Auth Headers

RFC 7235 / RFC 7617 outbound Authorization header construction — the small, security-aware primitive every framework consumer that talks to a credentialed HTTP endpoint composes (log-stream-webhook, object-store-http-put, object-store-gcs, custom outbound clients).

Previously each consumer re-implemented _authHeaders(config) with subtly different argument names and case semantics. This module collapses the construction so token / credential rules live in one place: never produce Basic , always pass bearer tokens through unmodified, refuse unknown auth methods at call time rather than silently emitting no header.

Three forms: - bearer(token) -> { Authorization: "Bearer " } - basic(username, password) -> { Authorization: "Basic " } - fromConfig({ auth, ... }) -> dispatch by auth field

fromConfig accepts { auth: "none" } (returns {}), { auth: "bearer", token }, and { auth: "basic", username, password }. Anything else throws AuthHeaderError. The "raw header pass-through" mode some consumers wanted is intentionally NOT this module's job — that's plain header merging at the call site, kept separate so the auth-header primitive stays pure string construction with no I/O.

Validation tier: config-time / entry-point. Bad opts throw synchronously so an operator catches the typo at boot rather than on the first outbound request.

b.authHeader.bearer(token) #

Build an { Authorization: "Bearer " } header object from a non-empty string token. The token is passed through verbatim — no encoding, no whitespace trimming — because RFC 6750 b64token tokens are already in the legal Authorization-value alphabet. Empty / null / non-string input throws AuthHeaderError.

var headers = b.authHeader.bearer("eyJhbGciOiJIUzI1NiJ9.payload.sig");
// → { Authorization: "Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig" }

b.authHeader.basic(username, password) #

Build an { Authorization: "Basic " } header per RFC 7617. Empty username + empty password is accepted (some legacy endpoints want literal Basic ), but null / undefined username throws AuthHeaderError to refuse the silent-bug shape Basic . password === null is normalized to an empty string.

var headers = b.authHeader.basic("svc-account", "s3cr3t");
// → { Authorization: "Basic c3ZjLWFjY291bnQ6czNjcjN0" }

b.authHeader.fromConfig(config) #

{
  {
    auth?:     "none" | "bearer" | "basic",  // default: "none"
    token?:    string,                       // required when auth === "bearer"
    username?: string,                       // required when auth === "basic"
    password?: string,                       // optional when auth === "basic"
  }
}

Dispatch by the auth field on a consumer config object — the shared shape every framework outbound consumer accepts. Returns an empty object for auth: "none" (or a missing config), routes to bearer(token) for auth: "bearer", and to basic(username, password) for auth: "basic". Any other auth value throws AuthHeaderError with the auth-header/unknown-method code so a typo doesn't silently produce an unauthenticated request.

var headers = b.authHeader.fromConfig({
  auth:  "bearer",
  token: "eyJhbGciOiJIUzI1NiJ9.payload.sig",
});
// → { Authorization: "Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig" }

Last updated 2026-08-08T16:39:49.652Z by seeder.