Express.js Integration

import { AgentPass, VerificationResult } from '@agent-pass/core';
import { Request, Response, NextFunction } from 'express';

// Extend Express Request interface
interface AuthenticatedRequest extends Request {
  agent?: {
    did: string;
    controllerDid: string;
    scope: string[];
    constraints?: any;
  };
}

/**
 * Agent-Pass Authentication Middleware
 * 
 * Validates Authorization header containing a Verifiable Presentation
 * and performs dual-signature verification.
 */
export function agentPassAuth(agentPass: AgentPass) {
  return async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    try {
      // Extract Authorization header
      const authHeader = req.headers.authorization;
      const authString = Array.isArray(authHeader) ? authHeader[0] : authHeader;
      
      if (!authString || !authString.startsWith('Bearer ')) {
        return res.status(401).json({
          error: 'Missing or invalid Authorization header',
          message: 'Expected: Authorization: Bearer <verifiable-presentation>',
          code: 'MISSING_AUTHORIZATION'
        });
      }

      // Extract and parse the Verifiable Presentation
      const presentationData = authString.substring(7); // Remove "Bearer "
      
      let presentation;
      try {
        presentation = JSON.parse(presentationData);
      } catch (parseError) {
        return res.status(400).json({
          error: 'Invalid presentation format',
          message: 'Presentation must be valid JSON',
          code: 'INVALID_JSON'
        });
      }

      // Extract challenge and domain from query parameters
      const challenge = req.query.challenge as string;
      const domain = req.hostname || req.get('host') || 'localhost';

      if (!challenge) {
        return res.status(400).json({
          error: 'Missing challenge parameter',
          message: 'Challenge is required for verification',
          code: 'MISSING_CHALLENGE'
        });
      }

      // Perform dual-signature verification
      const verification: VerificationResult = await agentPass.verifyVerifiablePresentation(
        presentation,
        challenge,
        domain
      );

      if (!verification.verified) {
        return res.status(401).json({
          error: 'Authentication failed',
          message: verification.error || 'Invalid presentation or signatures',
          code: 'VERIFICATION_FAILED'
        });
      }

      // Attach agent information to request
      req.agent = {
        did: verification.agentDid!,
        controllerDid: verification.controllerDid!,
        scope: verification.scope!,
        constraints: verification.constraints
      };

      // Authentication successful, proceed to next middleware
      next();

    } catch (error) {
      console.error('Agent-Pass authentication error:', error);
      return res.status(500).json({
        error: 'Internal authentication error',
        message: 'An error occurred during authentication',
        code: 'INTERNAL_ERROR'
      });
    }
  };
}

/**
 * Scope Authorization Middleware
 * 
 * Checks if the authenticated agent has a specific scope permission.
 */
export function requireScope(requiredScope: string) {
  return (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
    if (!req.agent) {
      return res.status(401).json({
        error: 'Not authenticated',
        message: 'Agent authentication required',
        code: 'NOT_AUTHENTICATED'
      });
    }

    if (!req.agent.scope.includes(requiredScope)) {
      return res.status(403).json({
        error: 'Insufficient permissions',
        message: `Required scope: ${requiredScope}`,
        code: 'INSUFFICIENT_SCOPE',
        details: {
          required: requiredScope,
          granted: req.agent.scope
        }
      });
    }

    next();
  };
}