extends AuthenticationScheme {
-    readonly type: "http";
+export declare class BearerAuthenticationScheme extends InlineAuthenticationScheme {
     readonly schemeName: string;
-    private readonly bearerFormat;
-    private readonly description?;
-    private readonly middlewareOptions;
+    protected readonly bearerFormat: string;
+    protected readonly description?: string;
+    protected readonly checkToken: CheckTokenFunction;
+    protected readonly log?: LogInterface;
     constructor(options: BearerAuthenticationSchemeOptions);
     getSecurityScheme(): SecuritySchemeObject;
-    getMiddleware(): RequestHandler;
+    getCredentials(request: ApiRequest): unknown;
+    authenticate(options: {
+        credentials: string;
+        request: ApiRequest;
+    }): Promise<void>;
 }

package/authentication/schemes/bearer-authentication-scheme.js

@@ -2,27 +2,26 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BearerAuthenticationScheme = void 0;
 const authentication_scheme_1 = require("../authentication-scheme");
-const bearer_authentication_1 = require("../middleware/bearer-authentication");
+const error_1 = require("../../error");
+const primitives_1 = require("valsan/primitives");
 /**
  * Bearer token authentication scheme
  * Validates the Authorization header with Bearer token
  * Automatically generates OpenAPI security scheme documentation
  */
-class BearerAuthenticationScheme extends authentication_scheme_1.AuthenticationScheme {
-    type = 'http';
+class BearerAuthenticationScheme extends authentication_scheme_1.InlineAuthenticationScheme {
     schemeName;
     bearerFormat;
     description;
-    middlewareOptions;
+    checkToken;
+    log;
     constructor(options) {
-        super();
+        super(options);
         this.schemeName = options.schemeName || 'BearerAuth';
         this.bearerFormat = options.bearerFormat || 'JWT';
         this.description = options.description;
-        this.middlewareOptions = {
-            checkToken: options.checkToken,
-            log: options.log,
-        };
+        this.checkToken = options.checkToken;
+        this.log = options.log;
     }
     getSecurityScheme() {
         const scheme = {
@@ -35,8 +34,49 @@ class BearerAuthenticationScheme extends authentication_scheme_1.AuthenticationS
         }
         return scheme;
     }
-    getMiddleware() {
-        return (0, bearer_authentication_1.bearerAuthenticationMiddleware)(this.middlewareOptions);
+    getCredentials(request) {
+        const authHeader = request.headers['authorization'] ||
+            request.headers['Authorization'];
+        if (!authHeader) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - No token provided';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        return authHeader;
+    }
+    async authenticate(options) {
+        const { credentials, request } = options;
+        if (!credentials) {
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        const validationResult = await new primitives_1.BearerTokenValSan().run(credentials);
+        if (!validationResult.success || !validationResult.data) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Invalid token format';
+            const details = JSON.stringify(validationResult.errors, null, 2);
+            this.log?.warn(msg, details);
+            throw new error_1.UnauthorizedError('Bearer token is empty or invalid', {
+                scheme: 'Bearer',
+                details: validationResult.errors,
+            });
+        }
+        if (!(await this.checkToken(validationResult.data))) {
+            // eslint-disable-next-line max-len
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Check token failed';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Bearer token check failed', {
+                scheme: 'Bearer',
+            });
+        }
     }
 }
 exports.BearerAuthenticationScheme = BearerAuthenticationScheme;

package/authentication/schemes/bearer-authentication-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-authentication-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/bearer-authentication-scheme.ts"],"names":[],"mappings":";;;AACA,oEAAgE;AAEhE,+EAG6C;AAwB7C;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,4CAAoB;IACnD,IAAI,GAAG,MAAe,CAAC;IACvB,UAAU,CAAS;IAElB,YAAY,CAAS;IACrB,WAAW,CAAU;IACrB,iBAAiB,CAAwC;IAE1E,YAAY,OAA0C;QACrD,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,iBAAiB,GAAG;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC;IACH,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEM,aAAa;QACnB,OAAO,IAAA,sDAA8B,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/D,CAAC;CACD;AApCD,gEAoCC"}
+{"version":3,"file":"bearer-authentication-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/bearer-authentication-scheme.ts"],"names":[],"mappings":";;;AAAA,oEAGkC;AAElC,uCAAgD;AAChD,kDAAsD;AAuCtD;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,kDAA0B;IACzD,UAAU,CAAS;IAEhB,YAAY,CAAS;IACrB,WAAW,CAAU;IACrB,UAAU,CAAqB;IAC/B,GAAG,CAAgB;IAEtC,YAAY,OAA0C;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEe,cAAc,CAAC,OAAmB;QACjD,MAAM,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,sBAAsB,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAEe,KAAK,CAAC,YAAY,CAAC,OAGlC;QACA,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,8BAAiB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,yBAAyB,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7B,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,mCAAmC;YACnC,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,uBAAuB,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,2BAA2B,EAAE;gBACxD,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AA5FD,gEA4FC"}

package/authentication/schemes/client-credentials-oauth2-scheme.d.ts

@@ -0,0 +1,64 @@
+import { AuthenticationSchemeOptions, InlineAuthenticationScheme } from '../authentication-scheme';
+import { SecuritySchemeObject } from 'auto-oas/oas/v3.1';
+import { LogInterface } from '../../log';
+import { ApiRequest } from '../../router';
+export type CheckTokenFunction = (token: string) => Promise<boolean>;
+export interface ClientCredentialsOAuth2SchemeOptions extends AuthenticationSchemeOptions {
+    /**
+     * The name of the security scheme in OpenAPI
+     * @default 'OAuth2ClientCredentials'
+     */
+    schemeName?: string;
+    /**
+     * Description of the authentication scheme
+     * Appears in the OpenAPI documentation
+     */
+    description?: string;
+    /**
+     * URL of the OAuth2 authorization server's token endpoint
+     * Used for OpenAPI documentation
+     * @default 'http://localhost:3000/oauth/token'
+     */
+    tokenUrl?: string;
+    /**
+     * Function to validate the access token
+     * Should return true if the token is valid, false otherwise
+     */
+    checkToken: CheckTokenFunction;
+    /**
+     * Optional logger for security events
+     */
+    log?: LogInterface;
+}
+/**
+ * OAuth2 Client Credentials authentication scheme
+ * Validates access tokens from the Authorization header using Bearer scheme
+ * Implements the OAuth2 Client Credentials flow for server-to-server authentication
+ * Automatically generates OpenAPI security scheme documentation
+ *
+ * Usage example:
+ * ```typescript
+ * const oauth2 = new ClientCredentialsOAuth2Scheme({
+ *   checkToken: async (token: string) => {
+ *     // Validate against your token store or OAuth2 provider
+ *     return validTokens.includes(token);
+ *   },
+ *   tokenUrl: 'https://auth-server.example.com/oauth/token',
+ *   schemeName: 'OAuth2',
+ * });
+ * ```
+ */
+export declare class ClientCredentialsOAuth2Scheme extends InlineAuthenticationScheme {
+    readonly schemeName: string;
+    protected readonly description?: string;
+    protected readonly tokenUrl: string;
+    protected readonly checkToken: CheckTokenFunction;
+    protected readonly log?: LogInterface;
+    constructor(options: ClientCredentialsOAuth2SchemeOptions);
+    getSecurityScheme(): SecuritySchemeObject;
+    getCredentials(request: ApiRequest): unknown;
+    authenticate(options: {
+        credentials: string;
+        request: ApiRequest;
+    }): Promise<void>;
+}

package/authentication/schemes/client-credentials-oauth2-scheme.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsOAuth2Scheme = void 0;
+const authentication_scheme_1 = require("../authentication-scheme");
+const error_1 = require("../../error");
+const primitives_1 = require("valsan/primitives");
+/**
+ * OAuth2 Client Credentials authentication scheme
+ * Validates access tokens from the Authorization header using Bearer scheme
+ * Implements the OAuth2 Client Credentials flow for server-to-server authentication
+ * Automatically generates OpenAPI security scheme documentation
+ *
+ * Usage example:
+ * ```typescript
+ * const oauth2 = new ClientCredentialsOAuth2Scheme({
+ *   checkToken: async (token: string) => {
+ *     // Validate against your token store or OAuth2 provider
+ *     return validTokens.includes(token);
+ *   },
+ *   tokenUrl: 'https://auth-server.example.com/oauth/token',
+ *   schemeName: 'OAuth2',
+ * });
+ * ```
+ */
+class ClientCredentialsOAuth2Scheme extends authentication_scheme_1.InlineAuthenticationScheme {
+    schemeName;
+    description;
+    tokenUrl;
+    checkToken;
+    log;
+    constructor(options) {
+        super(options);
+        this.schemeName = options.schemeName || 'OAuth2ClientCredentials';
+        this.description = options.description;
+        this.tokenUrl = options.tokenUrl || 'http://localhost:3000/oauth/token';
+        this.checkToken = options.checkToken;
+        this.log = options.log;
+    }
+    getSecurityScheme() {
+        const scheme = {
+            type: 'oauth2',
+            flows: {
+                clientCredentials: {
+                    tokenUrl: this.tokenUrl,
+                    scopes: {},
+                },
+            },
+        };
+        if (this.description) {
+            scheme.description = this.description;
+        }
+        return scheme;
+    }
+    getCredentials(request) {
+        const authHeader = request.headers['authorization'] ||
+            request.headers['Authorization'];
+        if (!authHeader) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - No access token provided';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        return authHeader;
+    }
+    async authenticate(options) {
+        const { credentials, request } = options;
+        if (!credentials) {
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        const validationResult = await new primitives_1.BearerTokenValSan().run(credentials);
+        if (!validationResult.success || !validationResult.data) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Invalid access token format';
+            const details = JSON.stringify(validationResult.errors, null, 2);
+            this.log?.warn(msg, details);
+            throw new error_1.UnauthorizedError('Access token is empty or invalid', {
+                scheme: 'Bearer',
+                details: validationResult.errors,
+            });
+        }
+        if (!(await this.checkToken(validationResult.data))) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Access token validation failed';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Access token validation failed', {
+                scheme: 'Bearer',
+            });
+        }
+    }
+}
+exports.ClientCredentialsOAuth2Scheme = ClientCredentialsOAuth2Scheme;
+//# sourceMappingURL=client-credentials-oauth2-scheme.js.map

package/authentication/schemes/client-credentials-oauth2-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials-oauth2-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/client-credentials-oauth2-scheme.ts"],"names":[],"mappings":";;;AAAA,oEAGkC;AAElC,uCAAgD;AAChD,kDAAsD;AAwCtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,6BAA8B,SAAQ,kDAA0B;IAC5D,UAAU,CAAS;IAEhB,WAAW,CAAU;IACrB,QAAQ,CAAS;IACjB,UAAU,CAAqB;IAC/B,GAAG,CAAgB;IAEtC,YAAY,OAA6C;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mCAAmC,CAAC;QACxE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE;gBACN,iBAAiB,EAAE;oBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,EAAE;iBACV;aACD;SACD,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEe,cAAc,CAAC,OAAmB;QACjD,MAAM,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,6BAA6B,CAAC;YAC/B,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAEe,KAAK,CAAC,YAAY,CAAC,OAGlC;QACA,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,8BAAiB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,gCAAgC,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7B,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,mCAAmC,CAAC;YACrC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,gCAAgC,EAAE;gBAC7D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AA/FD,sEA+FC"}

package/index.d.ts

@@ -2,3 +2,4 @@ export * from './router';
 export * from './server';
 export * from './error';
 export * from './authentication';
+export * from './session';

package/index.js

@@ -5,4 +5,5 @@ tslib_1.__exportStar(require("./router"), exports);
 tslib_1.__exportStar(require("./server"), exports);
 tslib_1.__exportStar(require("./error"), exports);
 tslib_1.__exportStar(require("./authentication"), exports);
+tslib_1.__exportStar(require("./session"), exports);
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,mDAAyB;AACzB,mDAAyB;AACzB,kDAAwB;AACxB,2DAAiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,mDAAyB;AACzB,mDAAyB;AACzB,kDAAwB;AACxB,2DAAiC;AACjC,oDAA0B"}