@ajna-inc/openbadges 0.1.0

package/build/http/OpenBadgesHttpModuleConfig.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenBadgesHttpModuleConfig = void 0;
+const router_1 = require("./router");
+class OpenBadgesHttpModuleConfig {
+    constructor(options) {
+        this.options = options;
+        this.router = options.router ?? (0, router_1.importExpress)().Router();
+    }
+    get baseUrl() {
+        return this.options.baseUrl;
+    }
+    get defaultSubjectId() {
+        return this.options.defaultSubjectId;
+    }
+    get discoveryPath() {
+        return this.options.endpoints?.discovery ?? '/ims/ob/v3p0/discovery';
+    }
+    get jwksPath() {
+        return this.options.endpoints?.jwks ?? '/.well-known/jwks.json';
+    }
+    get didDocumentPath() {
+        return this.options.endpoints?.didDocument ?? '/.well-known/did.json';
+    }
+    get registrationPath() {
+        return this.options.endpoints?.registration ?? '/connect/register';
+    }
+    get authorizePath() {
+        return this.options.endpoints?.authorize ?? '/authorize';
+    }
+    get tokenPath() {
+        return this.options.endpoints?.token ?? '/token';
+    }
+    get revokePath() {
+        return this.options.endpoints?.revoke ?? '/revoke';
+    }
+    get introspectPath() {
+        return this.options.endpoints?.introspect ?? '/introspect';
+    }
+    get profilePath() {
+        return this.options.endpoints?.profile ?? '/ims/ob/v3p0/profile';
+    }
+    get credentialsPath() {
+        return this.options.endpoints?.credentials ?? '/ims/ob/v3p0/credentials';
+    }
+    get providerName() {
+        return this.options.providerName;
+    }
+    get privacyPolicyUrl() {
+        return this.options.privacyPolicyUrl;
+    }
+    get termsOfServiceUrl() {
+        return this.options.termsOfServiceUrl;
+    }
+    get requireConsent() {
+        return this.options.requireConsent ?? false;
+    }
+    get useTenantRouting() {
+        return this.options.useTenantRouting ?? false;
+    }
+    get actorParamName() {
+        return this.options.actorParamName ?? 'actorId';
+    }
+    get didWebId() {
+        return this.options.didWebId;
+    }
+    get consentPath() {
+        return this.options.endpoints?.consent ?? '/consent';
+    }
+    get statusListPath() {
+        return this.options.endpoints?.statusList ?? '/status-list';
+    }
+    get refreshPath() {
+        return this.options.endpoints?.refresh ?? '/ims/ob/v3p0/credentials/refresh';
+    }
+}
+exports.OpenBadgesHttpModuleConfig = OpenBadgesHttpModuleConfig;
+//# sourceMappingURL=OpenBadgesHttpModuleConfig.js.map

package/build/http/OpenBadgesHttpModuleConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenBadgesHttpModuleConfig.js","sourceRoot":"","sources":["../../src/http/OpenBadgesHttpModuleConfig.ts"],"names":[],"mappings":";;;AAEA,qCAAwC;AA8BxC,MAAa,0BAA0B;IAIrC,YAAmB,OAA0C;QAC3D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,sBAAa,GAAE,CAAC,MAAM,EAAE,CAAA;IAC1D,CAAC;IAED,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAA;IAC7B,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAA;IACtC,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,wBAAwB,CAAA;IACtE,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,IAAI,wBAAwB,CAAA;IACjE,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,IAAI,uBAAuB,CAAA;IACvE,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,IAAI,mBAAmB,CAAA;IACpE,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,IAAI,YAAY,CAAA;IAC1D,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,CAAA;IAClD,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,IAAI,SAAS,CAAA;IACpD,CAAC;IAED,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,aAAa,CAAA;IAC5D,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,sBAAsB,CAAA;IAClE,CAAC;IAED,IAAW,eAAe;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,IAAI,0BAA0B,CAAA;IAC1E,CAAC;IAED,IAAW,YAAY;QACrB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAA;IAClC,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAA;IACtC,CAAC;IAED,IAAW,iBAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAA;IACvC,CAAC;IAED,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,KAAK,CAAA;IAC7C,CAAC;IAED,IAAW,gBAAgB;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAA;IAC/C,CAAC;IAED,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,SAAS,CAAA;IACjD,CAAC;IAED,IAAW,QAAQ;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAA;IAC9B,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,UAAU,CAAA;IACtD,CAAC;IAED,IAAW,cAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,cAAc,CAAA;IAC7D,CAAC;IAED,IAAW,WAAW;QACpB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,IAAI,kCAAkC,CAAA;IAC9E,CAAC;CACF;AAhGD,gEAgGC"}

package/build/http/endpoints/authorize.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureAuthorizeEndpoint(router: Router, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/authorize.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureAuthorizeEndpoint = configureAuthorizeEndpoint;
+const router_1 = require("../router");
+const OpenBadgesAuthCodeRepository_1 = require("../../repository/OpenBadgesAuthCodeRepository");
+const OpenBadgesOAuthRepository_1 = require("../../repository/OpenBadgesOAuthRepository");
+const auth_1 = require("../util/auth");
+const OpenBadgesConsentRepository_1 = require("../../repository/OpenBadgesConsentRepository");
+function urlEncode(params) {
+    return Object.entries(params)
+        .filter(([, v]) => v !== undefined)
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`)
+        .join('&');
+}
+function randomCode() {
+    return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+}
+function configureAuthorizeEndpoint(router, module) {
+    router.get(module.config.authorizePath, async (req, res) => {
+        const { agentContext } = req.requestContext;
+        const { query } = req;
+        const client_id = String(query.client_id ?? '');
+        const redirect_uri = String(query.redirect_uri ?? '');
+        const response_type = String(query.response_type ?? 'code');
+        const scope = String(query.scope ?? '');
+        const state = String(query.state ?? '');
+        const code_challenge = query.code_challenge ? String(query.code_challenge) : undefined;
+        const code_challenge_method = query.code_challenge_method ? String(query.code_challenge_method) : undefined;
+        if (response_type !== 'code')
+            return (0, router_1.sendError)(res, 400, 'unsupported_response_type', 'Only code supported');
+        if (!client_id || !redirect_uri)
+            return (0, router_1.sendError)(res, 400, 'invalid_request', 'client_id and redirect_uri required');
+        // Validate client registration, redirect_uri and scope against registration
+        const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+        const clientRec = await oauthRepo.findByClientId(agentContext, client_id);
+        if (!clientRec)
+            return (0, router_1.sendError)(res, 401, 'unauthorized_client', 'Unknown client_id');
+        const reg = clientRec.clientRegistration || {};
+        const redirectUris = Array.isArray(reg.redirect_uris) ? reg.redirect_uris : [];
+        if (!redirectUris.includes(redirect_uri))
+            return (0, router_1.sendError)(res, 400, 'invalid_request', 'redirect_uri not registered');
+        if (!(0, auth_1.isScopeSubset)(scope, reg.scope))
+            return (0, router_1.sendError)(res, 400, 'invalid_scope', 'Requested scope not allowed');
+        const subject = module.config.defaultSubjectId;
+        if (!subject)
+            return (0, router_1.sendError)(res, 500, 'server_error', 'No defaultSubjectId configured');
+        if (module.config.requireConsent) {
+            const consentRepo = agentContext.dependencyManager.resolve(OpenBadgesConsentRepository_1.OpenBadgesConsentRepository);
+            const consent = await consentRepo.findByClientAndSubject(agentContext, client_id, subject);
+            if (!consent) {
+                return res
+                    .status(403)
+                    .json({
+                    error: 'consent_required',
+                    consent_endpoint: new URL(module.config.consentPath, module.config.baseUrl).toString(),
+                    client_id,
+                    subject,
+                });
+            }
+        }
+        const code = randomCode();
+        const expiresAt = new Date(Date.now() + 60 * 1000);
+        const repo = agentContext.dependencyManager.resolve(OpenBadgesAuthCodeRepository_1.OpenBadgesAuthCodeRepository);
+        await repo.save(agentContext, new (require('../../repository/OpenBadgesAuthCodeRecord').OpenBadgesAuthCodeRecord)({
+            code,
+            clientId: client_id,
+            redirectUri: redirect_uri,
+            scope,
+            subject,
+            expiresAt,
+            codeChallenge: code_challenge,
+            codeChallengeMethod: code_challenge_method,
+        }));
+        const redirectUrl = `${redirect_uri}${redirect_uri.includes('?') ? '&' : '?'}${urlEncode({ code, state })}`;
+        agentContext.config.logger.debug('[OB][OAuth] Issued authorization code', { client_id });
+        res.redirect(302, redirectUrl);
+    });
+}
+//# sourceMappingURL=authorize.js.map

package/build/http/endpoints/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../src/http/endpoints/authorize.ts"],"names":[],"mappings":";;AAqBA,gEAgEC;AAjFD,sCAAqC;AACrC,gGAA4F;AAC5F,0FAAsF;AACtF,uCAA4C;AAC5C,8FAA0F;AAE1F,SAAS,SAAS,CAAC,MAAmD;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5E,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,SAAgB,0BAA0B,CAAC,MAAc,EAAE,MAA4B;IACrF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC9E,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,cAAe,CAAA;QAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;QAErB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,CAAA;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACvC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtF,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAE3G,IAAI,aAAa,KAAK,MAAM;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,EAAE,qBAAqB,CAAC,CAAA;QAC5G,IAAI,CAAC,SAAS,IAAI,CAAC,YAAY;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,qCAAqC,CAAC,CAAA;QAErH,4EAA4E;QAC5E,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QACzE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,CAAA;QACtF,MAAM,GAAG,GAAI,SAAS,CAAC,kBAA0B,IAAI,EAAE,CAAA;QACvD,MAAM,YAAY,GAAa,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAA;QACxF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,6BAA6B,CAAC,CAAA;QACtH,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,6BAA6B,CAAC,CAAA;QAEhH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAA;QAC9C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAA;QAE1F,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,yDAA2B,CAAC,CAAA;YACvF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;YAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG;qBACP,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC;oBACJ,KAAK,EAAE,kBAAkB;oBACzB,gBAAgB,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;oBACtF,SAAS;oBACT,OAAO;iBACR,CAAC,CAAA;YACN,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,2DAA4B,CAAC,CAAA;QACjF,MAAM,IAAI,CAAC,IAAI,CACb,YAAY,EACZ,IAAI,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,wBAAwB,CAAC,CAAC;YAClF,IAAI;YACJ,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,YAAY;YACzB,KAAK;YACL,OAAO;YACP,SAAS;YACT,aAAa,EAAE,cAAc;YAC7B,mBAAmB,EAAE,qBAAqB;SAC3C,CAAC,CACH,CAAA;QAED,MAAM,WAAW,GAAG,GAAG,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;QAC3G,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;QACxF,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/consent.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureConsentEndpoint(router: Router, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/consent.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureConsentEndpoint = configureConsentEndpoint;
+const router_1 = require("../router");
+const OpenBadgesConsentRepository_1 = require("../../repository/OpenBadgesConsentRepository");
+function configureConsentEndpoint(router, module) {
+    router.post(module.config.consentPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const client_id = String(req.body?.client_id ?? '');
+        const subject = String(req.body?.subject ?? module.config.defaultSubjectId ?? '');
+        if (!client_id || !subject)
+            return (0, router_1.sendError)(res, 400, 'invalid_request', 'client_id and subject are required');
+        const repo = agentContext.dependencyManager.resolve(OpenBadgesConsentRepository_1.OpenBadgesConsentRepository);
+        const existing = await repo.findByClientAndSubject(agentContext, client_id, subject);
+        if (existing)
+            return (0, router_1.sendJson)(res, { ok: true, alreadyGranted: true });
+        await repo.save(agentContext, {
+            clientId: client_id,
+            subject,
+            grantedAt: new Date(),
+        });
+        return (0, router_1.sendJson)(res, { ok: true });
+    });
+}
+//# sourceMappingURL=consent.js.map

package/build/http/endpoints/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../src/http/endpoints/consent.ts"],"names":[],"mappings":";;AAOA,4DAgBC;AAnBD,sCAAkE;AAClE,8FAA0F;AAE1F,SAAgB,wBAAwB,CAAC,MAAc,EAAE,MAA4B;IACnF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAC7E,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAA;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,oCAAoC,CAAC,CAAA;QAC/G,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,yDAA2B,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACpF,IAAI,QAAQ;YAAE,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAA;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAC5B,QAAQ,EAAE,SAAS;YACnB,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,EAAE;SACf,CAAC,CAAA;QACT,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/credentials.d.ts

@@ -0,0 +1,4 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureCredentialsEndpoints(router: Router, config: OpenBadgesHttpModuleConfig, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/credentials.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureCredentialsEndpoints = configureCredentialsEndpoints;
+const auth_1 = require("../middleware/auth");
+const router_1 = require("../router");
+const OpenBadgeCredentialRepository_1 = require("../../repository/OpenBadgeCredentialRepository");
+const OpenBadgeCredentialRecord_1 = require("../../repository/OpenBadgeCredentialRecord");
+const DisplayMapper_1 = require("../../services/DisplayMapper");
+const OB_READ = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/readonly';
+const OB_WRITE = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/replace';
+const OB_DELETE = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/delete';
+function configureCredentialsEndpoints(router, config, module) {
+    // POST create/upsert
+    router.post(config.credentialsPath, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_WRITE]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const auth = req.requestContext.auth;
+            const body = req.body;
+            if (!body || typeof body !== 'object')
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Missing credential body');
+            const repo = agentContext.dependencyManager.resolve(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository);
+            const mapper = agentContext.dependencyManager.resolve(DisplayMapper_1.DisplayMapper);
+            const record = new OpenBadgeCredentialRecord_1.OpenBadgeCredentialRecord({
+                credential: body,
+                status: 'unknown',
+                derived: mapper.toDisplay(body),
+                tags: { subjectId: auth.subject },
+            });
+            await repo.save(agentContext, record);
+            return (0, router_1.sendJson)(res, { id: record.id }, 201);
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // GET list
+    router.get(config.credentialsPath, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_READ]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const auth = req.requestContext.auth;
+            const repo = agentContext.dependencyManager.resolve(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository);
+            const items = await repo.findByQuery(agentContext, { subjectId: auth.subject });
+            return (0, router_1.sendJson)(res, items.map((r) => ({ id: r.id, status: r.status, derived: r.derived })));
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // GET one
+    router.get(`${config.credentialsPath}/:id`, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_READ]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const repo = agentContext.dependencyManager.resolve(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository);
+            const id = String(req.params.id);
+            const record = await repo.getById(agentContext, id);
+            if (!record)
+                return (0, router_1.sendError)(res, 404, 'not_found', 'Credential not found');
+            return (0, router_1.sendJson)(res, record.credential);
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // DELETE one
+    router.delete(`${config.credentialsPath}/:id`, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_DELETE]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const auth = req.requestContext.auth;
+            const repo = agentContext.dependencyManager.resolve(OpenBadgeCredentialRepository_1.OpenBadgeCredentialRepository);
+            const id = String(req.params.id);
+            const record = await repo.getById(agentContext, id);
+            if (!record)
+                return (0, router_1.sendError)(res, 404, 'not_found', 'Credential not found');
+            const tags = record.getTags();
+            if (tags.subjectId && tags.subjectId !== auth.subject)
+                return (0, router_1.sendError)(res, 404, 'not_found', 'Credential not found');
+            await repo.deleteById(agentContext, id);
+            return (0, router_1.sendJson)(res, { deleted: true });
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+}
+//# sourceMappingURL=credentials.js.map

package/build/http/endpoints/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/http/endpoints/credentials.ts"],"names":[],"mappings":";;AAeA,sEA2EC;AArFD,6CAA8D;AAC9D,sCAAkE;AAClE,kGAA8F;AAC9F,0FAAsF;AACtF,gEAA4D;AAE5D,MAAM,OAAO,GAAG,wDAAwD,CAAA;AACxE,MAAM,QAAQ,GAAG,uDAAuD,CAAA;AACxE,MAAM,SAAS,GAAG,sDAAsD,CAAA;AAExE,SAAgB,6BAA6B,CAAC,MAAc,EAAE,MAAkC,EAAE,MAA4B;IAC5H,qBAAqB;IACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAA,iBAAU,EAAC,MAAM,CAAC,EAAE,IAAA,oBAAa,EAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACzH,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAI,GAAG,CAAC,cAAsB,CAAC,IAAI,CAAA;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;YACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAA;YAE/G,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAClF,MAAM,MAAM,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6BAAa,CAAC,CAAA;YAEpE,MAAM,MAAM,GAAG,IAAI,qDAAyB,CAAC;gBAC3C,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC/B,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE;aAClC,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAErC,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,WAAW;IACX,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,IAAA,iBAAU,EAAC,MAAM,CAAC,EAAE,IAAA,oBAAa,EAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACvH,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAI,GAAG,CAAC,cAAsB,CAAC,IAAI,CAAA;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAClF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YAC/E,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACnG,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,UAAU;IACV,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,MAAM,EAAE,IAAA,iBAAU,EAAC,MAAM,CAAC,EAAE,IAAA,oBAAa,EAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAChI,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAClF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAA;YAC5E,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,aAAa;IACb,MAAM,CAAC,MAAM,CACX,GAAG,MAAM,CAAC,eAAe,MAAM,EAC/B,IAAA,iBAAU,EAAC,MAAM,CAAC,EAClB,IAAA,oBAAa,EAAC,CAAC,SAAS,CAAC,CAAC,EAC1B,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAI,GAAG,CAAC,cAAsB,CAAC,IAAI,CAAA;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,6DAA6B,CAAC,CAAA;YAClF,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAA;YAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAS,CAAA;YACpC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAA;YACtH,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;YACvC,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACzC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/build/http/endpoints/did.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+export declare function configureDidDocumentEndpoint(router: Router, config: OpenBadgesHttpModuleConfig): void;

package/build/http/endpoints/did.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureDidDocumentEndpoint = configureDidDocumentEndpoint;
+const router_1 = require("../router");
+const OpenBadgesKeyBindingRepository_1 = require("../../repository/OpenBadgesKeyBindingRepository");
+function parseDidWebToPath(did) {
+    // did:web:example.com[:path:segments]
+    const parts = did.split(':');
+    if (parts.length < 3 || parts[0] !== 'did' || parts[1] !== 'web')
+        return '';
+    const domainEnc = parts[2];
+    const pathSegs = parts.slice(3);
+    // Resolution rules: if path segments present => "/<segments>/did.json", else => "/.well-known/did.json"
+    return pathSegs.length > 0 ? `/${pathSegs.join('/')}/did.json` : '/.well-known/did.json';
+}
+function configureDidDocumentEndpoint(router, config) {
+    const did = config.didWebId;
+    if (!did)
+        return;
+    const path = config.didDocumentPath || parseDidWebToPath(did) || '/.well-known/did.json';
+    router.get(path, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const bindingRepo = agentContext.dependencyManager.resolve(OpenBadgesKeyBindingRepository_1.OpenBadgesKeyBindingRepository);
+        let bindings = [];
+        try {
+            const all = await bindingRepo.getAll(agentContext);
+            bindings = all.filter((b) => b.controller === did);
+        }
+        catch (e) {
+            agentContext.config.logger.warn('[OB][HTTP][DID] bindingRepo.getAll failed', { err: e?.message || e });
+            bindings = [];
+        }
+        const vm = bindings.map((b) => ({
+            id: b.vmId,
+            type: 'Ed25519VerificationKey2020',
+            controller: did,
+            publicKeyMultibase: b.publicKeyMultibase,
+        }));
+        const doc = {
+            '@context': 'https://www.w3.org/ns/did/v1',
+            id: did,
+            verificationMethod: vm,
+            assertionMethod: vm.map((v) => v.id),
+        };
+        (0, router_1.sendJson)(res, doc);
+    });
+}
+//# sourceMappingURL=did.js.map

package/build/http/endpoints/did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"did.js","sourceRoot":"","sources":["../../../src/http/endpoints/did.ts"],"names":[],"mappings":";;AAiBA,oEA8BC;AA3CD,sCAAuD;AACvD,oGAAgG;AAEhG,SAAS,iBAAiB,CAAC,GAAW;IACpC,sCAAsC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,CAAA;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/B,wGAAwG;IACxG,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAA;AAC1F,CAAC;AAED,SAAgB,4BAA4B,CAAC,MAAc,EAAE,MAAkC;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAA;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAM;IAChB,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,uBAAuB,CAAA;IACxF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACvD,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+DAA8B,CAAC,CAAA;QAC1F,IAAI,QAAQ,GAAG,EAAW,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAClD,QAAQ,GAAI,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,GAAG,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YAC/G,QAAQ,GAAG,EAAE,CAAA;QACf,CAAC;QAED,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YACnC,EAAE,EAAE,CAAC,CAAC,IAAI;YACV,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,GAAG;YACf,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;SACzC,CAAC,CAAC,CAAA;QACH,MAAM,GAAG,GAAG;YACV,UAAU,EAAE,8BAA8B;YAC1C,EAAE,EAAE,GAAG;YACP,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAA;QACD,IAAA,iBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/introspect.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureIntrospectEndpoint(router: Router, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/introspect.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureIntrospectEndpoint = configureIntrospectEndpoint;
+const router_1 = require("../router");
+const OpenBadgesTokenRepository_1 = require("../../repository/OpenBadgesTokenRepository");
+const OpenBadgesOAuthRepository_1 = require("../../repository/OpenBadgesOAuthRepository");
+const auth_1 = require("../util/auth");
+function configureIntrospectEndpoint(router, module) {
+    router.post(module.config.introspectPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const basic = (0, auth_1.parseBasicAuth)(req) ?? (0, auth_1.parseBodyClientAuth)(req);
+        if (!basic)
+            return (0, router_1.sendError)(res, 401, 'invalid_client', 'Client authentication required');
+        const oauthRepo = agentContext.dependencyManager.resolve(OpenBadgesOAuthRepository_1.OpenBadgesOAuthRepository);
+        const clientRec = await oauthRepo.findByClientId(agentContext, basic.clientId);
+        const reg = clientRec?.clientRegistration || {};
+        if (!clientRec || reg.client_secret !== basic.clientSecret)
+            return (0, router_1.sendError)(res, 401, 'invalid_client', 'Invalid client credentials');
+        const token = String(req.body?.token ?? '');
+        if (!token)
+            return (0, router_1.sendError)(res, 400, 'invalid_request', 'token is required');
+        const tokenRepo = agentContext.dependencyManager.resolve(OpenBadgesTokenRepository_1.OpenBadgesTokenRepository);
+        const t = await tokenRepo.findByToken(agentContext, token);
+        if (!t || t.expiresAt.getTime() < Date.now())
+            return (0, router_1.sendJson)(res, { active: false });
+        return (0, router_1.sendJson)(res, {
+            active: true,
+            client_id: t.clientId,
+            scope: t.scope,
+            sub: t.subject,
+            token_type: t.tokenType,
+            exp: Math.floor(t.expiresAt.getTime() / 1000),
+            iat: Math.floor(t.createdAt.getTime() / 1000),
+        });
+    });
+}
+//# sourceMappingURL=introspect.js.map

package/build/http/endpoints/introspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect.js","sourceRoot":"","sources":["../../../src/http/endpoints/introspect.ts"],"names":[],"mappings":";;AASA,kEA2BC;AAhCD,sCAAkE;AAClE,0FAAsF;AACtF,0FAAsF;AACtF,uCAAkE;AAElE,SAAgB,2BAA2B,CAAC,MAAc,EAAE,MAA4B;IACtF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAChF,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,KAAK,GAAG,IAAA,qBAAc,EAAC,GAAG,CAAC,IAAI,IAAA,0BAAmB,EAAC,GAAG,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAA;QAE1F,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QACnF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC9E,MAAM,GAAG,GAAI,SAAS,EAAE,kBAA0B,IAAI,EAAE,CAAA;QACxD,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY;YACxD,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,4BAA4B,CAAC,CAAA;QAE5E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAA;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,qDAAyB,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE;YACnB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,OAAO;YACd,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAC7C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;SAC9C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/jwks.d.ts

@@ -0,0 +1,3 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+export declare function configureJwksEndpoint(router: Router, config: OpenBadgesHttpModuleConfig): void;

package/build/http/endpoints/jwks.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureJwksEndpoint = configureJwksEndpoint;
+const router_1 = require("../router");
+const OpenBadgesKeyBindingRepository_1 = require("../../repository/OpenBadgesKeyBindingRepository");
+const KeyService_1 = require("../../services/KeyService");
+function base64UrlEncode(buf) {
+    return Buffer.from(buf)
+        .toString('base64')
+        .replace(/=/g, '')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_');
+}
+function configureJwksEndpoint(router, config) {
+    router.get(config.jwksPath, async (req, res) => {
+        const { agentContext } = (0, router_1.getRequestContext)(req);
+        const bindingRepo = agentContext.dependencyManager.resolve(OpenBadgesKeyBindingRepository_1.OpenBadgesKeyBindingRepository);
+        let bindings = [];
+        try {
+            const all = await bindingRepo.getAll(agentContext);
+            bindings = all.filter((b) => b.controller === (config.didWebId || ''));
+        }
+        catch (e) {
+            agentContext.config.logger.warn('[OB][HTTP][JWKS] bindingRepo.getAll failed', { err: e?.message || e });
+            bindings = [];
+        }
+        const keyService = agentContext.dependencyManager.resolve(KeyService_1.KeyService);
+        const jwks = {
+            keys: await (async () => {
+                const out = [];
+                for (const b of bindings) {
+                    try {
+                        const jwk = await keyService.getPublicJwkByVm(agentContext, b.vmId);
+                        if (jwk?.kty === 'OKP' && jwk?.crv === 'Ed25519' && jwk?.x) {
+                            out.push({ kty: 'OKP', crv: 'Ed25519', x: jwk.x, kid: b.vmId, use: 'sig', alg: 'EdDSA' });
+                        }
+                    }
+                    catch { }
+                }
+                return out;
+            })(),
+        };
+        (0, router_1.sendJson)(res, jwks);
+    });
+}
+//# sourceMappingURL=jwks.js.map

package/build/http/endpoints/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../../../src/http/endpoints/jwks.ts"],"names":[],"mappings":";;AAiBA,sDA+BC;AA5CD,sCAAuD;AACvD,oGAAgG;AAChG,0DAAsD;AAGtD,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;SACpB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAc,EAAE,MAAkC;IACtF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QAClE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,+DAA8B,CAAC,CAAA;QAC1F,IAAI,QAAQ,GAAG,EAAW,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAClD,QAAQ,GAAI,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,GAAG,EAAG,CAAS,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAA;YAChH,QAAQ,GAAG,EAAE,CAAA;QACf,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,uBAAU,CAAC,CAAA;QAErE,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;gBACtB,MAAM,GAAG,GAAU,EAAE,CAAA;gBACrB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,GAAG,GAAQ,MAAM,UAAU,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;wBACxE,IAAI,GAAG,EAAE,GAAG,KAAK,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,SAAS,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC;4BAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;wBAC3F,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;gBACZ,CAAC;gBACD,OAAO,GAAG,CAAA;YACZ,CAAC,CAAC,EAAE;SACL,CAAA;QAED,IAAA,iBAAQ,EAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/profile.d.ts

@@ -0,0 +1,4 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+export declare function configureProfileEndpoints(router: Router, config: OpenBadgesHttpModuleConfig, module: OpenBadgesHttpModule): void;

package/build/http/endpoints/profile.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configureProfileEndpoints = configureProfileEndpoints;
+const auth_1 = require("../middleware/auth");
+const router_1 = require("../router");
+const OpenBadgesProfileRepository_1 = require("../../repository/OpenBadgesProfileRepository");
+const OpenBadgesProfileRecord_1 = require("../../repository/OpenBadgesProfileRecord");
+const OB_READ = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/readonly';
+const OB_WRITE = 'https://purl.imsglobal.org/spec/ob/v3p0/scope/replace';
+function configureProfileEndpoints(router, config, module) {
+    // GET profile by subject
+    router.get(config.profilePath, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_READ]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const auth = req.requestContext.auth;
+            const repo = agentContext.dependencyManager.resolve(OpenBadgesProfileRepository_1.OpenBadgesProfileRepository);
+            try {
+                const rec = await repo.findByProfileId(agentContext, auth.subject);
+                if (!rec)
+                    return (0, router_1.sendError)(res, 404, 'not_found', 'Profile not found');
+                return (0, router_1.sendJson)(res, rec.profile);
+            }
+            catch {
+                return (0, router_1.sendError)(res, 404, 'not_found', 'Profile not found');
+            }
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+    // PUT profile
+    router.put(config.profilePath, (0, auth_1.bearerAuth)(module), (0, auth_1.requireScopes)([OB_WRITE]), async (req, res) => {
+        try {
+            const { agentContext } = (0, router_1.getRequestContext)(req);
+            const auth = req.requestContext.auth;
+            const repo = agentContext.dependencyManager.resolve(OpenBadgesProfileRepository_1.OpenBadgesProfileRepository);
+            const body = req.body;
+            if (!body || typeof body !== 'object')
+                return (0, router_1.sendError)(res, 400, 'invalid_request', 'Missing profile body');
+            try {
+                const existing = await repo.findByProfileId(agentContext, auth.subject);
+                if (existing) {
+                    existing.profile = body;
+                    await repo.update(agentContext, existing);
+                    return (0, router_1.sendJson)(res, { updated: true });
+                }
+            }
+            catch { }
+            const rec = new OpenBadgesProfileRecord_1.OpenBadgesProfileRecord({ profileId: auth.subject, profile: body });
+            await repo.save(agentContext, rec);
+            return (0, router_1.sendJson)(res, { created: true }, 201);
+        }
+        catch (e) {
+            return (0, router_1.sendError)(res, 500, 'server_error', e?.message || 'Unexpected error');
+        }
+    });
+}
+//# sourceMappingURL=profile.js.map

package/build/http/endpoints/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/http/endpoints/profile.ts"],"names":[],"mappings":";;AAaA,8DA4CC;AApDD,6CAA8D;AAC9D,sCAAkE;AAClE,8FAA0F;AAC1F,sFAAkF;AAElF,MAAM,OAAO,GAAG,wDAAwD,CAAA;AACxE,MAAM,QAAQ,GAAG,uDAAuD,CAAA;AAExE,SAAgB,yBAAyB,CAAC,MAAc,EAAE,MAAkC,EAAE,MAA4B;IACxH,yBAAyB;IACzB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,iBAAU,EAAC,MAAM,CAAC,EAAE,IAAA,oBAAa,EAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACnH,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAI,GAAG,CAAC,cAAsB,CAAC,IAAI,CAAA;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,yDAA2B,CAAC,CAAA;YAChF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;gBAClE,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAA;gBACtE,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,cAAc;IACd,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAA,iBAAU,EAAC,MAAM,CAAC,EAAE,IAAA,oBAAa,EAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,GAAc,EAAE,GAAa,EAAE,EAAE;QACpH,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAI,GAAG,CAAC,cAAsB,CAAC,IAAI,CAAA;YAC7C,MAAM,IAAI,GAAG,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,yDAA2B,CAAC,CAAA;YAChF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;YACrB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAA;YAE5G,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvE,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAA;oBACvB,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;oBACzC,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YAEV,MAAM,GAAG,GAAG,IAAI,iDAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACnF,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;YAClC,OAAO,IAAA,iBAAQ,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,OAAO,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,OAAO,IAAI,kBAAkB,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/build/http/endpoints/refresh.d.ts

@@ -0,0 +1,15 @@
+import type { Router } from 'express';
+import type { OpenBadgesHttpModuleConfig } from '../OpenBadgesHttpModuleConfig';
+import type { OpenBadgesHttpModule } from '../OpenBadgesHttpModule';
+/**
+ * Credential Refresh Endpoint
+ *
+ * Allows holders to request a refreshed (renewed) version of their credential.
+ * The issuer may update validity dates or other information.
+ *
+ * POST /ims/ob/v3p0/credentials/refresh
+ * Body: { credentialId: string } or the full credential
+ *
+ * Returns: refreshed credential with new proof and updated dates
+ */
+export declare function configureRefreshEndpoint(router: Router, config: OpenBadgesHttpModuleConfig, module: OpenBadgesHttpModule): void;