client-certificate-auth 1.2.0 → 1.3.1

package/lib/extractor.cjs

@@ -0,0 +1,20 @@
+/*!
+ * client-certificate-auth/extractor - CommonJS wrapper
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+'use strict';
+
+let _module;
+
+async function load() {
+    // Stryker disable next-line ConditionalExpression,BlockStatement: test ordering caches _module from prior test; ConditionalExpression→true (always re-import) re-imports same module successfully; BlockStatement→{} uses cached value
+    if (!_module) {
+        // Stryker disable next-line StringLiteral: test ordering caches _module; StringLiteral→"" fails import but cached value masks it
+        _module = await import('./extractor.js');
+    }
+    return _module;
+}
+
+module.exports = { load };

package/lib/extractor.d.cts

@@ -0,0 +1,13 @@
+/*!
+ * client-certificate-auth/extractor - CommonJS type declarations
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+import type * as ExtractorModule from './extractor.js';
+
+declare const extractor: {
+    load(): Promise<typeof ExtractorModule>;
+};
+
+export = extractor;

package/lib/helpers.cjs

@@ -0,0 +1,20 @@
+/*!
+ * client-certificate-auth/helpers - CommonJS wrapper
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+'use strict';
+
+let _module;
+
+async function load() {
+    // Stryker disable next-line ConditionalExpression,BlockStatement: test ordering caches _module from prior test; ConditionalExpression→true (always re-import) re-imports same module successfully; BlockStatement→{} uses cached value
+    if (!_module) {
+        // Stryker disable next-line StringLiteral: test ordering caches _module; StringLiteral→"" fails import but cached value masks it
+        _module = await import('./helpers.js');
+    }
+    return _module;
+}
+
+module.exports = { load };

package/lib/helpers.d.cts

@@ -0,0 +1,13 @@
+/*!
+ * client-certificate-auth/helpers - CommonJS type declarations
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+import type * as HelpersModule from './helpers.js';
+
+declare const helpers: {
+    load(): Promise<typeof HelpersModule>;
+};
+
+export = helpers;

package/lib/helpers.d.ts

@@ -4,13 +4,9 @@
  * @license MIT
  */
 
-import type { PeerCertificate, DetailedPeerCertificate } from 'tls';
-import type { ClientCertRequest } from './clientCertificateAuth.js';
+import type { ValidationCallback } from './clientCertificateAuth.js';
 
-/**
- * Validation callback for clientCertificateAuth middleware.
- */
-export type ValidationCallback = (cert: PeerCertificate | DetailedPeerCertificate, req?: ClientCertRequest) => boolean | Promise<boolean>;
+export type { ValidationCallback };
 
 /**
  * Distinguished Name fields for matching.

package/lib/helpers.js

@@ -9,6 +9,17 @@
  * @typedef {(cert: PeerCertificate, req?: import('http').IncomingMessage) => boolean | Promise<boolean>} ValidationCallback
  */
 
+/**
+ * Normalize a certificate DN field value to an array.
+ * Node.js returns string for single-valued and string[] for multi-valued DN attributes.
+ * @param {string | string[] | undefined} value
+ * @returns {string[]}
+ */
+function toArray(value) {
+    if (value === undefined || value === null) {return [];}
+    return Array.isArray(value) ? value : [value];
+}
+
 /**
  * Create a validation callback that allows certificates with matching Common Names.
  *
@@ -20,7 +31,7 @@
  */
 export function allowCN(names) {
     const allowed = new Set(names);
-    return (cert) => allowed.has(cert.subject?.CN);
+    return (cert) => toArray(cert.subject?.CN).some((cn) => allowed.has(cn));
 }
 
 /**
@@ -76,7 +87,7 @@ export function allowIssuer(match) {
     const entries = Object.entries(match);
     return (cert) => {
         if (!cert.issuer) {return false;}
-        return entries.every(([key, value]) => cert.issuer[key] === value);
+        return entries.every(([key, value]) => toArray(cert.issuer[key]).includes(value));
     };
 }
 
@@ -94,7 +105,7 @@ export function allowSubject(match) {
     const entries = Object.entries(match);
     return (cert) => {
         if (!cert.subject) {return false;}
-        return entries.every(([key, value]) => cert.subject[key] === value);
+        return entries.every(([key, value]) => toArray(cert.subject[key]).includes(value));
     };
 }
 
@@ -109,7 +120,7 @@ export function allowSubject(match) {
  */
 export function allowOU(ous) {
     const allowed = new Set(ous);
-    return (cert) => allowed.has(cert.subject?.OU);
+    return (cert) => toArray(cert.subject?.OU).some((ou) => allowed.has(ou));
 }
 
 /**
@@ -123,7 +134,7 @@ export function allowOU(ous) {
  */
 export function allowOrganization(orgs) {
     const allowed = new Set(orgs);
-    return (cert) => allowed.has(cert.subject?.O);
+    return (cert) => toArray(cert.subject?.O).some((o) => allowed.has(o));
 }
 
 /**
@@ -196,9 +207,9 @@ export function allowEmail(emails) {
     const allowed = new Set(emails.map((e) => e.toLowerCase()));
 
     return (cert) => {
-        // Check subject.emailAddress
+        // Check subject.emailAddress (may be string or string[] for multi-valued)
         if (cert.subject?.emailAddress) {
-            if (allowed.has(cert.subject.emailAddress.toLowerCase())) {
+            if (toArray(cert.subject.emailAddress).some((e) => allowed.has(e.toLowerCase()))) {
                 return true;
             }
         }

package/lib/parsers.cjs

@@ -0,0 +1,20 @@
+/*!
+ * client-certificate-auth/parsers - CommonJS wrapper
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+'use strict';
+
+let _module;
+
+async function load() {
+    // Stryker disable next-line ConditionalExpression,BlockStatement: test ordering caches _module from prior test; ConditionalExpression→true (always re-import) re-imports same module successfully; BlockStatement→{} uses cached value
+    if (!_module) {
+        // Stryker disable next-line StringLiteral: test ordering caches _module; StringLiteral→"" fails import but cached value masks it
+        _module = await import('./parsers.js');
+    }
+    return _module;
+}
+
+module.exports = { load };

package/lib/parsers.d.cts

@@ -0,0 +1,13 @@
+/*!
+ * client-certificate-auth/parsers - CommonJS type declarations
+ * Copyright (C) 2013-2026 Tony Gies
+ * @license MIT
+ */
+
+import type * as ParsersModule from './parsers.js';
+
+declare const parsers: {
+    load(): Promise<typeof ParsersModule>;
+};
+
+export = parsers;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "client-certificate-auth",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Express/Connect middleware for mTLS client certificate authentication with reverse proxy support (AWS ALB, Envoy, Cloudflare, Traefik)",
   "homepage": "https://github.com/tgies/client-certificate-auth",
   "bugs": {
@@ -26,23 +26,48 @@
       "import": {
         "types": "./lib/parsers.d.ts",
         "default": "./lib/parsers.js"
+      },
+      "require": {
+        "types": "./lib/parsers.d.cts",
+        "default": "./lib/parsers.cjs"
       }
     },
     "./helpers": {
       "import": {
         "types": "./lib/helpers.d.ts",
         "default": "./lib/helpers.js"
+      },
+      "require": {
+        "types": "./lib/helpers.d.cts",
+        "default": "./lib/helpers.cjs"
       }
     },
     "./extractor": {
       "import": {
         "types": "./lib/extractor.d.ts",
         "default": "./lib/extractor.js"
+      },
+      "require": {
+        "types": "./lib/extractor.d.cts",
+        "default": "./lib/extractor.cjs"
       }
     }
   },
   "main": "./lib/clientCertificateAuth.cjs",
   "types": "./lib/clientCertificateAuth.d.ts",
+  "typesVersions": {
+    "*": {
+      "parsers": [
+        "./lib/parsers.d.ts"
+      ],
+      "helpers": [
+        "./lib/helpers.d.ts"
+      ],
+      "extractor": [
+        "./lib/extractor.d.ts"
+      ]
+    }
+  },
   "engines": {
     "node": ">= 20"
   },
@@ -52,7 +77,7 @@
     "@stryker-mutator/core": "^9.5.1",
     "@stryker-mutator/jest-runner": "^9.5.1",
     "@types/express": "^5.0.6",
-    "@types/node": "^25.2.2",
+    "@types/node": "^25.2.3",
     "c8": "^10.1.3",
     "eslint": "^9.17.0",
     "globals": "^17.3.0",