@atlasauth/backend 0.25.0 → 0.27.0

package/dist/uma.d.ts

@@ -0,0 +1,77 @@
+/**
+ * User-Managed Access 2.0 for a RESOURCE SERVER: register what your users own, ask Atlas for permission tickets,
+ * answer a request without a token with the UMA challenge, and read the permissions of a Requesting Party Token.
+ * Atlas is the authorization server; the protection API needs a Protection API Access Token (PAT), which this
+ * client fetches and refreshes with your confidential client's credentials (client_credentials, scope uma_protection).
+ */
+export declare const UMA_PROTECTION_SCOPE = "uma_protection";
+export interface UmaResourceBody {
+    name: string;
+    type?: string;
+    uri?: string;
+    icon_uri?: string;
+    /** The scopes a requesting party can be granted on this resource. */
+    resource_scopes?: string[];
+    /** The Atlas user id of the resource owner, who can then share it from the hosted account page. */
+    owner?: string;
+    /** A resource-scoped roles resource whose role assignments decide who holds each scope. */
+    rbac_resource_id?: string;
+    /** Let a requesting party with no access ask the owner (the grant answers request_submitted until they decide). */
+    owner_approval?: boolean;
+}
+export interface UmaResource extends UmaResourceBody {
+    _id: string;
+}
+export interface UmaPermission {
+    resource_id: string;
+    resource_scopes: string[];
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+}
+/** The RPT introspection answer (UMA Federated Authorization 5.1.1): no `scope`, with `permissions`. */
+export interface UmaIntrospection {
+    active: boolean;
+    sub?: string;
+    exp?: number;
+    iat?: number;
+    client_id?: string;
+    permissions?: UmaPermission[];
+}
+export declare class UmaProtectionError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export interface UmaProtectionOptions {
+    /** Your Atlas sign-in origin, e.g. `https://auth.example.com`. */
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** For tests or a proxy; defaults to the global fetch. */
+    fetch?: typeof fetch;
+}
+export declare function createUmaProtection(options: UmaProtectionOptions): {
+    /** A Protection API Access Token (cached until shortly before it expires). */
+    getPat: () => Promise<string>;
+    resources: {
+        create: (body: UmaResourceBody) => Promise<{
+            _id: string;
+        }>;
+        list: () => Promise<string[]>;
+        get: (id: string) => Promise<UmaResource>;
+        update: (id: string, body: UmaResourceBody) => Promise<UmaResource>;
+        remove: (id: string) => Promise<void>;
+    };
+    /** Ask for a permission ticket covering one or more resources and scopes. */
+    requestTicket(permissions: Array<{
+        resource_id: string;
+        resource_scopes?: string[];
+    }>): Promise<string>;
+    /** The `WWW-Authenticate` value for a 401 that hands the client a ticket. */
+    challenge(ticket: string, realm?: string): string;
+    /** Introspect a Requesting Party Token with the PAT. */
+    introspect(rpt: string): Promise<UmaIntrospection>;
+};
+/** Whether an introspected RPT grants `scope` on `resourceId` (and has not expired). */
+export declare function umaAllows(introspection: UmaIntrospection, resourceId: string, scope: string, nowSeconds?: number): boolean;

package/dist/uma.js

@@ -0,0 +1,95 @@
+"use strict";
+/**
+ * User-Managed Access 2.0 for a RESOURCE SERVER: register what your users own, ask Atlas for permission tickets,
+ * answer a request without a token with the UMA challenge, and read the permissions of a Requesting Party Token.
+ * Atlas is the authorization server; the protection API needs a Protection API Access Token (PAT), which this
+ * client fetches and refreshes with your confidential client's credentials (client_credentials, scope uma_protection).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UmaProtectionError = exports.UMA_PROTECTION_SCOPE = void 0;
+exports.createUmaProtection = createUmaProtection;
+exports.umaAllows = umaAllows;
+exports.UMA_PROTECTION_SCOPE = 'uma_protection';
+class UmaProtectionError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'UmaProtectionError';
+    }
+}
+exports.UmaProtectionError = UmaProtectionError;
+function createUmaProtection(options) {
+    const issuer = options.issuer.replace(/\/+$/, '');
+    const doFetch = options.fetch ?? fetch;
+    let pat;
+    const getPat = async () => {
+        if (pat && pat.expiresAt - 30_000 > Date.now())
+            return pat.token;
+        const res = await doFetch(`${issuer}/oauth2/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded', authorization: `Basic ${btoa(`${encodeURIComponent(options.clientId)}:${encodeURIComponent(options.clientSecret)}`)}` },
+            body: new URLSearchParams({ grant_type: 'client_credentials', scope: exports.UMA_PROTECTION_SCOPE }).toString(),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok || !body.access_token)
+            throw new UmaProtectionError(res.status, body.error ?? 'invalid_client', body.error_description ?? 'Could not obtain a Protection API Access Token.');
+        pat = { token: body.access_token, expiresAt: Date.now() + (body.expires_in ?? 3600) * 1000 };
+        return pat.token;
+    };
+    const call = async (method, path, body) => {
+        const res = await doFetch(`${issuer}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${await getPat()}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        if (res.status === 204)
+            return undefined;
+        const data = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            if (res.status === 401)
+                pat = undefined;
+            throw new UmaProtectionError(res.status, data.error ?? data.errors?.[0]?.code ?? 'error', data.message ?? data.errors?.[0]?.message ?? 'The protection API refused the request.');
+        }
+        return data;
+    };
+    return {
+        /** A Protection API Access Token (cached until shortly before it expires). */
+        getPat,
+        resources: {
+            create: (body) => call('POST', '/oauth2/uma/resource_set', body),
+            list: () => call('GET', '/oauth2/uma/resource_set'),
+            get: (id) => call('GET', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`),
+            update: (id, body) => call('PUT', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`, body),
+            remove: (id) => call('DELETE', `/oauth2/uma/resource_set/${encodeURIComponent(id)}`),
+        },
+        /** Ask for a permission ticket covering one or more resources and scopes. */
+        async requestTicket(permissions) {
+            return (await call('POST', '/oauth2/uma/permission', permissions)).ticket;
+        },
+        /** The `WWW-Authenticate` value for a 401 that hands the client a ticket. */
+        challenge(ticket, realm = 'uma') {
+            return `UMA realm="${realm}", as_uri="${issuer}", ticket="${ticket}"`;
+        },
+        /** Introspect a Requesting Party Token with the PAT. */
+        async introspect(rpt) {
+            const res = await doFetch(`${issuer}/oauth2/introspect`, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${await getPat()}`, 'content-type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({ token: rpt }).toString(),
+            });
+            if (!res.ok)
+                throw new UmaProtectionError(res.status, 'introspection_failed', 'Introspection was refused.');
+            return (await res.json());
+        },
+    };
+}
+/** Whether an introspected RPT grants `scope` on `resourceId` (and has not expired). */
+function umaAllows(introspection, resourceId, scope, nowSeconds = Math.floor(Date.now() / 1000)) {
+    if (!introspection.active)
+        return false;
+    return (introspection.permissions ?? []).some((p) => p.resource_id === resourceId && p.resource_scopes.includes(scope) && (p.exp ?? introspection.exp ?? Infinity) > nowSeconds && (p.nbf ?? 0) <= nowSeconds);
+}
+//# sourceMappingURL=uma.js.map

package/dist/uma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uma.js","sourceRoot":"","sources":["../src/uma.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA6DH,kDA8DC;AAGD,8BAKC;AAjIY,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAuCrD,MAAa,kBAAmB,SAAQ,KAAK;IAEhC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AATD,gDASC;AAWD,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,IAAI,GAAqD,CAAC;IAE1D,MAAM,MAAM,GAAG,KAAK,IAAqB,EAAE;QACzC,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,eAAe,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE;YACvL,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,4BAAoB,EAAE,CAAC,CAAC,QAAQ,EAAE;SACxG,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA+F,CAAC;QAChJ,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,IAAI,iDAAiD,CAAC,CAAC;QACzL,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7F,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,KAAK,EAAK,MAAc,EAAE,IAAY,EAAE,IAAc,EAAc,EAAE;QACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YAC5C,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,EAAE;YAC7H,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC5D,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA8F,CAAC;QAC/I,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,GAAG,GAAG,SAAS,CAAC;YACxC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,yCAAyC,CAAC,CAAC;QACpL,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL,8EAA8E;QAC9E,MAAM;QACN,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAqB,EAA4B,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,0BAA0B,EAAE,IAAI,CAAC;YAC3G,IAAI,EAAE,GAAsB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC;YACtE,GAAG,EAAE,CAAC,EAAU,EAAwB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5G,MAAM,EAAE,CAAC,EAAU,EAAE,IAAqB,EAAwB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC;YAC5I,MAAM,EAAE,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,4BAA4B,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;SAC5G;QACD,6EAA6E;QAC7E,KAAK,CAAC,aAAa,CAAC,WAAuE;YACzF,OAAO,CAAC,MAAM,IAAI,CAAqB,MAAM,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,CAAC;QACD,6EAA6E;QAC7E,SAAS,CAAC,MAAc,EAAE,KAAK,GAAG,KAAK;YACrC,OAAO,cAAc,KAAK,cAAc,MAAM,cAAc,MAAM,GAAG,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,UAAU,CAAC,GAAW;YAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAC3G,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;YAC5G,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,SAAgB,SAAS,CAAC,aAA+B,EAAE,UAAkB,EAAE,KAAa,EAAE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACtI,IAAI,CAAC,aAAa,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,aAAa,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,UAAU,CAChK,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
@@ -8,7 +8,7 @@
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
     "@noble/curves": "^1.9.1",
-    "@atlasauth/authz": "0.2.0",
+    "@atlasauth/authz": "0.3.0",
     "@atlasauth/pca": "0.1.0"
   },
   "devDependencies": {