✅ Authentication validators

Authentication routes compose these shared validators to authenticate requests and restrict access to administrators, the affected identity, or either of those principals.

Inventory

Validator	Reads	Success condition	Failure / error	Consumers
isAuthenticated()	context.authenticate, or Bearer fallback	Selected auth adapter accepts the request.	Authentication adapter error.	logoutRoute, deleteRefreshTokensRoute, generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute, activateRoute.
checkIdentityType(['admin'])	Auth adapter, db.identities, configuration.identity.typeIds	Identity type matches configured admin.	500 setup, 401 token, or 403 identity/authorization error.	Direct: generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, activateRoute. Through some(...): deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute.
isSelf(path)	Authenticated identity and configured payload path	Token identity ID matches target identity ID.	401/403 invalid or nonmatching access.	deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute.
some(...validators)	Supplied validator results	At least one supplied validator succeeds.	Throws the collected validation error when all fail.	deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute.

Details

isAuthenticated()

Implementation

Signature: isAuthenticated(): Validator. authService supplies Bearer authentication by default and cookie authentication when authMode is 'cookie'; register cookie-parser before cookie-mode routes.

Consumers: logoutRoute, deleteRefreshTokensRoute, generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, deactivateRoute, and activateRoute.

checkIdentityType(['admin'])

Implementation

Signature: checkIdentityType(['admin']): Validator. Factory invocation authenticates the request, requires configured identity type IDs, loads the token identity, and succeeds only when its type matches the configured administrator ID. Missing configuration is 500, token failure is 401, and a missing identity or disallowed type is 403.

Consumers: Direct on generateOnetimeTokenRoute, restoreOnetimeTokenRoute, invalidateOnetimeTokenRoute, and activateRoute, and the administrator branch of some(...) on deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, and deactivateRoute.

isSelf(path)

Implementation

Signature: isSelf<T extends string>(identityIdPathInPayload: [T, ...T[]]): Validator. Compares the authenticated token identity with the configured target path: requestParams.identityId for refresh-token deletion, verification, email/password changes; requestBody.identityId for deactivation.

Consumers: the some(...) branches in deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, and deactivateRoute.

some(...validators)

Implementation

Signature: some(...args: Validator[]): Validator. Combines administrator and self checks where source permits either principal.

Consumers: deleteRefreshTokensRoute, sendVerificationEmailRoute, changeEmailRoute, changePasswordRoute, and deactivateRoute.