Node.js

npm install @hyper.authio/express        # uma API em Express (traz server e client)
npm install @hyper.authio/server         # uma API em outro framework
npm install @hyper.authio/client         # um worker, uma CLI ou chamadas ao Authio
npm install -D @hyper.authio/testing     # testes

AUTHIO_ISSUER=https://authio.api.hyperio.tech/realms/acme
AUTHIO_CLIENT_ID=orders-worker
AUTHIO_CLIENT_SECRET=YOUR_CLIENT_SECRET

import express from 'express'
import { authioBearer, requirePermission, requireScope } from '@hyper.authio/express'

const app = express()

app.use(
  '/api',
  authioBearer({
    issuer: process.env.AUTHIO_ISSUER!,
    audiences: 'https://api.example.com',
  }),
)

app.get('/api/me', (req, res) => {
  res.json(req.authio!.user)
})

app.get('/api/orders', requireScope('orders:read'), requirePermission('orders', 'read'), (req, res) => {
  res.json([])
})

app.listen(3001)

import {
  anyOf,
  requireAuthenticationLevel,
  requireAuthio,
  requireClaim,
  requireGroup,
  requireOrganization,
  requirePermission,
  requireRole,
  requireScope,
} from '@hyper.authio/express'

// Qualquer um dos escopos; passe 'all' para exigir todos.
app.get('/api/orders/export', requireScope(['orders:read', 'orders:export'], 'all'), exportOrders)

// Um papel atribuído à pessoa ou a um grupo dela, não a todo mundo do realm.
app.delete('/api/orders/:id', requireRole('orders-admin', { sources: ['user'] }), deleteOrder)

// Um grupo (claim mapper de grupo) e uma claim (qualquer mapper, ou a própria claim da pessoa).
app.get('/api/finance', requireGroup('finance'), requireClaim('department', 'finance'), report)

// Uma permissão e, além dela, um login forte ou a organização acme.
app.post(
  '/api/payouts',
  requireAuthio(requirePermission('payouts', 'create'), anyOf(requireAuthenticationLevel(2), requireOrganization('acme'))),
  payout,
)

import { AuthioForbiddenError, authorize, createAuthioVerifier, requirePermission } from '@hyper.authio/server'

const verifier = createAuthioVerifier({
  issuer: process.env.AUTHIO_ISSUER!,
  audiences: 'https://api.example.com',
})

export async function caller(authorization: string | undefined) {
  // Lança AuthioBearerError: responda 401 com error.wwwAuthenticate.
  const user = await verifier.verifyAuthorizationHeader(authorization)
  const refusal = authorize(user, requirePermission('orders', 'read'))

  // AuthioForbiddenError: responda 403, com error.wwwAuthenticate quando houver.
  if (refusal) throw new AuthioForbiddenError(refusal)

  return user
}

app.use(
  '/api',
  authioBearer({
    issuer: process.env.AUTHIO_ISSUER!,
    audiences: 'https://api.example.com',
    introspection: 'activeCheck',
    client: { clientId: process.env.AUTHIO_CLIENT_ID!, clientSecret: process.env.AUTHIO_CLIENT_SECRET },
  }),
)

import { createAuthioClient } from '@hyper.authio/client'

const authio = createAuthioClient({
  issuer: process.env.AUTHIO_ISSUER!,
  clientId: process.env.AUTHIO_CLIENT_ID!,
  clientSecret: process.env.AUTHIO_CLIENT_SECRET,
})

const ordersFetch = authio.clientCredentialsFetch({
  scopes: 'orders:read',
  resource: 'https://api.example.com',
})

const response = await ordersFetch('https://api.example.com/api/orders')

import { createAuthioClient } from '@hyper.authio/client'
import { createOnBehalfOf } from '@hyper.authio/server'

const billing = createOnBehalfOf({
  client: createAuthioClient({ issuer, clientId, clientSecret }),
  resource: 'https://billing.example.com',
  scopes: 'invoices:read',
})

app.get('/api/invoices', async (req, res) => {
  const response = await billing.fetch(req.authio!.user)('https://billing.example.com/invoices')
  res.status(response.status).json(await response.json())
})

import { authioWebhooks } from '@hyper.authio/express'

// Antes do express.json(): a assinatura é conferida sobre o corpo bruto.
app.post(
  '/webhooks/authio',
  authioWebhooks({ secret: process.env.AUTHIO_WEBHOOK_SECRET })
    .on('user_deleted', async (event) => forget(event.data.id))
    .on('*', (event) => console.log(event.type)),
)

import { FakeAuthio } from '@hyper.authio/testing'

const authio = await FakeAuthio.start({ realm: 'acme' })

const token = await authio.issueAccessToken({
  sub: 'u-1',
  audience: 'https://api.example.com',
  scope: 'orders:read',
  claims: { user_resource_access: { clerk: { orders: ['read'] } }, groups: ['finance'] },
})

// Aponte a API para authio.issuer, chame-a com o token e, no fim:
await authio.close()