api-machine 1.3.0 → 2.0.0

package/authentication/authentication-scheme.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.AuthenticationScheme = void 0;
+exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.throwIfAuthenticationBlocked = exports.AuthenticationScheme = void 0;
 const router_1 = require("../router");
+const error_1 = require("../error");
 /**
  * Abstract base class for authentication schemes
  * Extend this class to create custom authentication schemes that integrate
@@ -21,6 +22,18 @@ class AuthenticationScheme {
     }
 }
 exports.AuthenticationScheme = AuthenticationScheme;
+function throwIfAuthenticationBlocked(result) {
+    if (result.allowed) {
+        return;
+    }
+    throw new error_1.TooManyRequestsError('Authentication temporarily unavailable', {
+        retryAfter: typeof result.retryAfterSeconds === 'number' &&
+            result.retryAfterSeconds > 0
+            ? result.retryAfterSeconds
+            : undefined,
+    });
+}
+exports.throwIfAuthenticationBlocked = throwIfAuthenticationBlocked;
 class InlineAuthenticationScheme extends AuthenticationScheme {
     /**
      * Generate the Express middleware that enforces this authentication
@@ -31,8 +44,11 @@ class InlineAuthenticationScheme extends AuthenticationScheme {
     getMiddleware() {
         return async (request, response, next) => {
             const credentials = this.getCredentials(request);
-            await this.authenticate({ credentials, request });
+            const principal = await this.authenticate({ credentials, request });
             request.authenticated = true;
+            if (principal) {
+                request.principal = principal;
+            }
             return next();
         };
     }
@@ -71,14 +87,40 @@ class SessionAuthenticationScheme extends AuthenticationScheme {
     }
     getMiddleware() {
         return async (request, response, next) => {
+            const sessionId = this.getSessionId(request);
             await this.sessionDriver.checkSession({
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                sessionId: request.sessionId,
+                sessionId,
             });
+            const session = await this.sessionDriver.getSession({ sessionId });
             request.authenticated = true;
+            if (session.principal) {
+                request.principal = session.principal;
+            }
             return next();
         };
     }
+    getSessionId(request) {
+        if (request.sessionId) {
+            return request.sessionId;
+        }
+        const cookieHeader = request.headers?.cookie;
+        if (!cookieHeader) {
+            return undefined;
+        }
+        const sessionCookie = cookieHeader
+            .split(';')
+            .map((cookie) => cookie.trim())
+            .find((cookie) => cookie.startsWith('sessionId='));
+        if (!sessionCookie) {
+            return undefined;
+        }
+        try {
+            return decodeURIComponent(sessionCookie.slice('sessionId='.length));
+        }
+        catch {
+            return undefined;
+        }
+    }
 }
 exports.SessionAuthenticationScheme = SessionAuthenticationScheme;
 //# sourceMappingURL=authentication-scheme.js.map

package/authentication/authentication-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-scheme.js","sourceRoot":"","sources":["../../../src/authentication/authentication-scheme.ts"],"names":[],"mappings":";;;AAKA,sCAKmB;AASnB;;;;GAIG;AACH,MAAsB,oBAAoB;IACzC,6DAA6D;IAC7D,YAAmB,UAAuC,EAAE,IAAG,CAAC;IAehE;;;;;OAKG;IACI,sBAAsB;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;CAUD;AAnCD,oDAmCC;AAED,MAAsB,0BAA2B,SAAQ,oBAAoB;IAO5E;;;;;OAKG;IACI,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YAElD,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAE7B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;CACD;AA3BD,gEA2BC;AAED,MAAsB,2BAA4B,SAAQ,oBAAoB;IACnE,aAAa,CAAgB;IAEvC,YAAmB,OAAyC;QAC3D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,CAAC;IAWD;;;;OAIG;IACI,YAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACI,aAAa,CAAC,QAAQ,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,OAAO,IAAI,CAAC,KAAM,SAAQ,sBAAa;YAC7B,IAAI,GAAG,QAAQ,CAAC;YAEzB,KAAK,CAAC,MAAM;gBACX,OAAO,SAAS,CAAC;YAClB,CAAC;SACD,CAAC,EAAE,CAAC;IACN,CAAC;IAEM,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;gBACrC,8DAA8D;gBAC9D,SAAS,EAAG,OAAe,CAAC,SAAS;aACrC,CAAC,CAAC;YAEH,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;CACD;AA7DD,kEA6DC"}
+{"version":3,"file":"authentication-scheme.js","sourceRoot":"","sources":["../../../src/authentication/authentication-scheme.ts"],"names":[],"mappings":";;;AAKA,sCAKmB;AAEnB,oCAAgD;AAWhD;;;;GAIG;AACH,MAAsB,oBAAoB;IACzC,6DAA6D;IAC7D,YAAmB,UAAuC,EAAE,IAAG,CAAC;IAehE;;;;;OAKG;IACI,sBAAsB;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;CAUD;AAnCD,oDAmCC;AAOD,SAAgB,4BAA4B,CAC3C,MAAsC;IAEtC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACR,CAAC;IAED,MAAM,IAAI,4BAAoB,CAAC,wCAAwC,EAAE;QACxE,UAAU,EACT,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ;YAC5C,MAAM,CAAC,iBAAiB,GAAG,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,SAAS;KACb,CAAC,CAAC;AACJ,CAAC;AAdD,oEAcC;AAED,MAAsB,0BAA2B,SAAQ,oBAAoB;IAO5E;;;;;OAKG;IACI,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YAEpE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/B,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;CACD;AA9BD,gEA8BC;AAED,MAAsB,2BAA4B,SAAQ,oBAAoB;IACnE,aAAa,CAAgB;IAEvC,YAAmB,OAAyC;QAC3D,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,CAAC;IAWD;;;;OAIG;IACI,YAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACI,aAAa,CAAC,QAAQ,GAAG,EAAE;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEtC,OAAO,IAAI,CAAC,KAAM,SAAQ,sBAAa;YAC7B,IAAI,GAAG,QAAQ,CAAC;YAEzB,KAAK,CAAC,MAAM;gBACX,OAAO,SAAS,CAAC;YAClB,CAAC;SACD,CAAC,EAAE,CAAC;IACN,CAAC;IAEM,aAAa;QACnB,OAAO,KAAK,EACX,OAA6B,EAC7B,QAAqB,EACrB,IAAqB,EACpB,EAAE;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC;gBACrC,SAAS;aACT,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAEnE,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YACvC,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QACf,CAAC,CAAC;IACH,CAAC;IAES,YAAY,CAAC,OAA6B;QACnD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,OAAO,CAAC,SAAS,CAAC;QAC1B,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,aAAa,GAAG,YAAY;aAChC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACJ,OAAO,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC;YACN,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AA7FD,kEA6FC"}

package/authentication/index.d.ts

@@ -1,4 +1,4 @@
-export { AuthenticatedRequest } from './authenticated-request';
-export { AuthenticationScheme, InlineAuthenticationScheme, SessionAuthenticationScheme, } from './authentication-scheme';
+export { AuthenticatedPrincipal, AuthenticatedRequest, } from './authenticated-request';
+export { AuthenticationScheme, InlineAuthenticationScheme, SessionAuthenticationScheme, throwIfAuthenticationBlocked, AuthenticationProtectionResult, } from './authentication-scheme';
 export { AuthFlow } from './auth-flow';
 export * from './schemes';

package/authentication/index.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.AuthenticationScheme = void 0;
+exports.throwIfAuthenticationBlocked = exports.SessionAuthenticationScheme = exports.InlineAuthenticationScheme = exports.AuthenticationScheme = void 0;
 const tslib_1 = require("tslib");
 var authentication_scheme_1 = require("./authentication-scheme");
 Object.defineProperty(exports, "AuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.AuthenticationScheme; } });
 Object.defineProperty(exports, "InlineAuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.InlineAuthenticationScheme; } });
 Object.defineProperty(exports, "SessionAuthenticationScheme", { enumerable: true, get: function () { return authentication_scheme_1.SessionAuthenticationScheme; } });
+Object.defineProperty(exports, "throwIfAuthenticationBlocked", { enumerable: true, get: function () { return authentication_scheme_1.throwIfAuthenticationBlocked; } });
 tslib_1.__exportStar(require("./schemes"), exports);
 //# sourceMappingURL=index.js.map

package/authentication/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authentication/index.ts"],"names":[],"mappings":";;;;AACA,iEAIiC;AAHhC,6HAAA,oBAAoB,OAAA;AACpB,mIAAA,0BAA0B,OAAA;AAC1B,oIAAA,2BAA2B,OAAA;AAG5B,oDAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authentication/index.ts"],"names":[],"mappings":";;;;AAIA,iEAMiC;AALhC,6HAAA,oBAAoB,OAAA;AACpB,mIAAA,0BAA0B,OAAA;AAC1B,oIAAA,2BAA2B,OAAA;AAC3B,qIAAA,4BAA4B,OAAA;AAI7B,oDAA0B"}

package/authentication/schemes/bearer-authentication-scheme.d.ts

@@ -2,7 +2,8 @@ import { AuthenticationSchemeOptions, InlineAuthenticationScheme } from '../auth
 import { SecuritySchemeObject } from 'auto-oas/oas/v3.1';
 import { LogInterface } from '../../log';
 import { ApiRequest } from '../../router';
-export type CheckTokenFunction = (token: string) => Promise<boolean>;
+import { AuthenticatedPrincipal } from '../authenticated-request';
+export type CheckTokenFunction = (token: string) => Promise<boolean | AuthenticatedPrincipal>;
 export interface BearerAuthenticationSchemeOptions extends AuthenticationSchemeOptions {
     /**
      * The name of the security scheme in OpenAPI
@@ -21,8 +22,8 @@ export interface BearerAuthenticationSchemeOptions extends AuthenticationSchemeO
      */
     description?: string;
     /**
-     * Function to validate the bearer token
-     * Should return true if the token is valid, false otherwise
+     * Validate a bearer token and optionally return the authenticated
+     * principal.
      */
     checkToken: CheckTokenFunction;
     /**
@@ -47,5 +48,5 @@ export declare class BearerAuthenticationScheme extends InlineAuthenticationSche
     authenticate(options: {
         credentials: string;
         request: ApiRequest;
-    }): Promise<void>;
+    }): Promise<void | AuthenticatedPrincipal>;
 }

package/authentication/schemes/bearer-authentication-scheme.js

@@ -67,7 +67,8 @@ class BearerAuthenticationScheme extends authentication_scheme_1.InlineAuthentic
                 details: validationResult.errors,
             });
         }
-        if (!(await this.checkToken(validationResult.data))) {
+        const tokenResult = await this.checkToken(validationResult.data);
+        if (!tokenResult) {
             // eslint-disable-next-line max-len
             const msg = 'Unauthorized access attempt from ' +
                 request.ip +
@@ -77,6 +78,7 @@ class BearerAuthenticationScheme extends authentication_scheme_1.InlineAuthentic
                 scheme: 'Bearer',
             });
         }
+        return typeof tokenResult === 'object' ? tokenResult : undefined;
     }
 }
 exports.BearerAuthenticationScheme = BearerAuthenticationScheme;

package/authentication/schemes/bearer-authentication-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-authentication-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/bearer-authentication-scheme.ts"],"names":[],"mappings":";;;AAAA,oEAGkC;AAElC,uCAAgD;AAChD,kDAAsD;AAuCtD;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,kDAA0B;IACzD,UAAU,CAAS;IAEhB,YAAY,CAAS;IACrB,WAAW,CAAU;IACrB,UAAU,CAAqB;IAC/B,GAAG,CAAgB;IAEtC,YAAY,OAA0C;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEe,cAAc,CAAC,OAAmB;QACjD,MAAM,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,sBAAsB,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAEe,KAAK,CAAC,YAAY,CAAC,OAGlC;QACA,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,8BAAiB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,yBAAyB,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7B,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,mCAAmC;YACnC,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,uBAAuB,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,2BAA2B,EAAE;gBACxD,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AA5FD,gEA4FC"}
+{"version":3,"file":"bearer-authentication-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/bearer-authentication-scheme.ts"],"names":[],"mappings":";;;AAAA,oEAGkC;AAElC,uCAAgD;AAChD,kDAAsD;AA0CtD;;;;GAIG;AACH,MAAa,0BAA2B,SAAQ,kDAA0B;IACzD,UAAU,CAAS;IAEhB,YAAY,CAAS;IACrB,WAAW,CAAU;IACrB,UAAU,CAAqB;IAC/B,GAAG,CAAgB;IAEtC,YAAY,OAA0C;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;QACrD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;QAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,IAAI,CAAC,YAAY;SAC/B,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEe,cAAc,CAAC,OAAmB;QACjD,MAAM,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,sBAAsB,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAEe,KAAK,CAAC,YAAY,CAAC,OAGlC;QACA,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,8BAAiB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,yBAAyB,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7B,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,mCAAmC;YACnC,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,uBAAuB,CAAC;YACzB,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,2BAA2B,EAAE;gBACxD,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;CACD;AA/FD,gEA+FC"}

package/authentication/schemes/client-credentials-oauth2-scheme.d.ts

@@ -0,0 +1,64 @@
+import { AuthenticationSchemeOptions, InlineAuthenticationScheme } from '../authentication-scheme';
+import { SecuritySchemeObject } from 'auto-oas/oas/v3.1';
+import { LogInterface } from '../../log';
+import { ApiRequest } from '../../router';
+export type CheckTokenFunction = (token: string) => Promise<boolean>;
+export interface ClientCredentialsOAuth2SchemeOptions extends AuthenticationSchemeOptions {
+    /**
+     * The name of the security scheme in OpenAPI
+     * @default 'OAuth2ClientCredentials'
+     */
+    schemeName?: string;
+    /**
+     * Description of the authentication scheme
+     * Appears in the OpenAPI documentation
+     */
+    description?: string;
+    /**
+     * URL of the OAuth2 authorization server's token endpoint
+     * Used for OpenAPI documentation
+     * @default 'http://localhost:3000/oauth/token'
+     */
+    tokenUrl?: string;
+    /**
+     * Function to validate the access token
+     * Should return true if the token is valid, false otherwise
+     */
+    checkToken: CheckTokenFunction;
+    /**
+     * Optional logger for security events
+     */
+    log?: LogInterface;
+}
+/**
+ * OAuth2 Client Credentials authentication scheme
+ * Validates access tokens from the Authorization header using Bearer scheme
+ * Implements the OAuth2 Client Credentials flow for server-to-server authentication
+ * Automatically generates OpenAPI security scheme documentation
+ *
+ * Usage example:
+ * ```typescript
+ * const oauth2 = new ClientCredentialsOAuth2Scheme({
+ *   checkToken: async (token: string) => {
+ *     // Validate against your token store or OAuth2 provider
+ *     return validTokens.includes(token);
+ *   },
+ *   tokenUrl: 'https://auth-server.example.com/oauth/token',
+ *   schemeName: 'OAuth2',
+ * });
+ * ```
+ */
+export declare class ClientCredentialsOAuth2Scheme extends InlineAuthenticationScheme {
+    readonly schemeName: string;
+    protected readonly description?: string;
+    protected readonly tokenUrl: string;
+    protected readonly checkToken: CheckTokenFunction;
+    protected readonly log?: LogInterface;
+    constructor(options: ClientCredentialsOAuth2SchemeOptions);
+    getSecurityScheme(): SecuritySchemeObject;
+    getCredentials(request: ApiRequest): unknown;
+    authenticate(options: {
+        credentials: string;
+        request: ApiRequest;
+    }): Promise<void>;
+}

package/authentication/schemes/client-credentials-oauth2-scheme.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsOAuth2Scheme = void 0;
+const authentication_scheme_1 = require("../authentication-scheme");
+const error_1 = require("../../error");
+const primitives_1 = require("valsan/primitives");
+/**
+ * OAuth2 Client Credentials authentication scheme
+ * Validates access tokens from the Authorization header using Bearer scheme
+ * Implements the OAuth2 Client Credentials flow for server-to-server authentication
+ * Automatically generates OpenAPI security scheme documentation
+ *
+ * Usage example:
+ * ```typescript
+ * const oauth2 = new ClientCredentialsOAuth2Scheme({
+ *   checkToken: async (token: string) => {
+ *     // Validate against your token store or OAuth2 provider
+ *     return validTokens.includes(token);
+ *   },
+ *   tokenUrl: 'https://auth-server.example.com/oauth/token',
+ *   schemeName: 'OAuth2',
+ * });
+ * ```
+ */
+class ClientCredentialsOAuth2Scheme extends authentication_scheme_1.InlineAuthenticationScheme {
+    schemeName;
+    description;
+    tokenUrl;
+    checkToken;
+    log;
+    constructor(options) {
+        super(options);
+        this.schemeName = options.schemeName || 'OAuth2ClientCredentials';
+        this.description = options.description;
+        this.tokenUrl = options.tokenUrl || 'http://localhost:3000/oauth/token';
+        this.checkToken = options.checkToken;
+        this.log = options.log;
+    }
+    getSecurityScheme() {
+        const scheme = {
+            type: 'oauth2',
+            flows: {
+                clientCredentials: {
+                    tokenUrl: this.tokenUrl,
+                    scopes: {},
+                },
+            },
+        };
+        if (this.description) {
+            scheme.description = this.description;
+        }
+        return scheme;
+    }
+    getCredentials(request) {
+        const authHeader = request.headers['authorization'] ||
+            request.headers['Authorization'];
+        if (!authHeader) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - No access token provided';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        return authHeader;
+    }
+    async authenticate(options) {
+        const { credentials, request } = options;
+        if (!credentials) {
+            throw new error_1.UnauthorizedError('Authorization header is missing', {
+                scheme: 'Bearer',
+            });
+        }
+        const validationResult = await new primitives_1.BearerTokenValSan().run(credentials);
+        if (!validationResult.success || !validationResult.data) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Invalid access token format';
+            const details = JSON.stringify(validationResult.errors, null, 2);
+            this.log?.warn(msg, details);
+            throw new error_1.UnauthorizedError('Access token is empty or invalid', {
+                scheme: 'Bearer',
+                details: validationResult.errors,
+            });
+        }
+        if (!(await this.checkToken(validationResult.data))) {
+            const msg = 'Unauthorized access attempt from ' +
+                request.ip +
+                ' - Access token validation failed';
+            this.log?.warn(msg);
+            throw new error_1.UnauthorizedError('Access token validation failed', {
+                scheme: 'Bearer',
+            });
+        }
+    }
+}
+exports.ClientCredentialsOAuth2Scheme = ClientCredentialsOAuth2Scheme;
+//# sourceMappingURL=client-credentials-oauth2-scheme.js.map

package/authentication/schemes/client-credentials-oauth2-scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credentials-oauth2-scheme.js","sourceRoot":"","sources":["../../../../src/authentication/schemes/client-credentials-oauth2-scheme.ts"],"names":[],"mappings":";;;AAAA,oEAGkC;AAElC,uCAAgD;AAChD,kDAAsD;AAwCtD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,6BAA8B,SAAQ,kDAA0B;IAC5D,UAAU,CAAS;IAEhB,WAAW,CAAU;IACrB,QAAQ,CAAS;IACjB,UAAU,CAAqB;IAC/B,GAAG,CAAgB;IAEtC,YAAY,OAA6C;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,mCAAmC,CAAC;QACxE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,CAAC;IAEM,iBAAiB;QACvB,MAAM,MAAM,GAAyB;YACpC,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE;gBACN,iBAAiB,EAAE;oBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,EAAE;iBACV;aACD;SACD,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACvC,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAEe,cAAc,CAAC,OAAmB;QACjD,MAAM,UAAU,GACf,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAElC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,6BAA6B,CAAC;YAC/B,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,UAAU,CAAC;IACnB,CAAC;IAEe,KAAK,CAAC,YAAY,CAAC,OAGlC;QACA,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAEzC,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,IAAI,yBAAiB,CAAC,iCAAiC,EAAE;gBAC9D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,8BAAiB,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAExE,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,gCAAgC,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAE7B,MAAM,IAAI,yBAAiB,CAAC,kCAAkC,EAAE;gBAC/D,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gBAAgB,CAAC,MAAM;aAChC,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,GAAG,GACR,mCAAmC;gBACnC,OAAO,CAAC,EAAE;gBACV,mCAAmC,CAAC;YACrC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,MAAM,IAAI,yBAAiB,CAAC,gCAAgC,EAAE;gBAC7D,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AA/FD,sEA+FC"}

package/authorization/authorization.d.ts

@@ -0,0 +1,16 @@
+import { AuthenticatedPrincipal } from '../authentication/authenticated-request';
+export interface AuthorizationRequirement {
+    action: string;
+    resource?: string | Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+}
+export interface AuthorizationContext extends AuthorizationRequirement {
+    principal: AuthenticatedPrincipal;
+}
+export interface AuthorizationResult {
+    allowed: boolean;
+    reason?: string;
+}
+export interface ApiAuthorizationService {
+    evaluate(context: AuthorizationContext): Promise<AuthorizationResult>;
+}

package/authorization/authorization.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authorization.js.map

package/authorization/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/authorization/authorization.ts"],"names":[],"mappings":""}

package/authorization/index.d.ts

@@ -0,0 +1 @@
+export * from './authorization';

package/authorization/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./authorization"), exports);
+//# sourceMappingURL=index.js.map

package/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/index.ts"],"names":[],"mappings":";;;AAAA,0DAAgC"}

package/index.d.ts

@@ -2,4 +2,5 @@ export * from './router';
 export * from './server';
 export * from './error';
 export * from './authentication';
+export * from './authorization';
 export * from './session';

package/index.js

@@ -5,5 +5,6 @@ tslib_1.__exportStar(require("./router"), exports);
 tslib_1.__exportStar(require("./server"), exports);
 tslib_1.__exportStar(require("./error"), exports);
 tslib_1.__exportStar(require("./authentication"), exports);
+tslib_1.__exportStar(require("./authorization"), exports);
 tslib_1.__exportStar(require("./session"), exports);
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,mDAAyB;AACzB,mDAAyB;AACzB,kDAAwB;AACxB,2DAAiC;AACjC,oDAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,mDAAyB;AACzB,mDAAyB;AACzB,kDAAwB;AACxB,2DAAiC;AACjC,0DAAgC;AAChC,oDAA0B"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "api-machine",
-	"version": "1.3.0",
+	"version": "2.0.0",
 	"description": "api-machine",
 	"typescript-template": {
 		"base": "1.0.1",
@@ -9,6 +9,7 @@
 	},
 	"scripts": {},
 	"dependencies": {
+		"@types/express": "^5.0.5",
 		"auto-oas": "^1.3.0",
 		"cors": "^2.8.5",
 		"express": "^5.1.0",

package/router/base.d.ts

@@ -1,6 +1,11 @@
 import { Router as ExpressRouter, RequestHandler } from 'express';
 import { AuthenticationScheme } from '../authentication/authentication-scheme';
 import { DependencyContainer } from 'hidi';
+import { AuthenticatedRequest } from '../authentication/authenticated-request';
+import { ApiAuthorizationService, AuthorizationRequirement } from '../authorization';
+export declare const AUTHENTICATION_KEY = "api-machine.authn";
+export declare const AUTHORIZATION_KEY = "api-machine.authz";
+export declare const AUTHORIZATION_REQUIREMENT_KEY = "api-machine.authorization-requirement";
 export declare abstract class BaseApiRoute {
     path: string;
     fullPath: string;
@@ -21,6 +26,8 @@ export declare abstract class BaseApiRoute {
      * If undefined, inherits from parent router or server
      */
     authentication?: AuthenticationScheme | null;
+    authorizer?: ApiAuthorizationService | null;
+    authorization?: AuthorizationRequirement | null;
     /**
      * Parent route in the hierarchy (used for authentication cascading)
      * @internal
@@ -36,5 +43,8 @@ export declare abstract class BaseApiRoute {
      * @returns The authentication scheme to use, or undefined if public
      */
     getEffectiveAuthentication(): AuthenticationScheme | undefined | null;
+    getEffectiveAuthorizationService(): ApiAuthorizationService | undefined | null;
+    getEffectiveAuthorizationRequirement(): AuthorizationRequirement | undefined | null;
+    logAuthorization(level: 'info' | 'warn' | 'error', event: string, request: AuthenticatedRequest, context?: Record<string, unknown>): void;
 }
 export type ApiRoute = new (...params: ConstructorParameters<typeof BaseApiRoute>) => BaseApiRoute;

package/router/base.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseApiRoute = void 0;
+exports.BaseApiRoute = exports.AUTHORIZATION_REQUIREMENT_KEY = exports.AUTHORIZATION_KEY = exports.AUTHENTICATION_KEY = void 0;
 const hidi_1 = require("hidi");
+exports.AUTHENTICATION_KEY = 'api-machine.authn';
+exports.AUTHORIZATION_KEY = 'api-machine.authz';
+exports.AUTHORIZATION_REQUIREMENT_KEY = 'api-machine.authorization-requirement';
 class BaseApiRoute {
     path;
     fullPath;
@@ -22,6 +25,8 @@ class BaseApiRoute {
      * If undefined, inherits from parent router or server
      */
     authentication;
+    authorizer;
+    authorization;
     /**
      * Parent route in the hierarchy (used for authentication cascading)
      * @internal
@@ -30,7 +35,13 @@ class BaseApiRoute {
     parentRoute;
     async register(_parentRouter, _parentPath) {
         if (this.authentication !== undefined) {
-            this.container.register('auth', this.authentication);
+            this.container.register(exports.AUTHENTICATION_KEY, this.authentication);
+        }
+        if (this.authorizer !== undefined) {
+            this.container.register(exports.AUTHORIZATION_KEY, this.authorizer);
+        }
+        if (this.authorization !== undefined) {
+            this.container.register(exports.AUTHORIZATION_REQUIREMENT_KEY, this.authorization);
         }
         this.inject();
     }
@@ -58,7 +69,25 @@ class BaseApiRoute {
      * @returns The authentication scheme to use, or undefined if public
      */
     getEffectiveAuthentication() {
-        return this.container.get('auth');
+        return this.container.get(exports.AUTHENTICATION_KEY);
+    }
+    getEffectiveAuthorizationService() {
+        return this.container.get(exports.AUTHORIZATION_KEY);
+    }
+    getEffectiveAuthorizationRequirement() {
+        return this.container.get(exports.AUTHORIZATION_REQUIREMENT_KEY);
+    }
+    logAuthorization(level, event, request, context = {}) {
+        const logger = this.container.get('log');
+        if (logger) {
+            logger[level](event, {
+                ...context,
+                principalId: request.principal?.id,
+                method: request.method,
+                path: request.originalUrl,
+                requestId: request.headers?.['x-request-id'],
+            });
+        }
     }
 }
 exports.BaseApiRoute = BaseApiRoute;

package/router/base.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/router/base.ts"],"names":[],"mappings":";;;AAEA,+BAA2C;AAE3C,MAAsB,YAAY;IAC1B,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,IAAI,CAAS;IACb,WAAW,CAAU;IACrB,SAAS,CAAwB;IAExC;;OAEG;IACI,SAAS,GAAwB,IAAI,0BAAmB,EAAE,CAAC;IAElE;;OAEG;IACI,UAAU,GAAqB,EAAE,CAAC;IAEzC;;;;OAIG;IACI,cAAc,CAA+B;IAEpD;;;OAGG;IACH,gDAAgD;IACzC,WAAW,CAAgB;IAE3B,KAAK,CAAC,QAAQ,CACpB,aAA4B,EAC5B,WAAmB;QAEnB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAEM,MAAM;QACZ,kDAAkD;IACnD,CAAC;IAEM,OAAO;QACb,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC3C,CAAC;IAEM,iBAAiB,CAAC,UAAkB;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAChB,CAAC;aACI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,0BAA0B;QAIhC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;CACD;AA5ED,oCA4EC"}
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/router/base.ts"],"names":[],"mappings":";;;AAEA,+BAA2C;AAQ9B,QAAA,kBAAkB,GAAG,mBAAmB,CAAC;AACzC,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AACxC,QAAA,6BAA6B,GACzC,uCAAuC,CAAC;AAEzC,MAAsB,YAAY;IAC1B,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,IAAI,CAAS;IACb,WAAW,CAAU;IACrB,SAAS,CAAwB;IAExC;;OAEG;IACI,SAAS,GAAwB,IAAI,0BAAmB,EAAE,CAAC;IAElE;;OAEG;IACI,UAAU,GAAqB,EAAE,CAAC;IAEzC;;;;OAIG;IACI,cAAc,CAA+B;IAC7C,UAAU,CAAkC;IAC5C,aAAa,CAAmC;IAEvD;;;OAGG;IACH,gDAAgD;IACzC,WAAW,CAAgB;IAE3B,KAAK,CAAC,QAAQ,CACpB,aAA4B,EAC5B,WAAmB;QAEnB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,0BAAkB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,yBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CACtB,qCAA6B,EAC7B,IAAI,CAAC,aAAa,CAClB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAEM,MAAM;QACZ,kDAAkD;IACnD,CAAC;IAEM,OAAO;QACb,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC3C,CAAC;IAEM,iBAAiB,CAAC,UAAkB;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QAChB,CAAC;aACI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACI,0BAA0B;QAEhC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CACxB,0BAAkB,CAClB,CAAC;IACH,CAAC;IAEM,gCAAgC;QAEtC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAiB,CAAC,CAAC;IAC9C,CAAC;IAEM,oCAAoC;QAE1C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qCAA6B,CAAC,CAAC;IAC1D,CAAC;IAEM,gBAAgB,CACtB,KAAgC,EAChC,KAAa,EACb,OAA6B,EAC7B,UAAmC,EAAE;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAe,KAAK,CAAC,CAAC;QAEvD,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE;gBACpB,GAAG,OAAO;gBACV,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC;aAC5C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;CACD;AAtHD,oCAsHC"}

package/router/endpoint.d.ts

@@ -1,9 +1,10 @@
-import { Router as ExpressRouter, Request as ExpressRequest, Response as ExpressResponse, NextFunction as ExpressNextFunction } from 'express';
+import { Router as ExpressRouter, Response as ExpressResponse, NextFunction as ExpressNextFunction } from 'express';
 import { ObjectSanitizer } from 'valsan/object-sanitizer';
 import { BaseApiRoute } from './base';
 import { HTTPError } from '../error';
 import { ArrayValSan, ObjectValSan } from 'valsan';
-export type ApiRequest = ExpressRequest;
+import { AuthenticatedRequest } from '../authentication/authenticated-request';
+export type ApiRequest = AuthenticatedRequest;
 export type ApiResponse = ExpressResponse;
 export type ApiNextFunction = ExpressNextFunction;
 export type ApiResponseData = {

package/router/endpoint.js

@@ -57,6 +57,39 @@ class BaseApiEndpoint extends base_1.BaseApiRoute {
         if (effectiveAuth) {
             endpointMiddleware.push(effectiveAuth.getMiddleware());
         }
+        const authorization = this.getEffectiveAuthorizationRequirement();
+        if (authorization) {
+            const authorizer = this.getEffectiveAuthorizationService();
+            if (!authorizer) {
+                throw new Error('Authorization is configured but no authorizer is available');
+            }
+            endpointMiddleware.push(async (request, _response, next) => {
+                const principal = request.principal;
+                if (!principal) {
+                    this.logAuthorization('warn', 'authorization.missing-principal', request);
+                    throw new error_1.UnauthorizedError('An authenticated principal is required');
+                }
+                let result;
+                try {
+                    result = await authorizer.evaluate({
+                        ...authorization,
+                        principal,
+                    });
+                }
+                catch (error) {
+                    this.logAuthorization('error', 'authorization.error', request, { ...authorization, error });
+                    throw error;
+                }
+                if (!result.allowed) {
+                    this.logAuthorization('warn', 'authorization.denied', request, { ...authorization, reason: result.reason });
+                    throw new error_1.ForbiddenError(result.reason || 'Authorization denied');
+                }
+                this.logAuthorization('info', 'authorization.allowed', request, {
+                    ...authorization,
+                });
+                return next();
+            });
+        }
         // Register with middleware (if any) before the handler
         if (endpointMiddleware.length > 0) {
             parentRouter[this.method](this.path, ...endpointMiddleware, this.handleWrapper.bind(this));

package/router/endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../../src/router/endpoint.ts"],"names":[],"mappings":";;;AASA,iCAAsC;AACtC,mEAA0D;AAC1D,oCAAgF;AAUhF,IAAY,cAMX;AAND,WAAY,cAAc;IACzB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,mCAAiB,CAAA;IACjB,iCAAe,CAAA;AAChB,CAAC,EANW,cAAc,8BAAd,cAAc,QAMzB;AAED,MAAsB,eAAgB,SAAQ,mBAAY;IAChD,SAAS,GAAG,UAAmB,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;IACZ,GAAG,CAAU;IACb,MAAM,GAAmB,cAAc,CAAC,GAAG,CAAC;IAC5C,UAAU,GAAW,GAAG,CAAC;IAEzB,IAAI,CAAkC;IAC7C,8DAA8D;IACvD,WAAW,CAAO;IAElB,KAAK,CAAkC;IAC9C,8DAA8D;IACvD,YAAY,CAAO;IAEnB,MAAM,CAAkC;IAC/C,8DAA8D;IACvD,aAAa,CAAO;IAEpB,OAAO,CAAkC;IAChD,8DAA8D;IACvD,cAAc,CAAO;IAErB,QAAQ,CAAgD;IAC/D,8DAA8D;IACvD,eAAe,CAAO;IAEtB,SAAS;QACf,OAAO;YACN,KAAK,EAAE,IAAI,uBAAe,EAAE;YAC5B,UAAU,EAAE,IAAI,gCAAwB,EAAE;SAC1C,CAAC;IACH,CAAC;IAEM,MAAM;QACZ,iEAAiE;QACjE,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAEe,KAAK,CAAC,QAAQ,CAC7B,YAA2B,EAC3B,UAAkB;QAElB,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAEnC,8CAA8C;QAC9C,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxD,IAAI,aAAa,EAAE,CAAC;YACnB,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,uDAAuD;QACvD,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CACxB,IAAI,CAAC,IAAI,EACT,GAAG,kBAAkB,EACrB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;QACH,CAAC;aACI,CAAC;YACL,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,aAAa,CACzB,OAAmB,EACnB,QAAqB,EACrB,IAAqB;QAErB,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAExD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAQM,KAAK,CAAC,YAAY,CAAC,OAAmB;QAC5C,wDAAwD;QACxD,6BAA6B;QAC7B,MAAM,IAAA,uCAAe,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACD;AAjGD,0CAiGC"}
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../../src/router/endpoint.ts"],"names":[],"mappings":";;;AAQA,iCAAsC;AACtC,mEAA0D;AAC1D,oCAMkB;AAWlB,IAAY,cAMX;AAND,WAAY,cAAc;IACzB,6BAAW,CAAA;IACX,+BAAa,CAAA;IACb,6BAAW,CAAA;IACX,mCAAiB,CAAA;IACjB,iCAAe,CAAA;AAChB,CAAC,EANW,cAAc,8BAAd,cAAc,QAMzB;AAED,MAAsB,eAAgB,SAAQ,mBAAY;IAChD,SAAS,GAAG,UAAmB,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;IACZ,GAAG,CAAU;IACb,MAAM,GAAmB,cAAc,CAAC,GAAG,CAAC;IAC5C,UAAU,GAAW,GAAG,CAAC;IAEzB,IAAI,CAAkC;IAC7C,8DAA8D;IACvD,WAAW,CAAO;IAElB,KAAK,CAAkC;IAC9C,8DAA8D;IACvD,YAAY,CAAO;IAEnB,MAAM,CAAkC;IAC/C,8DAA8D;IACvD,aAAa,CAAO;IAEpB,OAAO,CAAkC;IAChD,8DAA8D;IACvD,cAAc,CAAO;IAErB,QAAQ,CAAgD;IAC/D,8DAA8D;IACvD,eAAe,CAAO;IAEtB,SAAS;QACf,OAAO;YACN,KAAK,EAAE,IAAI,uBAAe,EAAE;YAC5B,UAAU,EAAE,IAAI,gCAAwB,EAAE;SAC1C,CAAC;IACH,CAAC;IAEM,MAAM;QACZ,iEAAiE;QACjE,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;IAEe,KAAK,CAAC,QAAQ,CAC7B,YAA2B,EAC3B,UAAkB;QAElB,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAE/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAEnC,8CAA8C;QAC9C,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhD,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxD,IAAI,aAAa,EAAE,CAAC;YACnB,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,oCAAoC,EAAE,CAAC;QAClE,IAAI,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,IAAI,CAAC,gCAAgC,EAAE,CAAC;YAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAC;YACH,CAAC;YAED,kBAAkB,CAAC,IAAI,CACtB,KAAK,EACJ,OAAmB,EACnB,SAAsB,EACtB,IAAqB,EACpB,EAAE;gBACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBAChB,IAAI,CAAC,gBAAgB,CACpB,MAAM,EAAE,iCAAiC,EAAE,OAAO,CAClD,CAAC;oBACF,MAAM,IAAI,yBAAiB,CAC1B,wCAAwC,CACxC,CAAC;gBACH,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACJ,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC;wBAClC,GAAG,aAAa;wBAChB,SAAS;qBACT,CAAC,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,EAAE,CAAC;oBACd,IAAI,CAAC,gBAAgB,CACpB,OAAO,EAAE,qBAAqB,EAAE,OAAO,EACvC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,CAC3B,CAAC;oBACF,MAAM,KAAK,CAAC;gBACb,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACrB,IAAI,CAAC,gBAAgB,CACpB,MAAM,EAAE,sBAAsB,EAAE,OAAO,EACvC,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAC3C,CAAC;oBACF,MAAM,IAAI,sBAAc,CACvB,MAAM,CAAC,MAAM,IAAI,sBAAsB,CACvC,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,gBAAgB,CACpB,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE;oBACzC,GAAG,aAAa;iBAChB,CACD,CAAC;gBACF,OAAO,IAAI,EAAE,CAAC;YACf,CAAC,CACD,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CACxB,IAAI,CAAC,IAAI,EACT,GAAG,kBAAkB,EACrB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;QACH,CAAC;aACI,CAAC;YACL,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,aAAa,CACzB,OAAmB,EACnB,QAAqB,EACrB,IAAqB;QAErB,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAExD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAQM,KAAK,CAAC,YAAY,CAAC,OAAmB;QAC5C,wDAAwD;QACxD,6BAA6B;QAC7B,MAAM,IAAA,uCAAe,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;CACD;AA7JD,0CA6JC"}

package/router/endpoints/health-check-endpoint.js

@@ -5,6 +5,8 @@ const valsan_1 = require("valsan");
 const get_endpoint_1 = require("./get-endpoint");
 class HealthCheckEndpoint extends get_endpoint_1.GetEndpoint {
     path = '/health';
+    // override authentication = null;
+    // override authorization = null;
     responseExample = {
         status: 'ok',
         timestamp: new Date().toISOString(),

package/router/endpoints/health-check-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"health-check-endpoint.js","sourceRoot":"","sources":["../../../../src/router/endpoints/health-check-endpoint.ts"],"names":[],"mappings":";;;AAAA,mCAKgB;AAChB,iDAA6C;AAE7C,MAAa,mBAAoB,SAAQ,0BAAW;IAC1C,IAAI,GAAG,SAAS,CAAC;IAEjB,eAAe,GAAG;QAC1B,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,aAAa;KAC1B,CAAC;IAEO,QAAQ,GAAG,IAAI,qBAAY,CAAC;QACpC,MAAM,EAAE;YACP,MAAM,EAAE,IAAI,2BAAkB,EAAE;YAChC,SAAS,EAAE,IAAI,+BAAsB,EAAE;YACvC,MAAM,EAAE,IAAI,6BAAoB,EAAE;YAClC,WAAW,EAAE,IAAI,2BAAkB,EAAE;SACrC;KACD,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM;QACX,OAAO;YACN,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE;YAC9B,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE;YACpC,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE;YAC9B,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,YAAY;QACxB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,SAAS;QACrB,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAEM,KAAK,CAAC,cAAc;QAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC;IACjD,CAAC;CACD;AA3CD,kDA2CC"}
+{"version":3,"file":"health-check-endpoint.js","sourceRoot":"","sources":["../../../../src/router/endpoints/health-check-endpoint.ts"],"names":[],"mappings":";;;AAAA,mCAKgB;AAChB,iDAA6C;AAE7C,MAAa,mBAAoB,SAAQ,0BAAW;IAC1C,IAAI,GAAG,SAAS,CAAC;IAC1B,kCAAkC;IAClC,iCAAiC;IAExB,eAAe,GAAG;QAC1B,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,aAAa;KAC1B,CAAC;IAEO,QAAQ,GAAG,IAAI,qBAAY,CAAC;QACpC,MAAM,EAAE;YACP,MAAM,EAAE,IAAI,2BAAkB,EAAE;YAChC,SAAS,EAAE,IAAI,+BAAsB,EAAE;YACvC,MAAM,EAAE,IAAI,6BAAoB,EAAE;YAClC,WAAW,EAAE,IAAI,2BAAkB,EAAE;SACrC;KACD,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM;QACX,OAAO;YACN,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE;YAC9B,SAAS,EAAE,MAAM,IAAI,CAAC,YAAY,EAAE;YACpC,MAAM,EAAE,MAAM,IAAI,CAAC,SAAS,EAAE;YAC9B,WAAW,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE;SACxC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,YAAY;QACxB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAEM,KAAK,CAAC,SAAS;QACrB,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAEM,KAAK,CAAC,cAAc;QAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC;IACjD,CAAC;CACD;AA7CD,kDA6CC"}

package/router/index.d.ts

@@ -1,3 +1,4 @@
 export { ApiEndpoint, ApiRequest, ApiResponse, ApiNextFunction, BaseApiEndpoint, } from './endpoint';
 export { ApiRouter, BaseApiRouter } from './router';
+export { AUTHENTICATION_KEY, AUTHORIZATION_KEY, AUTHORIZATION_REQUIREMENT_KEY, } from './base';
 export { GetEndpoint, PostEndpoint, PutEndpoint, DeleteEndpoint, PatchEndpoint, HealthCheckEndpoint, } from './endpoints';