Askr documentation
Generated API snapshot

@askrjs/auth

Exports from the declarations published in @askrjs/auth. Signatures reflect the published artifact.

Exports

This entrypoint publishes 19 exports. Use the anchored symbol rows for direct links. Type-only exports are labeled separately from runtime values.

allOftype

allOf: (...requirements: readonly AuthRequirement[]) => AuthRequirement

Combine requirements so every requirement must allow the request.

anyOftype

anyOf: (...requirements: readonly AuthRequirement[]) => AuthRequirement

Combine requirements so at least one requirement must allow the request.

AuthContexttype

AuthContext: any

Authentication state resolved for one request.

authenticated
Whether a valid principal was resolved.
principal
Resolved principal, or null for anonymous requests.
session
Resolved session, or null when no session is active.
tenant
Resolved tenant identifier, or null when unavailable.
scopes
Optional scopes carried by the credential.

AuthDecisiontype

AuthDecision: {
  allowed: true;
} | {
  allowed: false;
  reason: "unauthenticated" | "forbidden" | "already_authenticated";
}

Result returned by an authorization requirement.

AuthOptionstype

AuthOptions: any

Dependencies and policies used by the request authentication resolver.

sessions
Session lookup implementation.
principals
Principal lookup implementation.
jwt
Validator for bearer JWTs.
jwtCookie
Optional cookie name and validator for browser sessions.
tenant
Resolves the tenant associated with a request.
sessionCookie
Cookie name used to identify a session.
clock
Clock returning Unix time in milliseconds.

AuthRequirementtype

AuthRequirement: (context: AuthContext<P, S>) => AuthDecision | PromiseLike<AuthDecision>

Predicate that allows or rejects an authentication context.

AuthResolvertype

AuthResolver: any

Resolves authentication context from an incoming request.

resolve
Resolve the principal, session, tenant, and authorization state. Invalid bearer and cookie JWTs fall through as unauthenticated; tenant and store failures propagate.

AuthSessiontype

AuthSession: any

Persisted login session associated with a principal.

id
Stable session identifier.
subject
Subject owning the session.
expiresAt
Expiration time as Unix milliseconds.
revokedAt
Revocation time as Unix milliseconds.

Claimtype

Claim: Record<string, unknown>

Additional application-defined claims carried by an authenticated principal or session.

createAuthtype

createAuth: <P extends Principal = Principal, S extends AuthSession = AuthSession>(options?: AuthOptions<P, S>) => AuthResolver<P, S>

Create a request authentication resolver for bearer tokens, cookies, and sessions.

Principaltype

Principal: any

Stable identity and authorization attributes for a caller.

id
Application-specific principal identifier.
subject
External subject identifier, when supplied by an identity provider.
roles
Roles granted to the principal.
permissions
Fine-grained permissions granted to the principal.

PrincipalStoretype

PrincipalStore: any

Resolves an authenticated principal by subject.

get
Load a principal by subject.

requireAnonymoustype

requireAnonymous: () => AuthRequirement

Require that the request is not already authenticated.

requirePermissiontype

requirePermission: (permission: string) => AuthRequirement

Require an authenticated principal carrying a specific permission.

requireRoletype

requireRole: (role: string) => AuthRequirement

Require an authenticated principal carrying a specific role.

requireScopetype

requireScope: (scope: string) => AuthRequirement

Require an authenticated principal carrying a specific scope.

requireUsertype

requireUser: () => AuthRequirement

Require an authenticated principal.

SessionStoretype

SessionStore: any

Resolves a persisted session by its identifier.

get
Load a session by identifier.

TenantResolvertype

TenantResolver: string | ((request: Request, options: {
  signal: AbortSignal;
}) => string | null | PromiseLike<string | null>)

Supplies the tenant identifier for an incoming request.