faire-auth 1.0.4 → 1.1.0

package/dist/{parser-B25ylT5u.mjs → parser-CqwvpF6l.cjs}

@@ -1,4 +1,4 @@
-//#region src/client/parser.ts
+// src/client/parser.ts
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -47,16 +47,16 @@ const betterJSONParse = (value, options = {}) => {
 		return matches;
 	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 	try {
-		const secureReviver = (key, value$1) => {
-			if (key === "__proto__" || key === "constructor" && value$1 != null && typeof value$1 === "object" && "prototype" in value$1) {
+		const secureReviver = (key, value) => {
+			if (key === "__proto__" || key === "constructor" && value != null && typeof value === "object" && "prototype" in value) {
 				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
 				return;
 			}
-			if (parseDates && typeof value$1 === "string") {
-				const date = parseISODate(value$1);
+			if (parseDates && typeof value === "string") {
+				const date = parseISODate(value);
 				if (date) return date;
 			}
-			return reviver ? reviver(key, value$1) : value$1;
+			return reviver ? reviver(key, value) : value;
 		};
 		return JSON.parse(trimmed, secureReviver);
 	} catch (error) {
@@ -65,7 +65,9 @@ const betterJSONParse = (value, options = {}) => {
 	}
 };
 const parseJSON = (value, options = { strict: true }) => betterJSONParse(value, options);
-var parser_default = parseJSON;
-
-//#endregion
-export { parser_default as n, parseJSON as t };
+Object.defineProperty(exports, "parseJSON", {
+	enumerable: true,
+	get: function() {
+		return parseJSON;
+	}
+});

package/dist/{parser-B_wxvaAr.cjs → parser-DcKDjjHO.mjs}

@@ -1,5 +1,4 @@
-
-//#region src/client/parser.ts
+// src/client/parser.ts
 const PROTO_POLLUTION_PATTERNS = {
 	proto: /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/,
 	constructor: /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/,
@@ -48,16 +47,16 @@ const betterJSONParse = (value, options = {}) => {
 		return matches;
 	}) && strict) throw new Error("[better-json] Potential prototype pollution attempt detected");
 	try {
-		const secureReviver = (key, value$1) => {
-			if (key === "__proto__" || key === "constructor" && value$1 != null && typeof value$1 === "object" && "prototype" in value$1) {
+		const secureReviver = (key, value) => {
+			if (key === "__proto__" || key === "constructor" && value != null && typeof value === "object" && "prototype" in value) {
 				if (warnings) console.warn(`[better-json] Dropping "${key}" key to prevent prototype pollution`);
 				return;
 			}
-			if (parseDates && typeof value$1 === "string") {
-				const date = parseISODate(value$1);
+			if (parseDates && typeof value === "string") {
+				const date = parseISODate(value);
 				if (date) return date;
 			}
-			return reviver ? reviver(key, value$1) : value$1;
+			return reviver ? reviver(key, value) : value;
 		};
 		return JSON.parse(trimmed, secureReviver);
 	} catch (error) {
@@ -66,18 +65,4 @@ const betterJSONParse = (value, options = {}) => {
 	}
 };
 const parseJSON = (value, options = { strict: true }) => betterJSONParse(value, options);
-var parser_default = parseJSON;
-
-//#endregion
-Object.defineProperty(exports, 'parseJSON', {
-  enumerable: true,
-  get: function () {
-    return parseJSON;
-  }
-});
-Object.defineProperty(exports, 'parser_default', {
-  enumerable: true,
-  get: function () {
-    return parser_default;
-  }
-});
+export { parseJSON as t };

package/dist/plugins/access/index.cjs

@@ -1,4 +1,38 @@
-const require_access = require('../../access-BZ7-AbTM.cjs');
-
-exports.createAccessControl = require_access.createAccessControl;
-exports.role = require_access.role;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let _faire_auth_core_error = require("@faire-auth/core/error");
+// src/plugins/access/access.ts
+const role = (statements) => ({
+	authorize: (request, connector = "AND") => {
+		let success = false;
+		for (const [requestedResource, requestedActions] of Object.entries(request)) {
+			const allowedActions = statements[requestedResource];
+			if (!allowedActions) return {
+				success: false,
+				error: `You are not allowed to access resource: ${requestedResource}`
+			};
+			if (Array.isArray(requestedActions)) success = requestedActions.every((requestedAction) => allowedActions.includes(requestedAction));
+			else if (typeof requestedActions === "object") {
+				const actions = requestedActions;
+				if (actions.connector === "OR") success = actions.actions.some((requestedAction) => allowedActions.includes(requestedAction));
+				else success = actions.actions.every((requestedAction) => allowedActions.includes(requestedAction));
+			} else throw new _faire_auth_core_error.FaireAuthError("Invalid access control request");
+			if (success && connector === "OR") return { success };
+			if (!success && connector === "AND") return {
+				success: false,
+				error: `unauthorized to access resource "${requestedResource}"`
+			};
+		}
+		if (success) return { success };
+		return {
+			success: false,
+			error: "Not authorized"
+		};
+	},
+	statements
+});
+const createAccessControl = (s) => ({
+	newRole: (statements) => role(statements),
+	statements: s
+});
+exports.createAccessControl = createAccessControl;
+exports.role = role;

package/dist/plugins/access/index.d.cts

@@ -1,2 +1,36 @@
-import { a as Role, c as Subset, i as AccessControl, n as createAccessControl, o as Statements, r as role, s as SubArray, t as AuthorizeResponse } from "../../index-CdLyn7qP.cjs";
-export { AccessControl, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };
+import { LiteralString } from "@faire-auth/core/types";
+type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][];
+type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]>; };
+type Statements = {
+  readonly [resource: string]: readonly LiteralString[];
+};
+type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
+type Role<TStatements extends Statements = Record<string, any>> = {
+  authorize: (request: any, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
+  statements: TStatements;
+};
+export type AuthorizeResponse = {
+  success: false;
+  error: string;
+} | {
+  success: true;
+  error?: never;
+};
+export declare const role: <TStatements extends Statements>(statements: TStatements) => {
+  authorize: <K extends keyof TStatements>(request: { [key in K]?: TStatements[key] | {
+    actions: TStatements[key];
+    connector: "OR" | "AND";
+  }; }, connector?: "OR" | "AND") => AuthorizeResponse;
+  statements: TStatements;
+};
+export declare const createAccessControl: <const TStatements extends Statements>(s: TStatements) => {
+  newRole: <K extends keyof TStatements>(statements: Subset<K, TStatements>) => {
+    authorize: <K_1 extends K>(request: K_1 extends (infer T extends keyof Subset<K, TStatements>) ? { [key in T]?: {
+      actions: Subset<K, TStatements>[key];
+      connector: "OR" | "AND";
+    } | Subset<K, TStatements>[key]; } : never, connector?: "OR" | "AND") => AuthorizeResponse;
+    statements: Subset<K, TStatements>;
+  };
+  statements: TStatements;
+};
+export type { AccessControl, Role, Statements, SubArray, Subset };

package/dist/plugins/access/index.d.mts

@@ -1,2 +1,36 @@
-import { a as Role, c as Subset, i as AccessControl, n as createAccessControl, o as Statements, r as role, s as SubArray, t as AuthorizeResponse } from "../../index-CRt_fppq.mjs";
-export { AccessControl, AuthorizeResponse, Role, Statements, SubArray, Subset, createAccessControl, role };
+import { LiteralString } from "@faire-auth/core/types";
+type SubArray<T extends unknown[] | readonly unknown[] | any[]> = T[number][];
+type Subset<K extends keyof R, R extends Record<string | LiteralString, readonly string[] | readonly LiteralString[]>> = { [P in K]: SubArray<R[P]>; };
+type Statements = {
+  readonly [resource: string]: readonly LiteralString[];
+};
+type AccessControl<TStatements extends Statements = Statements> = ReturnType<typeof createAccessControl<TStatements>>;
+type Role<TStatements extends Statements = Record<string, any>> = {
+  authorize: (request: any, connector?: ("OR" | "AND") | undefined) => AuthorizeResponse;
+  statements: TStatements;
+};
+export type AuthorizeResponse = {
+  success: false;
+  error: string;
+} | {
+  success: true;
+  error?: never;
+};
+export declare const role: <TStatements extends Statements>(statements: TStatements) => {
+  authorize: <K extends keyof TStatements>(request: { [key in K]?: TStatements[key] | {
+    actions: TStatements[key];
+    connector: "OR" | "AND";
+  }; }, connector?: "OR" | "AND") => AuthorizeResponse;
+  statements: TStatements;
+};
+export declare const createAccessControl: <const TStatements extends Statements>(s: TStatements) => {
+  newRole: <K extends keyof TStatements>(statements: Subset<K, TStatements>) => {
+    authorize: <K_1 extends K>(request: K_1 extends (infer T extends keyof Subset<K, TStatements>) ? { [key in T]?: {
+      actions: Subset<K, TStatements>[key];
+      connector: "OR" | "AND";
+    } | Subset<K, TStatements>[key]; } : never, connector?: "OR" | "AND") => AuthorizeResponse;
+    statements: Subset<K, TStatements>;
+  };
+  statements: TStatements;
+};
+export type { AccessControl, Role, Statements, SubArray, Subset };

package/dist/plugins/access/index.mjs

@@ -1,3 +1,36 @@
-import { n as role, t as createAccessControl } from "../../access-D0DRqUKC.mjs";
-
-export { createAccessControl, role };
+import { FaireAuthError } from "@faire-auth/core/error";
+// src/plugins/access/access.ts
+const role = (statements) => ({
+	authorize: (request, connector = "AND") => {
+		let success = false;
+		for (const [requestedResource, requestedActions] of Object.entries(request)) {
+			const allowedActions = statements[requestedResource];
+			if (!allowedActions) return {
+				success: false,
+				error: `You are not allowed to access resource: ${requestedResource}`
+			};
+			if (Array.isArray(requestedActions)) success = requestedActions.every((requestedAction) => allowedActions.includes(requestedAction));
+			else if (typeof requestedActions === "object") {
+				const actions = requestedActions;
+				if (actions.connector === "OR") success = actions.actions.some((requestedAction) => allowedActions.includes(requestedAction));
+				else success = actions.actions.every((requestedAction) => allowedActions.includes(requestedAction));
+			} else throw new FaireAuthError("Invalid access control request");
+			if (success && connector === "OR") return { success };
+			if (!success && connector === "AND") return {
+				success: false,
+				error: `unauthorized to access resource "${requestedResource}"`
+			};
+		}
+		if (success) return { success };
+		return {
+			success: false,
+			error: "Not authorized"
+		};
+	},
+	statements
+});
+const createAccessControl = (s) => ({
+	newRole: (statements) => role(statements),
+	statements: s
+});
+export { createAccessControl, role };

package/dist/plugins/bearer/index.cjs

@@ -1,7 +1,52 @@
-require('../../crypto-DpSCnrTp.cjs');
-require('../../json--tl7Grvs.cjs');
-require('../../cookies-BTl72THv.cjs');
-require('../../middleware-CWvRH4EW.cjs');
-const require_bearer = require('../../bearer-DDzrp5M7.cjs');
-
-exports.bearer = require_bearer.bearer;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_middleware = require("../../middleware-Cd-VkNxB.cjs");
+const require_cookies = require("../../cookies-DQ52rcOy.cjs");
+let _faire_auth_core_datatypes = require("@faire-auth/core/datatypes");
+// src/plugins/bearer/index.ts
+/**
+* Converts bearer token to session cookie
+*/
+const bearer = (options) => ({
+	id: "bearer",
+	hooks: {
+		before: [{
+			matcher: (ctx) => Boolean(ctx.req.header("Authorization")),
+			handler: (_opts) => require_middleware.createHook()(async (ctx) => {
+				const token = ctx.req.header("Authorization")?.replace("Bearer ", "");
+				if (token == null) return;
+				let signedToken = "";
+				if (token.includes(".")) signedToken = token.replace("=", "");
+				else {
+					if (options?.requireSignature === true) return;
+					signedToken = (await require_cookies.serializeSignedCookie("", token, ctx.get("context").secret)).replace("=", "");
+				}
+				try {
+					const [first, second] = decodeURIComponent(signedToken).split(".");
+					if (first == null || second == null) return;
+					if (!await (0, _faire_auth_core_datatypes.createHMAC)("SHA-256", "base64urlnopad").verify(ctx.get("context").secret, first, second)) return;
+				} catch {
+					return;
+				}
+				ctx.req.raw.headers.append("cookie", `${ctx.get("context").authCookies.sessionToken.name}=${signedToken}`);
+			})
+		}],
+		after: [{
+			matcher: (_ctx) => true,
+			handler: (_opts) => require_middleware.createHook()(async (ctx) => {
+				const setCookie = ctx.res.headers.getSetCookie();
+				if (!setCookie.length) return;
+				const parsedCookies = require_cookies.parseSetCookieHeader(setCookie);
+				const cookieName = ctx.get("context").authCookies.sessionToken.name;
+				const sessionCookie = parsedCookies.get(cookieName);
+				if (sessionCookie?.value == null || sessionCookie["max-age"] === 0) return;
+				const token = sessionCookie.value;
+				const exposedHeaders = ctx.res.headers.get("access-control-expose-headers") ?? "";
+				const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+				headersSet.add("set-auth-token");
+				ctx.res.headers.set("set-auth-token", token);
+				ctx.res.headers.set("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+			})
+		}]
+	}
+});
+exports.bearer = bearer;

package/dist/plugins/bearer/index.d.cts

@@ -1,4 +1,27 @@
-import "../../index-Boa0SV4h.cjs";
-import "../../hono-DOM31WQz.cjs";
-import { t as bearer } from "../../index-DRYO4mGd.cjs";
-export { bearer };
+interface BearerOptions {
+  /**
+   * If true, only signed tokens
+   * will be converted to session
+   * cookies
+   *
+   * @default false
+   */
+  requireSignature?: boolean;
+}
+/**
+ * Converts bearer token to session cookie
+ */
+export declare const bearer: (options?: BearerOptions) => {
+  id: string;
+  hooks: {
+    before: {
+      matcher: (ctx: any) => boolean;
+      handler: (_opts: any) => (ctx: any) => Promise<void>;
+    }[];
+    after: {
+      matcher: (_ctx: any) => boolean;
+      handler: (_opts: any) => (ctx: any) => Promise<void>;
+    }[];
+  };
+};
+export {};

package/dist/plugins/bearer/index.d.mts

@@ -1,4 +1,27 @@
-import "../../index-DxXFCG2_.mjs";
-import "../../hono-D0VqxVy1.mjs";
-import { t as bearer } from "../../index--DLiUhEn.mjs";
-export { bearer };
+interface BearerOptions {
+  /**
+   * If true, only signed tokens
+   * will be converted to session
+   * cookies
+   *
+   * @default false
+   */
+  requireSignature?: boolean;
+}
+/**
+ * Converts bearer token to session cookie
+ */
+export declare const bearer: (options?: BearerOptions) => {
+  id: string;
+  hooks: {
+    before: {
+      matcher: (ctx: any) => boolean;
+      handler: (_opts: any) => (ctx: any) => Promise<void>;
+    }[];
+    after: {
+      matcher: (_ctx: any) => boolean;
+      handler: (_opts: any) => (ctx: any) => Promise<void>;
+    }[];
+  };
+};
+export {};

package/dist/plugins/bearer/index.mjs

@@ -1,7 +1,51 @@
-import "../../crypto-DH2Aa7jN.mjs";
-import "../../json-B1v2qRTQ.mjs";
-import "../../cookies-BTs1o992.mjs";
-import "../../middleware-CE6OhDkq.mjs";
-import { t as bearer } from "../../bearer-WZcs7gxL.mjs";
-
-export { bearer };
+import { n as createHook } from "../../middleware-Cakg4e1D.mjs";
+import { _ as serializeSignedCookie, p as parseSetCookieHeader } from "../../cookies-D9aY_gJh.mjs";
+import { createHMAC } from "@faire-auth/core/datatypes";
+// src/plugins/bearer/index.ts
+/**
+* Converts bearer token to session cookie
+*/
+const bearer = (options) => ({
+	id: "bearer",
+	hooks: {
+		before: [{
+			matcher: (ctx) => Boolean(ctx.req.header("Authorization")),
+			handler: (_opts) => createHook()(async (ctx) => {
+				const token = ctx.req.header("Authorization")?.replace("Bearer ", "");
+				if (token == null) return;
+				let signedToken = "";
+				if (token.includes(".")) signedToken = token.replace("=", "");
+				else {
+					if (options?.requireSignature === true) return;
+					signedToken = (await serializeSignedCookie("", token, ctx.get("context").secret)).replace("=", "");
+				}
+				try {
+					const [first, second] = decodeURIComponent(signedToken).split(".");
+					if (first == null || second == null) return;
+					if (!await createHMAC("SHA-256", "base64urlnopad").verify(ctx.get("context").secret, first, second)) return;
+				} catch {
+					return;
+				}
+				ctx.req.raw.headers.append("cookie", `${ctx.get("context").authCookies.sessionToken.name}=${signedToken}`);
+			})
+		}],
+		after: [{
+			matcher: (_ctx) => true,
+			handler: (_opts) => createHook()(async (ctx) => {
+				const setCookie = ctx.res.headers.getSetCookie();
+				if (!setCookie.length) return;
+				const parsedCookies = parseSetCookieHeader(setCookie);
+				const cookieName = ctx.get("context").authCookies.sessionToken.name;
+				const sessionCookie = parsedCookies.get(cookieName);
+				if (sessionCookie?.value == null || sessionCookie["max-age"] === 0) return;
+				const token = sessionCookie.value;
+				const exposedHeaders = ctx.res.headers.get("access-control-expose-headers") ?? "";
+				const headersSet = new Set(exposedHeaders.split(",").map((header) => header.trim()).filter(Boolean));
+				headersSet.add("set-auth-token");
+				ctx.res.headers.set("set-auth-token", token);
+				ctx.res.headers.set("Access-Control-Expose-Headers", Array.from(headersSet).join(", "));
+			})
+		}]
+	}
+});
+export { bearer };