cauthy-auth 0.0.0-stage → 0.2.0

package/dist/cli.js

@@ -0,0 +1,380 @@
+#!/usr/bin/env node
+"use strict";
+
+// src/cli.ts
+var import_node_fs = require("fs");
+
+// src/permissions.ts
+async function pushPolicy(o) {
+  const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const system = o.system ?? env("CAUTHY_SYSTEM") ?? "";
+  const tenant = o.tenant ?? env("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_SYSTEM: system, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a policy`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/systems/${encodeURIComponent(system)}/policy`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify({ roles: o.roles })
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the policy (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/theme.ts
+var MAX_RADIUS = 40;
+function declarations(css) {
+  const text = css.replace(/\/\*[\s\S]*?\*\//g, "");
+  const out2 = [];
+  const within = [];
+  let chunk = "";
+  let quote = "";
+  let depth = 0;
+  const flush = () => {
+    const m = /^\s*(--[\w-]+)\s*:\s*([\s\S]+?)\s*$/.exec(chunk);
+    if (m) out2.push({ name: m[1], value: m[2].replace(/\s+/g, " ").replace(/\s*!important$/, ""), within: [...within] });
+    chunk = "";
+  };
+  for (const ch of text) {
+    if (quote) {
+      chunk += ch;
+      if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      chunk += ch;
+    } else if (ch === "(") {
+      depth++;
+      chunk += ch;
+    } else if (ch === ")") {
+      depth = Math.max(0, depth - 1);
+      chunk += ch;
+    } else if (ch === "{" && depth === 0) {
+      within.push(chunk.trim().replace(/\s+/g, " "));
+      chunk = "";
+    } else if (ch === "}" && depth === 0) {
+      flush();
+      within.pop();
+    } else if (ch === ";" && depth === 0) {
+      flush();
+    } else {
+      chunk += ch;
+    }
+  }
+  return out2;
+}
+var DARK = /prefers-color-scheme:\s*dark|data-(mode|theme|color-scheme)=["']?dark|\.dark\b/i;
+var LIGHT = /prefers-color-scheme:\s*light|data-(mode|theme|color-scheme)=["']?light|\.light\b/i;
+var NAMED = /data-theme=["']?([\w-]+)/i;
+function applies(d, o) {
+  for (const scope of d.within) {
+    if (o.mode === "light" && DARK.test(scope)) return false;
+    if (o.mode === "dark" && LIGHT.test(scope)) return false;
+    const named = NAMED.exec(scope);
+    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false;
+    if (!scope.startsWith("@") && !/:root|^html\b|^body\b|\[data-|^\*$|:host/.test(scope)) return false;
+  }
+  return true;
+}
+function resolve(value, vars, seen = 0) {
+  if (seen > 16) return null;
+  let unresolved = false;
+  let out2 = value;
+  for (let guard = 0; guard < 32 && /var\(/.test(out2); guard++) {
+    out2 = out2.replace(/var\(\s*(--[\w-]+)\s*(?:,\s*([^()]*(?:\([^()]*\)[^()]*)*))?\)/, (_m, name, fallback) => {
+      const known = vars.get(name);
+      const next = known !== void 0 ? resolve(known, vars, seen + 1) : fallback !== void 0 ? resolve(fallback.trim(), vars, seen + 1) : null;
+      if (next === null) unresolved = true;
+      return next ?? "";
+    });
+    if (unresolved) return null;
+  }
+  return /var\(/.test(out2) ? null : out2.trim();
+}
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+var hex2 = (n) => Math.round(clamp01(n) * 255).toString(16).padStart(2, "0");
+var gamma = (c) => c <= 31308e-7 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055;
+function out(r, g, b, a = 1) {
+  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`;
+  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1e3) / 1e3})`;
+}
+var alpha = (s) => s === void 0 ? 1 : s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s);
+var KEYWORDS = { white: "#ffffff", black: "#000000" };
+function toColor(value) {
+  const v = value.trim().toLowerCase();
+  if (KEYWORDS[v]) return KEYWORDS[v];
+  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v;
+  let m = /^rgba?\(\s*([\d.]+%?)[\s,]+([\d.]+%?)[\s,]+([\d.]+%?)(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const ch = (s) => s.endsWith("%") ? parseFloat(s) / 100 : parseFloat(s) / 255;
+    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]));
+  }
+  m = /^hsla?\(\s*([\d.]+)(?:deg)?[\s,]+([\d.]+)%[\s,]+([\d.]+)%(?:\s*[,/]\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const h = (parseFloat(m[1]) % 360 + 360) % 360;
+    const s = parseFloat(m[2]) / 100;
+    const l = parseFloat(m[3]) / 100;
+    const f = (n) => {
+      const k = (n + h / 30) % 12;
+      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1));
+    };
+    return out(f(0), f(8), f(4), alpha(m[4]));
+  }
+  m = /^oklch\(\s*([\d.]+%?)\s+([\d.]+%?)\s+([\d.]+)(?:deg)?(?:\s*\/\s*([\d.]+%?))?\s*\)$/.exec(v);
+  if (m) {
+    const L = m[1].endsWith("%") ? parseFloat(m[1]) / 100 : parseFloat(m[1]);
+    const C = m[2].endsWith("%") ? parseFloat(m[2]) / 100 * 0.4 : parseFloat(m[2]);
+    const H = parseFloat(m[3]) * Math.PI / 180;
+    const a = C * Math.cos(H);
+    const b = C * Math.sin(H);
+    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3);
+    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3);
+    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3);
+    return out(
+      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),
+      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),
+      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),
+      alpha(m[4])
+    );
+  }
+  return null;
+}
+function toRadius(value) {
+  const m = /^([\d.]+)(px|rem|em)?$/.exec(value.trim());
+  if (!m) return null;
+  const px = parseFloat(m[1]) * (m[2] === "rem" || m[2] === "em" ? 16 : 1);
+  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null;
+}
+function toFont(value) {
+  const v = value.trim();
+  return /^[A-Za-z0-9 ,'"_-]{1,200}$/.test(v) && (v.match(/"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null;
+}
+var COLORS = [
+  ["background", ["--sm-bg-surface", "--sm-surface"]],
+  ["surface", ["--sm-bg-surface-raised", "--sm-surface-raised"]],
+  ["text", ["--sm-text-primary", "--sm-surface-text"]],
+  ["textMuted", ["--sm-text-secondary"]],
+  ["border", ["--sm-border-default", "--sm-surface-border"]],
+  ["primary", ["--sm-primary", "--sm-bg-interactive"]],
+  ["primaryText", ["--sm-primary-text", "--sm-text-inverse"]],
+  ["accent", ["--sm-text-brand", "--sm-border-focus", "--sm-accent"]],
+  ["error", ["--sm-error-soft-text", "--sm-error"]],
+  ["errorBackground", ["--sm-error-soft"]],
+  ["success", ["--sm-success-soft-text", "--sm-success"]],
+  ["successBackground", ["--sm-success-soft"]]
+];
+function themeFromStackmyth(css, options = {}) {
+  const o = { mode: options.mode ?? "light", theme: options.theme };
+  const vars = /* @__PURE__ */ new Map();
+  for (const sheet of Array.isArray(css) ? css : [css]) {
+    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value);
+  }
+  const theme = {};
+  const warnings = [];
+  const read = (tokens, to, what) => {
+    for (const token of tokens) {
+      const raw = vars.get(token);
+      if (raw === void 0) continue;
+      const value = resolve(raw, vars);
+      const got = value === null ? null : to(value);
+      if (got !== null) return got;
+      warnings.push(`${token}: "${raw}" is not ${what} Cauthy can take`);
+    }
+    return void 0;
+  };
+  for (const [field, tokens] of COLORS) {
+    const c = read(tokens, toColor, "a colour");
+    if (c !== void 0) theme[field] = c;
+  }
+  const radius = read(["--sm-radius-container", "--sm-radius-md"], toRadius, "a length");
+  if (radius !== void 0) theme.radius = radius;
+  const button = read(["--sm-radius-interactive", "--sm-radius-sm"], toRadius, "a length");
+  if (button !== void 0) theme.buttonRadius = button;
+  const font = read(["--sm-font-family"], toFont, "a font list");
+  if (font !== void 0) theme.fontFamily = font;
+  if (options.logoUrl) theme.logoUrl = options.logoUrl;
+  if (vars.size === 0) warnings.push("no custom properties were found: is this the stylesheet that declares the --sm-* tokens?");
+  else if (![...vars.keys()].some((k) => k.startsWith("--sm-"))) warnings.push("no --sm-* token was found in these stylesheets");
+  return { theme, warnings };
+}
+function toWire(theme) {
+  const names = {
+    background: "background",
+    surface: "surface",
+    text: "text",
+    textMuted: "text_muted",
+    border: "border",
+    primary: "primary",
+    primaryText: "primary_text",
+    accent: "accent",
+    error: "error",
+    errorBackground: "error_background",
+    success: "success",
+    successBackground: "success_background",
+    radius: "radius",
+    buttonRadius: "button_radius",
+    fontFamily: "font_family",
+    logoUrl: "logo_url"
+  };
+  const wire = {};
+  for (const [k, v] of Object.entries(theme)) if (v !== void 0 && v !== "") wire[names[k]] = v;
+  return wire;
+}
+async function pushTheme(o) {
+  const env = (n) => typeof process !== "undefined" ? process.env?.[n] : void 0;
+  const issuer = (o.issuer ?? env("CAUTHY_ISSUER") ?? "").replace(/\/+$/, "");
+  const clientId = o.clientId ?? env("CAUTHY_CLIENT_ID") ?? "";
+  const tenant = o.tenant ?? env("CAUTHY_TENANT") ?? "";
+  const token = o.token ?? env("CAUTHY_TOKEN") ?? "";
+  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {
+    if (v === "") throw new Error(`cauthy-auth: ${name} is required to push a theme`);
+  }
+  const res = await (o.fetch ?? fetch)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {
+    method: "PUT",
+    headers: { authorization: `Bearer ${token}`, "x-tenant-key": tenant, "content-type": "application/json" },
+    body: JSON.stringify(toWire(o.theme))
+  });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(`cauthy-auth: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`);
+  }
+}
+
+// src/cli.ts
+var POLICY_HELP = `cauthy-auth policy --file <roles.json> [--system <name>] [--push]
+
+Loads a system's catalog of roles into Cauthy from a file:
+
+  { "roles": [ { "role": "accountant", "name": "Accountant", "inherits": ["reader"],
+      "permissions": [ { "resource": "ledger", "action": "write" },
+                       { "kind": "business", "resource": "books.close", "action": "write" } ] } ] }
+
+  --file <file>     The catalog, as JSON.
+  --system <name>   The system it is of. Default: CAUTHY_SYSTEM.
+  --push            Send it to Cauthy, REPLACING the catalog it has. Without it
+                    the catalog is only checked and shown.
+
+Use it to load a first catalog. Afterwards the catalog is Cauthy's, edited in
+its dashboard: pushing again overwrites what was edited there.
+
+To push: CAUTHY_ISSUER, CAUTHY_TENANT (the workspace's slug) and CAUTHY_TOKEN
+(a personal access token with organizations:manage).
+`;
+async function policy(argv) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(POLICY_HELP);
+    return;
+  }
+  let file;
+  let system;
+  let push = false;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const value = () => argv[++i] ?? fail(`${arg} needs a value`);
+    if (arg === "--file") file = value();
+    else if (arg === "--system") system = value();
+    else if (arg === "--push") push = true;
+    else fail(`unknown option ${arg}
+
+${POLICY_HELP}`);
+  }
+  if (!file) fail("give the catalog with --file\n\n" + POLICY_HELP);
+  let roles;
+  try {
+    const parsed = JSON.parse((0, import_node_fs.readFileSync)(file, "utf8"));
+    const list = Array.isArray(parsed) ? parsed : parsed.roles;
+    if (!Array.isArray(list)) throw new Error('no "roles" list');
+    roles = list;
+  } catch (err) {
+    return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const permissions = roles.reduce((n, r) => n + (r.permissions?.length ?? 0), 0);
+  process.stdout.write(`${roles.length} roles, ${permissions} permissions: ${roles.map((r) => r.role).join(", ")}
+`);
+  if (push) {
+    await pushPolicy({ system, roles });
+    process.stdout.write("Sent to Cauthy: this is now the catalog of the system.\n");
+  } else {
+    process.stdout.write("Not sent. Add --push to give it to Cauthy.\n");
+  }
+}
+var HELP = `cauthy-auth theme [options]
+
+Reads the application's Stackmyth theme and gives it to Cauthy's hosted pages.
+
+  --css <file>      A stylesheet that declares --sm-* tokens. Repeat it, in the
+                    order the application loads them: Stackmyth's own first,
+                    the application's brand file after.
+  --theme <name>    The named theme to read, for a sheet with [data-theme=\u2026].
+  --mode <mode>     light (default) or dark.
+  --logo <url>      An https image shown where "Cauthy" is.
+  --push            Send the theme to Cauthy. Without it the theme is only shown.
+  --clear           Take the application back to Cauthy's own look.
+
+To push: CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_TENANT (the workspace's slug)
+and CAUTHY_TOKEN (a personal access token with oauth_clients:manage).
+`;
+function fail(message) {
+  process.stderr.write(`cauthy-auth: ${message}
+`);
+  process.exit(1);
+}
+async function main(argv) {
+  if (argv[0] === "policy") return policy(argv.slice(1));
+  if (argv[0] !== "theme" || argv.includes("--help") || argv.includes("-h")) {
+    process.stdout.write(HELP);
+    process.exit(argv[0] === "theme" || argv.length === 0 || argv.includes("--help") || argv.includes("-h") ? 0 : 1);
+  }
+  const files = [];
+  let theme;
+  let mode = "light";
+  let logoUrl;
+  let push = false;
+  let clear = false;
+  for (let i = 1; i < argv.length; i++) {
+    const arg = argv[i];
+    const value = () => argv[++i] ?? fail(`${arg} needs a value`);
+    if (arg === "--css") files.push(value());
+    else if (arg === "--theme") theme = value();
+    else if (arg === "--mode") {
+      const m = value();
+      if (m !== "light" && m !== "dark") fail("--mode is light or dark");
+      mode = m;
+    } else if (arg === "--logo") logoUrl = value();
+    else if (arg === "--push") push = true;
+    else if (arg === "--clear") clear = true;
+    else fail(`unknown option ${arg}
+
+${HELP}`);
+  }
+  if (clear) {
+    await pushTheme({ theme: {} });
+    process.stdout.write("The application is back to Cauthy's own look.\n");
+    return;
+  }
+  if (files.length === 0) fail("give at least one --css file\n\n" + HELP);
+  const sheets = files.map((f) => {
+    try {
+      return (0, import_node_fs.readFileSync)(f, "utf8");
+    } catch {
+      return fail(`cannot read ${f}`);
+    }
+  });
+  const imported = themeFromStackmyth(sheets, { theme, mode, logoUrl });
+  for (const w of imported.warnings) process.stderr.write(`warning: ${w}
+`);
+  if (Object.keys(imported.theme).length === 0) fail("no theme could be read from these stylesheets");
+  process.stdout.write(JSON.stringify(toWire(imported.theme), null, 2) + "\n");
+  if (push) {
+    await pushTheme({ theme: imported.theme });
+    process.stdout.write("Sent to Cauthy: its pages now take this look for the application.\n");
+  } else {
+    process.stdout.write("Not sent. Add --push to give it to Cauthy.\n");
+  }
+}
+main(process.argv.slice(2)).catch((err) => fail(err instanceof Error ? err.message.replace(/^@cauthy\/auth: /, "") : String(err)));

package/dist/fastify.d.mts

@@ -0,0 +1,22 @@
+import { FastifyReply, FastifyPluginAsync } from 'fastify';
+import { C as Cauthy } from './cauthy-BrIMaoj1.mjs';
+import { S as Session } from './types-CYmUVWzY.mjs';
+import 'jose';
+
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Who is signed in, or null. Asked once per request. */
+        cauthy(): Promise<Session | null>;
+    }
+    interface FastifyInstance {
+        /** A preHandler that answers 401 unless somebody is signed in. */
+        requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+    }
+}
+interface CauthyFastifyOptions {
+    auth: Cauthy;
+}
+declare const plugin: FastifyPluginAsync<CauthyFastifyOptions>;
+declare const cauthyFastify: FastifyPluginAsync<CauthyFastifyOptions>;
+
+export { type CauthyFastifyOptions, cauthyFastify, plugin as default };

package/dist/fastify.d.ts

@@ -0,0 +1,22 @@
+import { FastifyReply, FastifyPluginAsync } from 'fastify';
+import { C as Cauthy } from './cauthy-CCZc9w8r.js';
+import { S as Session } from './types-CYmUVWzY.js';
+import 'jose';
+
+declare module 'fastify' {
+    interface FastifyRequest {
+        /** Who is signed in, or null. Asked once per request. */
+        cauthy(): Promise<Session | null>;
+    }
+    interface FastifyInstance {
+        /** A preHandler that answers 401 unless somebody is signed in. */
+        requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+    }
+}
+interface CauthyFastifyOptions {
+    auth: Cauthy;
+}
+declare const plugin: FastifyPluginAsync<CauthyFastifyOptions>;
+declare const cauthyFastify: FastifyPluginAsync<CauthyFastifyOptions>;
+
+export { type CauthyFastifyOptions, cauthyFastify, plugin as default };

package/dist/fastify.js

@@ -0,0 +1,81 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/fastify.ts
+var fastify_exports = {};
+__export(fastify_exports, {
+  cauthyFastify: () => cauthyFastify,
+  default: () => fastify_default
+});
+module.exports = __toCommonJS(fastify_exports);
+function originOf(req) {
+  return `${req.protocol}://${req.headers.host ?? "localhost"}`;
+}
+function toWebRequest(req) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers });
+}
+var kSession = /* @__PURE__ */ Symbol("cauthy.session");
+var kReply = /* @__PURE__ */ Symbol("cauthy.reply");
+var plugin = async (app, { auth }) => {
+  const base = auth.options.basePath;
+  app.decorateRequest("cauthy", async function() {
+    const self = this;
+    self[kSession] ??= (async () => {
+      const resolved = await auth.resolve(toWebRequest(this));
+      const reply = this[kReply];
+      if (resolved.cookies.length > 0 && reply) reply.header("set-cookie", resolved.cookies);
+      return resolved.session;
+    })();
+    return self[kSession];
+  });
+  app.addHook("onRequest", async (req, reply) => {
+    ;
+    req[kReply] = reply;
+  });
+  app.decorate("requireSession", async function(request, reply) {
+    if (await request.cauthy() === null) {
+      await reply.code(401).header("x-cauthy-session", "none").send({ error: "unauthenticated" });
+    }
+  });
+  const serve = async (req, reply) => {
+    const res = await auth.handler(toWebRequest(req));
+    reply.code(res.status);
+    res.headers.forEach((value, name) => {
+      if (name !== "set-cookie") reply.header(name, value);
+    });
+    const cookies = res.headers.getSetCookie();
+    if (cookies.length > 0) reply.header("set-cookie", cookies);
+    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
+  };
+  app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
+};
+plugin[/* @__PURE__ */ Symbol.for("skip-override")] = true;
+plugin[/* @__PURE__ */ Symbol.for("fastify.display-name")] = "cauthy-auth";
+var cauthyFastify = plugin;
+var fastify_default = plugin;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  cauthyFastify
+});
+//# sourceMappingURL=fastify.js.map

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // The routes read no body: what they need is in the URL and the cookies.\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = 'cauthy-auth'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkCA,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAEA,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AACrF;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,KAAK,MAAM;AACjG,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AACzE;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/fastify.mjs

@@ -0,0 +1,56 @@
+// src/fastify.ts
+function originOf(req) {
+  return `${req.protocol}://${req.headers.host ?? "localhost"}`;
+}
+function toWebRequest(req) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (Array.isArray(v)) for (const one of v) headers.append(k, one);
+    else if (v !== void 0) headers.set(k, v);
+  }
+  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers });
+}
+var kSession = /* @__PURE__ */ Symbol("cauthy.session");
+var kReply = /* @__PURE__ */ Symbol("cauthy.reply");
+var plugin = async (app, { auth }) => {
+  const base = auth.options.basePath;
+  app.decorateRequest("cauthy", async function() {
+    const self = this;
+    self[kSession] ??= (async () => {
+      const resolved = await auth.resolve(toWebRequest(this));
+      const reply = this[kReply];
+      if (resolved.cookies.length > 0 && reply) reply.header("set-cookie", resolved.cookies);
+      return resolved.session;
+    })();
+    return self[kSession];
+  });
+  app.addHook("onRequest", async (req, reply) => {
+    ;
+    req[kReply] = reply;
+  });
+  app.decorate("requireSession", async function(request, reply) {
+    if (await request.cauthy() === null) {
+      await reply.code(401).header("x-cauthy-session", "none").send({ error: "unauthenticated" });
+    }
+  });
+  const serve = async (req, reply) => {
+    const res = await auth.handler(toWebRequest(req));
+    reply.code(res.status);
+    res.headers.forEach((value, name) => {
+      if (name !== "set-cookie") reply.header(name, value);
+    });
+    const cookies = res.headers.getSetCookie();
+    if (cookies.length > 0) reply.header("set-cookie", cookies);
+    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()));
+  };
+  app.route({ method: ["GET", "POST"], url: `${base}/*`, handler: serve });
+};
+plugin[/* @__PURE__ */ Symbol.for("skip-override")] = true;
+plugin[/* @__PURE__ */ Symbol.for("fastify.display-name")] = "cauthy-auth";
+var cauthyFastify = plugin;
+var fastify_default = plugin;
+export {
+  cauthyFastify,
+  fastify_default as default
+};
+//# sourceMappingURL=fastify.mjs.map

package/dist/fastify.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fastify.ts"],"sourcesContent":["// Fastify: the routes, and who is signed in on every request.\n//\n//   await app.register(cauthyFastify, { auth })\n//\n//   app.get('/api/me', async (req, reply) => {\n//     const session = await req.cauthy()\n//     if (!session) return reply.code(401).send({ error: 'unauthenticated' })\n//     return session.user\n//   })\n//\n//   app.get('/api/books', { preHandler: app.requireSession }, async (req) => { … })\n//\n// Here a session that needs renewing is renewed on the spot: Fastify has the\n// reply in hand, so the new cookie always goes back.\n\nimport type { FastifyInstance, FastifyPluginAsync, FastifyReply, FastifyRequest } from 'fastify'\nimport type { Cauthy } from './cauthy'\nimport type { Session } from './types'\n\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is signed in, or null. Asked once per request. */\n    cauthy(): Promise<Session | null>\n  }\n  interface FastifyInstance {\n    /** A preHandler that answers 401 unless somebody is signed in. */\n    requireSession(request: FastifyRequest, reply: FastifyReply): Promise<void>\n  }\n}\n\nexport interface CauthyFastifyOptions {\n  auth: Cauthy\n}\n\nfunction originOf(req: FastifyRequest): string {\n  return `${req.protocol}://${req.headers.host ?? 'localhost'}`\n}\n\nfunction toWebRequest(req: FastifyRequest): Request {\n  const headers = new Headers()\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (Array.isArray(v)) for (const one of v) headers.append(k, one)\n    else if (v !== undefined) headers.set(k, v)\n  }\n  // The routes read no body: what they need is in the URL and the cookies.\n  return new Request(new URL(req.url, originOf(req)), { method: req.method, headers })\n}\n\nconst kSession = Symbol('cauthy.session')\nconst kReply = Symbol('cauthy.reply')\n\nconst plugin: FastifyPluginAsync<CauthyFastifyOptions> = async (app: FastifyInstance, { auth }) => {\n  const base = auth.options.basePath\n\n  app.decorateRequest('cauthy', async function (this: FastifyRequest): Promise<Session | null> {\n    const self = this as FastifyRequest & { [kSession]?: Promise<Session | null> }\n    self[kSession] ??= (async () => {\n      const resolved = await auth.resolve(toWebRequest(this))\n      // Set through the raw response so the cookie leaves whatever the route\n      // answers with, even an error.\n      const reply = (this as FastifyRequest & { [kReply]?: FastifyReply })[kReply]\n      if (resolved.cookies.length > 0 && reply) reply.header('set-cookie', resolved.cookies)\n      return resolved.session\n    })()\n    return self[kSession]\n  })\n\n  app.addHook('onRequest', async (req, reply) => {\n    ;(req as FastifyRequest & { [kReply]?: FastifyReply })[kReply] = reply\n  })\n\n  app.decorate('requireSession', async function (request: FastifyRequest, reply: FastifyReply): Promise<void> {\n    if ((await request.cauthy()) === null) {\n      await reply.code(401).header('x-cauthy-session', 'none').send({ error: 'unauthenticated' })\n    }\n  })\n\n  const serve = async (req: FastifyRequest, reply: FastifyReply) => {\n    const res = await auth.handler(toWebRequest(req))\n    reply.code(res.status)\n    res.headers.forEach((value, name) => {\n      if (name !== 'set-cookie') reply.header(name, value)\n    })\n    const cookies = res.headers.getSetCookie()\n    if (cookies.length > 0) reply.header('set-cookie', cookies)\n    return reply.send(res.body === null ? null : Buffer.from(await res.arrayBuffer()))\n  }\n  app.route({ method: ['GET', 'POST'], url: `${base}/*`, handler: serve })\n}\n\n\n// Outside encapsulation: `req.cauthy()` and `requireSession` are for the whole\n// application, not only for routes registered beside this plugin.\n;(plugin as unknown as Record<symbol, boolean>)[Symbol.for('skip-override')] = true\n;(plugin as unknown as Record<symbol, unknown>)[Symbol.for('fastify.display-name')] = 'cauthy-auth'\n\nexport const cauthyFastify = plugin\nexport default plugin\n"],"mappings":";AAkCA,SAAS,SAAS,KAA6B;AAC7C,SAAO,GAAG,IAAI,QAAQ,MAAM,IAAI,QAAQ,QAAQ,WAAW;AAC7D;AAEA,SAAS,aAAa,KAA8B;AAClD,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AAChD,QAAI,MAAM,QAAQ,CAAC,EAAG,YAAW,OAAO,EAAG,SAAQ,OAAO,GAAG,GAAG;AAAA,aACvD,MAAM,OAAW,SAAQ,IAAI,GAAG,CAAC;AAAA,EAC5C;AAEA,SAAO,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AACrF;AAEA,IAAM,WAAW,uBAAO,gBAAgB;AACxC,IAAM,SAAS,uBAAO,cAAc;AAEpC,IAAM,SAAmD,OAAO,KAAsB,EAAE,KAAK,MAAM;AACjG,QAAM,OAAO,KAAK,QAAQ;AAE1B,MAAI,gBAAgB,UAAU,iBAA+D;AAC3F,UAAM,OAAO;AACb,SAAK,QAAQ,OAAO,YAAY;AAC9B,YAAM,WAAW,MAAM,KAAK,QAAQ,aAAa,IAAI,CAAC;AAGtD,YAAM,QAAS,KAAsD,MAAM;AAC3E,UAAI,SAAS,QAAQ,SAAS,KAAK,MAAO,OAAM,OAAO,cAAc,SAAS,OAAO;AACrF,aAAO,SAAS;AAAA,IAClB,GAAG;AACH,WAAO,KAAK,QAAQ;AAAA,EACtB,CAAC;AAED,MAAI,QAAQ,aAAa,OAAO,KAAK,UAAU;AAC7C;AAAC,IAAC,IAAqD,MAAM,IAAI;AAAA,EACnE,CAAC;AAED,MAAI,SAAS,kBAAkB,eAAgB,SAAyB,OAAoC;AAC1G,QAAK,MAAM,QAAQ,OAAO,MAAO,MAAM;AACrC,YAAM,MAAM,KAAK,GAAG,EAAE,OAAO,oBAAoB,MAAM,EAAE,KAAK,EAAE,OAAO,kBAAkB,CAAC;AAAA,IAC5F;AAAA,EACF,CAAC;AAED,QAAM,QAAQ,OAAO,KAAqB,UAAwB;AAChE,UAAM,MAAM,MAAM,KAAK,QAAQ,aAAa,GAAG,CAAC;AAChD,UAAM,KAAK,IAAI,MAAM;AACrB,QAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,UAAI,SAAS,aAAc,OAAM,OAAO,MAAM,KAAK;AAAA,IACrD,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,aAAa;AACzC,QAAI,QAAQ,SAAS,EAAG,OAAM,OAAO,cAAc,OAAO;AAC1D,WAAO,MAAM,KAAK,IAAI,SAAS,OAAO,OAAO,OAAO,KAAK,MAAM,IAAI,YAAY,CAAC,CAAC;AAAA,EACnF;AACA,MAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,MAAM,GAAG,KAAK,GAAG,IAAI,MAAM,SAAS,MAAM,CAAC;AACzE;AAKE,OAA8C,uBAAO,IAAI,eAAe,CAAC,IAAI;AAC7E,OAA8C,uBAAO,IAAI,sBAAsB,CAAC,IAAI;AAE/E,IAAM,gBAAgB;AAC7B,IAAO,kBAAQ;","names":[]}

package/dist/index.d.mts

@@ -0,0 +1,5 @@
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-BrIMaoj1.mjs';
+export { C as CauthyConfigError, a as CauthyOptions, J as JsonValue, P as PublicSession, S as Session, b as SessionOrganization, c as SessionStatus, d as SessionUser } from './types-CYmUVWzY.mjs';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, pushTheme, themeFromStackmyth } from './theme.mjs';
+export { P as Permitted, a as PolicyPermission, b as PolicyRole, c as PushPolicyOptions, d as can, p as pushPolicy } from './permissions-B-a3eN0h.mjs';
+import 'jose';

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { C as Cauthy, a as CauthyEvent, b as CauthyWebhookError, R as Resolved, V as VerifyWebhookOptions, c as createCauthy, v as verifyWebhook } from './cauthy-CCZc9w8r.js';
+export { C as CauthyConfigError, a as CauthyOptions, J as JsonValue, P as PublicSession, S as Session, b as SessionOrganization, c as SessionStatus, d as SessionUser } from './types-CYmUVWzY.js';
+export { CauthyTheme, ImportedTheme, PushThemeOptions, StackmythThemeOptions, pushTheme, themeFromStackmyth } from './theme.js';
+export { P as Permitted, a as PolicyPermission, b as PolicyRole, c as PushPolicyOptions, d as can, p as pushPolicy } from './permissions-B-a3eN0h.js';
+import 'jose';