v1.0.0: Enterprise Spring Security 6 for Express & TypeScript

🍃 Welcome to Express Spring Security v1.0.0!

We are excited to announce the initial production release of express-spring-security—bringing the battle-tested, enterprise-grade architecture of Spring Security 6 to the Express.js and TypeScript ecosystem without framework lock-in.

---

✨ Key Features & Architecture

• 🔒 Fluent SecurityFilterChain: Declarative URL path authorization with Spring-style Ant matchers (/api/admin/**), HTTP method filtering, and first-match-wins evaluation.
• 🧵 Ambient SecurityContextHolder: ThreadLocal-equivalent request context powered by Node.js native AsyncLocalStorage. Access the authenticated user anywhere in services and repositories without drilling req.user.
• 🛡️ Universal @PreAuthorize: Method-level security compatible with both Stage 2 (legacy) and TC39 Stage 3 (TypeScript 5+) decorators with automatic this binding and dynamic SpEL-style predicates.
• 🏢 Enterprise JWT & JWKS Support: Asymmetric RS256/ES256 verification and dynamic JWKS key resolvers for Auth0, Okta, and Keycloak.
• 🚦 Pluggable Exception Architecture: Clean separation between AuthenticationEntryPoint (401 Unauthorized) and AccessDeniedHandler (403 Forbidden).
• 🔑 Pluggable PasswordEncoder: Contract-based hashing interface with zero forced dependencies—use bcrypt, argon2, or your preferred implementation.
• ⚡ Zero Monolith Lock-in: Pure TypeScript, zero Angular-style bloat, built natively for Express 5.x.

---

📦 Installation (Coming to npm)

npm install express-spring-security

---

📚 Links & Resources

• 📖 Documentation & Interactive Architecture Diagram: https://eyob-hailu.github.io/express-spring-security/
• 💻 GitHub Repository: https://github.com/eyob-hailu/express-spring-security
• 📄 License: MIT License