@adonis-agora/authkit-server 1.0.0-rc.2 → 1.0.0-rc.3

package/build/src/host/ui-dist/index.html

@@ -8,7 +8,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Sora:wght@400;500;600;700&family=JetBrains+Mono:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-BqyJYRVX.js"></script>
+    <script type="module" crossorigin src="/__AUTHKIT_BASE__/assets/index-u0bMxkLg.js"></script>
     <link rel="stylesheet" crossorigin href="/__AUTHKIT_BASE__/assets/index-DTSmD4RU.css">
   </head>
   <body>

package/build/src/provider/build_provider.js

@@ -3,6 +3,8 @@ import { pickModelAdapterClass } from '../adapters/factory.js';
 import { normalizeActiveOrg, readActiveOrgFromKoaCtx } from '../host/active_org_cookie.js';
 import { consoleSsoClientMetadata } from '../host/console_sso.js';
 import { findMcpResource, mcpAuthorizeMiddleware } from '../mcp/mcp_oauth.js';
+import { hideDisabledClients } from '../service_tenants/client_metadata.js';
+import { createServiceTenantHooks } from '../service_tenants/provider_hooks.js';
 import { createDeviceSources } from './device_sources.js';
 import { createLogoutSources } from './logout_sources.js';
 import { registrationPolicyMiddleware } from './registration_policy.js';
@@ -79,21 +81,35 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         return key ? { key, rc: at.resources[key] } : null;
     };
     const mcp = config.mcp;
-    const resourceIndicatorFeatures = at.anyJwt || declaredResources.length > 0 || mcp.enabled
+    // Service tenants (`serviceTenants`): `client_credentials` clients with a partition,
+    // whose tokens are JWTs for a service-tenant resource. See `service_tenants/`.
+    const serviceTenants = createServiceTenantHooks({
+        serviceTenants: config.serviceTenants ?? { enabled: false, resources: {} },
+        AdapterClass: config.AdapterClass,
+        audit: config.audit,
+    });
+    const signAlg = config.jwks.keys[0]?.alg ?? 'RS256';
+    const resourceIndicatorFeatures = at.anyJwt || declaredResources.length > 0 || mcp.enabled || serviceTenants.enabled
         ? {
             resourceIndicators: {
                 enabled: true,
-                defaultResource: async (_ctx, _client, oneOf) => {
+                defaultResource: async (ctx, client, oneOf) => {
                     // Nas trocas (code/refresh/device), o provider passa `oneOf` com as
                     // resources já concedidas — devolvemos para não falhar a request.
                     if (oneOf)
                         return oneOf;
+                    const serviceResource = await serviceTenants.defaultResource(ctx, client);
+                    if (serviceResource)
+                        return serviceResource;
                     // Authorize/sem resource explícito: no modo JWT, liga ao resource
                     // default (modo simples). Só opaco: sem resource (AT de sempre).
                     return at.anyJwt ? at.audience : undefined;
                 },
                 useGrantedResource: async () => true,
-                getResourceServerInfo: (_ctx, resourceIndicator, _client) => {
+                getResourceServerInfo: async (ctx, resourceIndicator, client) => {
+                    const serviceInfo = await serviceTenants.resourceServerInfo(ctx, resourceIndicator, client, signAlg);
+                    if (serviceInfo)
+                        return serviceInfo;
                     const found = findResource(resourceIndicator);
                     const isDefault = at.anyJwt && resourceIndicator === at.audience;
                     // Servidores MCP (`mcp`): os declarados e os registrados em runtime.
@@ -122,7 +138,7 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
                         info.accessTokenTTL = ttl;
                     if (format === 'jwt') {
                         // Assina com a chave de assinatura corrente do keystore (mesma do JWKS).
-                        info.jwt = { sign: { alg: config.jwks.keys[0]?.alg ?? 'RS256' } };
+                        info.jwt = { sign: { alg: signAlg } };
                     }
                     return info;
                 },
@@ -138,13 +154,23 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
         // O ator (`act`, RFC 8693) dos access tokens de impersonation — ver
         // `impersonationExtraClaims` em `token_exchange.ts`. Sem isto o token trocado
         // não se distingue de um token do próprio alvo no resource server.
-        extraTokenClaims: async (_ctx, token) => impersonationExtraClaims(token),
+        // Service tenants add `partition`/`capabilities` (see `service_tenants/`).
+        extraTokenClaims: async (ctx, token) => {
+            const actor = impersonationExtraClaims(token);
+            const tenant = await serviceTenants.extraClaims(ctx, token);
+            return actor || tenant ? { ...tenant, ...actor } : undefined;
+        },
         // Dispatcher por modelo (suportado pelo oidc-provider: `Adapter` aceita
         // função `(name) => adapter` além de classe). Session-scoped vai pro
         // `SessionAdapterClass`, o resto pro `AdapterClass` — mesma regra de
         // `pickModelAdapterClass`, usada também pelos serviços que instanciam
         // adapter na mão. Sem `session.adapter`, as duas classes são a mesma.
-        adapter: ((name) => new (pickModelAdapterClass(name, config.AdapterClass, config.SessionAdapterClass))(name)),
+        // A disabled client (`authkit_disabled`) is "not found" for the provider: every
+        // endpoint answers `invalid_client` on the next request.
+        adapter: ((name) => {
+            const instance = new (pickModelAdapterClass(name, config.AdapterClass, config.SessionAdapterClass))(name);
+            return name === 'Client' ? hideDisabledClients(instance) : instance;
+        }),
         findAccount: options.findAccount,
         // Grant REAPROVEITADO (consent já lembrado): o org capturado no primeiro
         // consent ficaria VELHO se o usuário trocasse de org no console e voltasse a
@@ -244,6 +270,7 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
             backchannelLogout: { enabled: true },
             revocation: { enabled: true },
             introspection: { enabled: true },
+            ...(serviceTenants.enabled ? { clientCredentials: { enabled: true } } : {}),
             ...registrationFeatures,
             ...deviceFlowFeatures,
             ...dpopFeatures,
@@ -279,6 +306,10 @@ export function buildProvider(config, options, sessionTtlHolder, tokenTtlHolder)
                     ? sessionTtlHolder.transientSec
                     : sessionTtlHolder.rememberSec
                 : config.ttl.session,
+            // `client_credentials` tokens: the resource's lifetime (a service-tenant resource
+            // always sets one), else the access-token TTL.
+            ClientCredentials: (_ctx, token) => token?.resourceServer?.accessTokenTTL ??
+                (tokenTtlHolder ? tokenTtlHolder.accessTokenSec : config.ttl.accessToken),
             Interaction: 3600,
             Grant: tokenTtlHolder
                 ? () => tokenTtlHolder.refreshTokenSec

package/build/src/service_tenants/client_metadata.d.ts

@@ -0,0 +1,39 @@
+import type { OidcAdapter } from '../adapters/adapter_contract.js';
+/**
+ * authkit-owned keys in a persisted `Client` payload. oidc-provider strips unknown
+ * metadata when it builds a `Client` (and when dynamic registration persists one), so
+ * these keys can only be written by authkit itself (console, Admin API, CLI) and are
+ * read straight from the adapter.
+ */
+export declare const SERVICE_TENANT_KEY = "authkit_service_tenant";
+export declare const CLIENT_DISABLED_KEY = "authkit_disabled";
+/** The service-tenant part of a client. */
+export interface ServiceTenantInfo {
+    /** Partition (tenant) the client acts as. Emitted as the `partition` claim. */
+    partition: string;
+    /** Granted capabilities. Emitted as the `capabilities` claim when non-empty. */
+    capabilities: string[];
+}
+/** Letters, digits, `.`, `_`, `:` and `-`; starts with a letter or digit; up to 128 chars. */
+export declare const PARTITION_PATTERN: RegExp;
+/** Like {@link PARTITION_PATTERN}, plus `*` and `/`. */
+export declare const CAPABILITY_PATTERN: RegExp;
+export declare const MAX_CAPABILITIES = 64;
+/** Reads the service-tenant metadata from a raw client payload, or `null`. */
+export declare function serviceTenantOf(payload: Record<string, unknown> | undefined | null): ServiceTenantInfo | null;
+/** `true` when the raw client payload is disabled. */
+export declare function isClientDisabled(payload: Record<string, unknown> | undefined | null): boolean;
+/**
+ * Validates and normalizes service-tenant input. Returns an error message or the
+ * normalized value (trimmed, de-duplicated capabilities).
+ */
+export declare function normalizeServiceTenant(input: {
+    partition: string;
+    capabilities?: string[];
+}): ServiceTenantInfo | string;
+/**
+ * Wraps the provider's `Client` adapter so a disabled client is "not found": every
+ * endpoint answers `invalid_client` from the next request on, on every instance that
+ * shares the adapter. Writes are untouched.
+ */
+export declare function hideDisabledClients<T extends OidcAdapter>(adapter: T): T;

package/build/src/service_tenants/client_metadata.js

@@ -0,0 +1,80 @@
+/**
+ * authkit-owned keys in a persisted `Client` payload. oidc-provider strips unknown
+ * metadata when it builds a `Client` (and when dynamic registration persists one), so
+ * these keys can only be written by authkit itself (console, Admin API, CLI) and are
+ * read straight from the adapter.
+ */
+export const SERVICE_TENANT_KEY = 'authkit_service_tenant';
+export const CLIENT_DISABLED_KEY = 'authkit_disabled';
+/** Letters, digits, `.`, `_`, `:` and `-`; starts with a letter or digit; up to 128 chars. */
+export const PARTITION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+/** Like {@link PARTITION_PATTERN}, plus `*` and `/`. */
+export const CAPABILITY_PATTERN = /^[A-Za-z0-9*][A-Za-z0-9._:*/-]{0,127}$/;
+export const MAX_CAPABILITIES = 64;
+/** Reads the service-tenant metadata from a raw client payload, or `null`. */
+export function serviceTenantOf(payload) {
+    const raw = payload?.[SERVICE_TENANT_KEY];
+    if (!raw || typeof raw !== 'object')
+        return null;
+    if (typeof raw.partition !== 'string' || !PARTITION_PATTERN.test(raw.partition))
+        return null;
+    const capabilities = Array.isArray(raw.capabilities)
+        ? raw.capabilities.filter((c) => typeof c === 'string' && c.length > 0)
+        : [];
+    return { partition: raw.partition, capabilities };
+}
+/** `true` when the raw client payload is disabled. */
+export function isClientDisabled(payload) {
+    return payload?.[CLIENT_DISABLED_KEY] === true;
+}
+/**
+ * Validates and normalizes service-tenant input. Returns an error message or the
+ * normalized value (trimmed, de-duplicated capabilities).
+ */
+export function normalizeServiceTenant(input) {
+    // Called directly too (not only behind the HTTP validators): check the types here.
+    const rawPartition = input?.partition;
+    const partition = typeof rawPartition === 'string' ? rawPartition.trim() : '';
+    if (!PARTITION_PATTERN.test(partition)) {
+        return `partition "${partition}" is invalid: use letters, digits, ".", "_", ":" or "-" (max 128 chars)`;
+    }
+    const rawCapabilities = input.capabilities ?? [];
+    if (!Array.isArray(rawCapabilities))
+        return 'capabilities must be an array of strings';
+    const capabilities = [];
+    for (const raw of rawCapabilities) {
+        if (typeof raw !== 'string')
+            return 'capabilities must be an array of strings';
+        const cap = raw.trim();
+        if (!CAPABILITY_PATTERN.test(cap)) {
+            return `capability "${cap}" is invalid: use letters, digits, ".", "_", ":", "*", "/" or "-" (max 128 chars)`;
+        }
+        if (!capabilities.includes(cap))
+            capabilities.push(cap);
+    }
+    if (capabilities.length > MAX_CAPABILITIES) {
+        return `at most ${MAX_CAPABILITIES} capabilities per client`;
+    }
+    return { partition, capabilities };
+}
+/**
+ * Wraps the provider's `Client` adapter so a disabled client is "not found": every
+ * endpoint answers `invalid_client` from the next request on, on every instance that
+ * shares the adapter. Writes are untouched.
+ */
+export function hideDisabledClients(adapter) {
+    return new Proxy(adapter, {
+        get(target, prop, receiver) {
+            if (prop === 'find') {
+                return async (id) => {
+                    const payload = await target.find(id);
+                    return isClientDisabled(payload)
+                        ? undefined
+                        : payload;
+                };
+            }
+            const value = Reflect.get(target, prop, receiver);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}

package/build/src/service_tenants/config.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Service tenants: confidential `client_credentials` clients that act as a partition
+ * (`partition` claim) of a resource server (e.g. a durable control plane). Their tokens
+ * are JWT access tokens (RFC 9068) whose `aud` is the resource (RFC 8707).
+ */
+/** One resource that issues service-tenant tokens. */
+export interface ServiceTenantResourceInput {
+    /** `aud` of the token. Default: the resource indicator itself. */
+    audience?: string;
+    /** Token lifetime in seconds. Default: 600 (10 minutes). */
+    expiresIn?: number;
+    /** Scopes a service tenant may request for this resource. Default: none. */
+    scopes?: string[];
+}
+export interface ServiceTenantsConfigInput {
+    /**
+     * Resource indicators (RFC 8707) that issue service-tenant tokens, e.g.
+     * `{ 'urn:agora:durable': {} }`. Only service-tenant clients can get tokens for them.
+     */
+    resources: Record<string, ServiceTenantResourceInput>;
+}
+export interface ResolvedServiceTenantResource {
+    audience: string;
+    expiresIn: number;
+    scopes: string[];
+}
+export interface ResolvedServiceTenantsConfig {
+    /** `true` when at least one resource is declared. */
+    enabled: boolean;
+    resources: Record<string, ResolvedServiceTenantResource>;
+}
+/** Default token lifetime: 10 minutes. */
+export declare const DEFAULT_SERVICE_TENANT_TTL = 600;
+/**
+ * Resolves `serviceTenants`. Throws on an invalid resource indicator, a non-positive
+ * `expiresIn`, or a resource also declared in `accessTokens.resources` (a resource is
+ * either for users or for service tenants, never both).
+ */
+export declare function resolveServiceTenants(input: ServiceTenantsConfigInput | undefined, accessTokenResources?: Record<string, unknown>): ResolvedServiceTenantsConfig;
+/** Finds a declared service-tenant resource, tolerating a trailing slash. */
+export declare function findServiceTenantResource(config: ResolvedServiceTenantsConfig, indicator: string): {
+    key: string;
+    resource: ResolvedServiceTenantResource;
+} | null;

package/build/src/service_tenants/config.js

@@ -0,0 +1,44 @@
+/**
+ * Service tenants: confidential `client_credentials` clients that act as a partition
+ * (`partition` claim) of a resource server (e.g. a durable control plane). Their tokens
+ * are JWT access tokens (RFC 9068) whose `aud` is the resource (RFC 8707).
+ */
+/** Default token lifetime: 10 minutes. */
+export const DEFAULT_SERVICE_TENANT_TTL = 600;
+const trimSlash = (s) => s.replace(/\/+$/, '');
+/**
+ * Resolves `serviceTenants`. Throws on an invalid resource indicator, a non-positive
+ * `expiresIn`, or a resource also declared in `accessTokens.resources` (a resource is
+ * either for users or for service tenants, never both).
+ */
+export function resolveServiceTenants(input, accessTokenResources = {}) {
+    const resources = {};
+    const userResources = new Set(Object.keys(accessTokenResources).map(trimSlash));
+    for (const [indicator, rc] of Object.entries(input?.resources ?? {})) {
+        const parsed = URL.parse(indicator);
+        if (!parsed || indicator.includes('#')) {
+            throw new Error(`authkit: serviceTenants.resources["${indicator}"] must be an absolute URI without a fragment (e.g. "urn:agora:durable").`);
+        }
+        if (userResources.has(trimSlash(indicator))) {
+            throw new Error(`authkit: "${indicator}" is declared in both accessTokens.resources and serviceTenants.resources. Pick one.`);
+        }
+        const expiresIn = rc?.expiresIn ?? DEFAULT_SERVICE_TENANT_TTL;
+        if (!Number.isInteger(expiresIn) || expiresIn <= 0) {
+            throw new Error(`authkit: serviceTenants.resources["${indicator}"].expiresIn must be a positive integer (seconds).`);
+        }
+        resources[indicator] = {
+            audience: rc?.audience ?? indicator,
+            expiresIn,
+            scopes: [...(rc?.scopes ?? [])],
+        };
+    }
+    return { enabled: Object.keys(resources).length > 0, resources };
+}
+/** Finds a declared service-tenant resource, tolerating a trailing slash. */
+export function findServiceTenantResource(config, indicator) {
+    if (config.resources[indicator])
+        return { key: indicator, resource: config.resources[indicator] };
+    const trimmed = trimSlash(indicator);
+    const key = Object.keys(config.resources).find((k) => trimSlash(k) === trimmed);
+    return key ? { key, resource: config.resources[key] } : null;
+}

package/build/src/service_tenants/provider_hooks.d.ts

@@ -0,0 +1,52 @@
+import type { OidcAdapterClass } from '../adapters/factory.js';
+import type { AuditSink } from '../audit/audit_sink.js';
+import { type ResolvedServiceTenantsConfig } from './config.js';
+export interface ServiceTenantHooksDeps {
+    serviceTenants: ResolvedServiceTenantsConfig;
+    /** Adapter class of the `Client` model (raw: sees authkit's own keys). */
+    AdapterClass: OidcAdapterClass;
+    audit?: AuditSink;
+}
+/** Resource server info for a service-tenant resource, in oidc-provider's shape. */
+export interface ServiceTenantResourceServerInfo {
+    scope: string;
+    audience: string;
+    accessTokenFormat: 'jwt';
+    accessTokenTTL: number;
+    jwt: {
+        sign: {
+            alg: string;
+        };
+    };
+}
+/**
+ * The provider hooks behind service tenants:
+ *
+ * - a service-tenant resource is granted only to a service-tenant client, only on the
+ *   `client_credentials` grant, always as a JWT access token (RFC 9068);
+ * - a service-tenant client can only get tokens for a service-tenant resource (when
+ *   it sends no `resource` and exactly one is declared, that one is used);
+ * - its tokens carry the `partition` (and `capabilities`) claims read from the client
+ *   at issuance time, so an edit applies to the next token.
+ */
+export declare function createServiceTenantHooks(deps: ServiceTenantHooksDeps): {
+    enabled: boolean;
+    /**
+     * `defaultResource` for a service-tenant client: the only declared resource, or
+     * `invalid_target` when several are declared. `undefined` for any other client.
+     */
+    defaultResource(ctx: any, client: any): Promise<string | undefined>;
+    /**
+     * `getResourceServerInfo` for service tenants. Returns the info for a
+     * service-tenant resource, `undefined` when neither the resource nor the client is
+     * a service-tenant one (the caller handles it), and throws `invalid_target` for a
+     * mismatch.
+     */
+    resourceServerInfo(ctx: any, indicator: string, client: any, signAlg: string): Promise<ServiceTenantResourceServerInfo | undefined>;
+    /** `extraTokenClaims` for a service-tenant token; audits the issuance. */
+    extraClaims(ctx: any, token: any): Promise<{
+        partition: string;
+        capabilities?: string[];
+    } | undefined>;
+};
+export type ServiceTenantHooks = ReturnType<typeof createServiceTenantHooks>;

package/build/src/service_tenants/provider_hooks.js

@@ -0,0 +1,124 @@
+import { errors } from 'oidc-provider';
+import { serviceTenantOf } from './client_metadata.js';
+import { findServiceTenantResource } from './config.js';
+/**
+ * The provider hooks behind service tenants:
+ *
+ * - a service-tenant resource is granted only to a service-tenant client, only on the
+ *   `client_credentials` grant, always as a JWT access token (RFC 9068);
+ * - a service-tenant client can only get tokens for a service-tenant resource (when
+ *   it sends no `resource` and exactly one is declared, that one is used);
+ * - its tokens carry the `partition` (and `capabilities`) claims read from the client
+ *   at issuance time, so an edit applies to the next token.
+ */
+export function createServiceTenantHooks(deps) {
+    const { serviceTenants } = deps;
+    const memo = new WeakMap();
+    let adapter;
+    const read = async (clientId) => {
+        adapter ??= new deps.AdapterClass('Client');
+        return serviceTenantOf((await adapter.find(clientId)));
+    };
+    /** Service-tenant info of the client, memoized per request. */
+    const tenantOf = (ctx, clientId) => {
+        if (!clientId)
+            return Promise.resolve(null);
+        const key = ctx && typeof ctx === 'object' ? ctx : null;
+        if (!key)
+            return read(clientId);
+        let byClient = memo.get(key);
+        if (!byClient) {
+            byClient = new Map();
+            memo.set(key, byClient);
+        }
+        let pending = byClient.get(clientId);
+        if (!pending) {
+            pending = read(clientId);
+            byClient.set(clientId, pending);
+        }
+        return pending;
+    };
+    return {
+        enabled: serviceTenants.enabled,
+        /**
+         * `defaultResource` for a service-tenant client: the only declared resource, or
+         * `invalid_target` when several are declared. `undefined` for any other client.
+         */
+        async defaultResource(ctx, client) {
+            if (!serviceTenants.enabled)
+                return undefined;
+            if (!(await tenantOf(ctx, client?.clientId)))
+                return undefined;
+            const keys = Object.keys(serviceTenants.resources);
+            if (keys.length === 1)
+                return keys[0];
+            throw new errors.InvalidTarget('a service tenant must send the resource parameter');
+        },
+        /**
+         * `getResourceServerInfo` for service tenants. Returns the info for a
+         * service-tenant resource, `undefined` when neither the resource nor the client is
+         * a service-tenant one (the caller handles it), and throws `invalid_target` for a
+         * mismatch.
+         */
+        async resourceServerInfo(ctx, indicator, client, signAlg) {
+            if (!serviceTenants.enabled)
+                return undefined;
+            const found = findServiceTenantResource(serviceTenants, indicator);
+            const tenant = await tenantOf(ctx, client?.clientId);
+            if (found) {
+                const grantType = ctx?.oidc?.params?.grant_type;
+                if (!tenant || grantType !== 'client_credentials') {
+                    throw new errors.InvalidTarget(`resource indicator not allowed: ${indicator}`);
+                }
+                return {
+                    scope: found.resource.scopes.join(' '),
+                    audience: found.resource.audience,
+                    accessTokenFormat: 'jwt',
+                    accessTokenTTL: found.resource.expiresIn,
+                    jwt: { sign: { alg: signAlg } },
+                };
+            }
+            if (tenant) {
+                throw new errors.InvalidTarget(`resource indicator not allowed for a service tenant: ${indicator}`);
+            }
+            return undefined;
+        },
+        /** `extraTokenClaims` for a service-tenant token; audits the issuance. */
+        async extraClaims(ctx, token) {
+            if (!serviceTenants.enabled || token?.kind !== 'ClientCredentials')
+                return undefined;
+            const rs = token.resourceServer;
+            const indicator = typeof rs?.identifier === 'function' ? rs.identifier() : undefined;
+            if (typeof indicator !== 'string')
+                return undefined;
+            const found = findServiceTenantResource(serviceTenants, indicator);
+            if (!found)
+                return undefined;
+            const tenant = await tenantOf(ctx, token.clientId);
+            if (!tenant)
+                return undefined;
+            try {
+                await deps.audit
+                    ?.record({
+                    type: 'service_tenant.token_issued',
+                    clientId: token.clientId,
+                    ip: typeof ctx?.ip === 'string' ? ctx.ip : null,
+                    metadata: {
+                        partition: tenant.partition,
+                        resource: found.key,
+                        jti: token.jti,
+                        expiresIn: found.resource.expiresIn,
+                    },
+                })
+                    .catch(() => { });
+            }
+            catch {
+                // Auditing is best-effort: it never fails an issuance.
+            }
+            return {
+                partition: tenant.partition,
+                ...(tenant.capabilities.length ? { capabilities: tenant.capabilities } : {}),
+            };
+        },
+    };
+}

package/build/src/service_tenants/tenant_verifier.d.ts

@@ -0,0 +1,73 @@
+import type { ResolvedServiceTenantsConfig } from './config.js';
+/**
+ * What a verified tenant token authenticates as. Same shape as `VerifiedTenant` in
+ * `@adonis-agora/durable` (declared here: authkit never imports durable).
+ */
+export interface VerifiedTenant {
+    tenant: string;
+    capabilities?: string[] | undefined;
+}
+/** The input a control plane hands to its tenant verifier. */
+export interface TenantVerifierInput {
+    /** The token the tenant presented. */
+    token?: string | undefined;
+    /** The tenant the request claims to be. Advisory only: the token decides. */
+    tenant?: string | undefined;
+}
+/** The issuer the verifier checks against: the local authkit server. */
+export interface TenantTokenIssuer {
+    readonly publicJwks: {
+        keys: Record<string, any>[];
+    };
+    readonly config: {
+        issuer: string;
+        serviceTenants?: ResolvedServiceTenantsConfig;
+    };
+}
+export interface AuthkitTenantVerifierOptions {
+    /**
+     * Expected `aud`. Default: the audience of the only resource in
+     * `serviceTenants.resources` (required when several are declared).
+     */
+    audience?: string;
+    /** Claim holding the partition. Default: `'partition'`. */
+    partitionClaim?: string;
+    /** Claim holding the capabilities. Default: `'capabilities'`. */
+    capabilitiesClaim?: string;
+    /** Allowed clock skew in seconds for `exp`/`nbf`/`iat`. Default: 30. */
+    clockToleranceSec?: number;
+    /**
+     * Where the issuer comes from. Default: the `authkit.server` binding of the booted
+     * app. Read on every call, so a signing-key rotation applies right away.
+     */
+    issuer?: () => TenantTokenIssuer | Promise<TenantTokenIssuer>;
+}
+/**
+ * Verifies service-tenant tokens against the local authkit issuer and its JWKS (no
+ * network call), and returns the tenant they authenticate as, or `null`.
+ *
+ * Satisfies durable's `TenantVerifierContract` (`verify(input)`); usable as a class in
+ * `verifyTenant` (built by the container with the default options) or through
+ * {@link authkitTenantVerifier}.
+ */
+export declare class AuthkitTenantVerifier {
+    #private;
+    constructor(options?: AuthkitTenantVerifierOptions);
+    verify(input: TenantVerifierInput): Promise<VerifiedTenant | null>;
+}
+/** A tenant verifier usable both as a function and as an object with `verify`. */
+export type AuthkitTenantVerifierFn = ((input: TenantVerifierInput) => Promise<VerifiedTenant | null>) & {
+    verify(input: TenantVerifierInput): Promise<VerifiedTenant | null>;
+};
+/**
+ * Tenant verifier for a durable control plane hosted by the authkit app:
+ *
+ * ```ts
+ * // config/durable.ts
+ * verifyTenant: authkitTenantVerifier()
+ * ```
+ *
+ * The result is a function (durable's `TenantVerifier`) that also has `verify`
+ * (durable's `TenantVerifierContract`).
+ */
+export declare function authkitTenantVerifier(options?: AuthkitTenantVerifierOptions): AuthkitTenantVerifierFn;