@agntcy/slim-bindings 2.1.0 → 2.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +68 -0
- package/package.json +9 -10
package/README.md
CHANGED
|
@@ -52,6 +52,74 @@ Full TypeScript types ship under `types/` in the published package (`index.d.ts`
|
|
|
52
52
|
`slimBindings.getGlobalService().runServer(config)`
|
|
53
53
|
The process must stay alive while the server runs (see examples).
|
|
54
54
|
|
|
55
|
+
## Transport authentication (gRPC connection)
|
|
56
|
+
|
|
57
|
+
Separate from the app identity given to `createAppWithSecret`, the gRPC connection to a SLIM
|
|
58
|
+
node can carry its own credentials via `config.auth` (and `ServerConfig.auth` when hosting).
|
|
59
|
+
Supported modes are `Basic`, `StaticJwt`, `Jwt`, `Spire`, and `Oidc`.
|
|
60
|
+
|
|
61
|
+
OIDC, client side (client-credentials flow):
|
|
62
|
+
|
|
63
|
+
```ts
|
|
64
|
+
const config = slimBindings.newInsecureClientConfig('http://127.0.0.1:46357');
|
|
65
|
+
config.auth = new slimBindings.ClientAuthenticationConfig.Oidc({
|
|
66
|
+
config: {
|
|
67
|
+
issuerUrl: 'https://auth.example.com',
|
|
68
|
+
clientId: 'my-client',
|
|
69
|
+
clientSecret: 's3cr3t',
|
|
70
|
+
scope: 'openid profile',
|
|
71
|
+
timeout: 30_000, // durations are milliseconds
|
|
72
|
+
},
|
|
73
|
+
});
|
|
74
|
+
|
|
75
|
+
const connId = await service.connectAsync(config);
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
For the refresh-token flow set `refreshToken` — or `refreshTokenFile`, which is rewritten in
|
|
79
|
+
place as tokens rotate — instead of `clientSecret`.
|
|
80
|
+
|
|
81
|
+
Server side, verifying incoming JWTs against the issuer's JWKS endpoint, optionally
|
|
82
|
+
restricting access by claim:
|
|
83
|
+
|
|
84
|
+
```ts
|
|
85
|
+
const config = slimBindings.newInsecureServerConfig('0.0.0.0:46357');
|
|
86
|
+
config.auth = new slimBindings.ServerAuthenticationConfig.Oidc({
|
|
87
|
+
config: {
|
|
88
|
+
issuerUrl: 'https://auth.example.com',
|
|
89
|
+
audience: 'slim', // required for verification
|
|
90
|
+
jwksTtl: 3_600_000,
|
|
91
|
+
policy: new slimBindings.OidcPolicyConfig.Cel({ expression: '"admin" in claims.groups' }),
|
|
92
|
+
},
|
|
93
|
+
});
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
`policy` accepts `OidcPolicyConfig.Cel`, `OidcPolicyConfig.Rego` (which must define
|
|
97
|
+
`package slim.auth` with `default allow = false`), or `OidcPolicyConfig.RegoFile`. Client-only
|
|
98
|
+
fields (`scope`, `timeout`) and server-only fields (`jwksTtl`, `claimCacheTtl`, `policy`) are
|
|
99
|
+
ignored by the other side.
|
|
100
|
+
|
|
101
|
+
From a config file — `newConfigFromJson(json)` accepts a full gRPC client config, covering TLS
|
|
102
|
+
material, backoff, and every authentication mode. The examples read the same document from
|
|
103
|
+
`SLIM_CLIENT_CONFIG`:
|
|
104
|
+
|
|
105
|
+
```json
|
|
106
|
+
{
|
|
107
|
+
"endpoint": "http://127.0.0.1:46357",
|
|
108
|
+
"tls": { "insecure": true },
|
|
109
|
+
"auth": {
|
|
110
|
+
"type": "oidc",
|
|
111
|
+
"issuer_url": "https://auth.example.com",
|
|
112
|
+
"client_id": "my-client",
|
|
113
|
+
"client_secret": "s3cr3t",
|
|
114
|
+
"audience": "slim",
|
|
115
|
+
"policy": { "cel": "\"admin\" in claims.groups" }
|
|
116
|
+
}
|
|
117
|
+
}
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
The schema matches `data-plane/core/config/src/grpc/schema/client-config.schema.json` in the
|
|
121
|
+
[slim](https://github.com/agntcy/slim) repo.
|
|
122
|
+
|
|
55
123
|
## Examples
|
|
56
124
|
|
|
57
125
|
Runnable scripts live under `examples/` (from repo root, use the `Taskfile` targets `example:server`, `example:alice`, `example:bob`, `example:group`, or run them via npm from `examples/` as documented in [README_dev.md](./README_dev.md)). `example:group` demonstrates multicast (group) sessions — a moderator creates a channel and invites participants; see [README_dev.md](./README_dev.md#3-run-the-group-multicast-example) for usage.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@agntcy/slim-bindings",
|
|
3
|
-
"version": "2.1.
|
|
3
|
+
"version": "2.1.1",
|
|
4
4
|
"description": "SLIM Node.js bindings using UniFFI",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "index.js",
|
|
@@ -42,15 +42,14 @@
|
|
|
42
42
|
"@ubjs/node": "0.31.0-3"
|
|
43
43
|
},
|
|
44
44
|
"optionalDependencies": {
|
|
45
|
-
"@agntcy/slim-bindings-darwin-arm64": "2.1.
|
|
46
|
-
"@agntcy/slim-bindings-darwin-x64": "2.1.
|
|
47
|
-
"@agntcy/slim-bindings-linux-arm64-gnu": "2.1.
|
|
48
|
-
"@agntcy/slim-bindings-linux-arm64-musl": "2.1.
|
|
49
|
-
"@agntcy/slim-bindings-linux-x64-gnu": "2.1.
|
|
50
|
-
"@agntcy/slim-bindings-linux-x64-musl": "2.1.
|
|
51
|
-
"@agntcy/slim-bindings-win32-arm64-msvc": "2.1.
|
|
52
|
-
"@agntcy/slim-bindings-win32-x64-
|
|
53
|
-
"@agntcy/slim-bindings-win32-x64-msvc": "2.1.0"
|
|
45
|
+
"@agntcy/slim-bindings-darwin-arm64": "2.1.1",
|
|
46
|
+
"@agntcy/slim-bindings-darwin-x64": "2.1.1",
|
|
47
|
+
"@agntcy/slim-bindings-linux-arm64-gnu": "2.1.1",
|
|
48
|
+
"@agntcy/slim-bindings-linux-arm64-musl": "2.1.1",
|
|
49
|
+
"@agntcy/slim-bindings-linux-x64-gnu": "2.1.1",
|
|
50
|
+
"@agntcy/slim-bindings-linux-x64-musl": "2.1.1",
|
|
51
|
+
"@agntcy/slim-bindings-win32-arm64-msvc": "2.1.1",
|
|
52
|
+
"@agntcy/slim-bindings-win32-x64-msvc": "2.1.1"
|
|
54
53
|
},
|
|
55
54
|
"devDependencies": {
|
|
56
55
|
"@types/node": "^20.0.0",
|