Installation

The Security plugin provides a framework-neutral execution pipeline. You choose how credentials are read and verified, what identity data represents, and which rules grant access. The package works with AxiSpark transports; install the transport plugin and adapter that your application uses as well.

Install

npm install @axisparkjs/security

For an HTTP application, for example, install and configure the HTTP plugin and one HTTP adapter too. Follow the relevant HTTP installation guide.

Register the plugin

Register the plugin once on your application. The options factory inserts SecurityPlugin into the options and defaults to discovering all injectable authenticator subclasses. The selected strategy is usually easier to audit and maintain because it states exactly which authenticators can run.

import { AxiSparkFactory } from '@axisparkjs/core';
import { HttpPlugin } from '@axisparkjs/http';
import { HttpPluginOptionsFactory } from '@axisparkjs/http-express';
import { SecurityPlugin, SecurityPluginOptionsFactory } from '@axisparkjs/security';
import { BearerAuthenticator } from './auth/bearer-authenticator';

const app = AxiSparkFactory.create({ name: 'Example API', basePath: __dirname });

app.use(HttpPlugin, HttpPluginOptionsFactory.create({ basePath: '/api', port: 3000 }));
app.use(
    SecurityPlugin,
    SecurityPluginOptionsFactory.create({
        authenticator: {
            strategy: 'selected',
            selected: [BearerAuthenticator]
        }
    })
);

Authenticator and policy classes must be injectable (@Injectable()) when they need to be resolved with dependencies. The security plugin binds its options and scoped logger into the application container. It does not itself validate credentials or implement an identity provider.

Choose authenticators

The plugin accepts an optional authenticator configuration:

Property	Description
strategy	Required when authenticator is supplied. selected uses the selected list; all discovers all registered injectable classes that extend Authenticator.
selected	Classes to try in array order when using the selected strategy.
transports	Transports on which the authentication middleware runs. Defaults to all transports.

Each authenticator class also has a static transports property. The base class defaults it to all transports, and a subclass can narrow it. The middleware-level transports setting and each class-level transport declaration are both checked before the authenticator runs.

Include every protected transport in the middleware-level transports list. The authentication engine also discovers @Secured() metadata and sets the flag that the guards use to enforce security. If the authentication middleware is disabled for a transport, that discovery does not run on that transport, so its secured handlers will not be enforced by these guards.

With strategy: 'all', every discovered injectable subclass can take part. This is useful when installed plugins contribute authenticators, but applications that need a fixed security configuration should use selected.

What is included

The package registers global authentication and authorization middleware and guards. They run for AxiSpark's execution transports and use the engine's step ordering. Your code supplies the transport-specific credential parsing, identity validation, policies, and error mapping. This keeps the same policy abstraction usable for HTTP requests, messages, jobs, and other execution types.