@ddd-ts-kit/auth 0.0.0-stage → 0.1.0

package/dist/errors/missing-actor-error.js

@@ -0,0 +1,8 @@
+/** A protected command or query was sent without its actor. A programming error, not a refusal. */
+export class MissingActorError extends Error {
+    constructor(info) {
+        super(`The ${info.kind} ${info.name} requires a permission but carries no actor. Extend AuthorizedCommand or AuthorizedQuery.`);
+        this.name = 'MissingActorError';
+    }
+}
+//# sourceMappingURL=missing-actor-error.js.map

package/dist/errors/missing-actor-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missing-actor-error.js","sourceRoot":"","sources":["../../src/errors/missing-actor-error.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,IAAiB;QAC3B,KAAK,CACH,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,2FAA2F,CACzH,CAAC;QAEF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF"}

package/dist/errors/unauthenticated-error.d.ts

@@ -0,0 +1,12 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+/**
+ * The code `UnauthorizedError` of @ddd-ts-kit/http carries, so its default error mapping
+ * answers 401 for the errors of this package with no extra wiring.
+ */
+export declare const UNAUTHORIZED = "UNAUTHORIZED";
+/** Nobody is authenticated and the use case is not public. */
+export declare class UnauthenticatedError extends DomainError {
+    readonly code = "UNAUTHORIZED";
+    constructor();
+}
+//# sourceMappingURL=unauthenticated-error.d.ts.map

package/dist/errors/unauthenticated-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthenticated-error.d.ts","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,8DAA8D;AAC9D,qBAAa,oBAAqB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,kBAAgB;IAE7B,cAEC;CACF"}

package/dist/errors/unauthenticated-error.js

@@ -0,0 +1,14 @@
+import { DomainError } from '@ddd-ts-kit/kernel';
+/**
+ * The code `UnauthorizedError` of @ddd-ts-kit/http carries, so its default error mapping
+ * answers 401 for the errors of this package with no extra wiring.
+ */
+export const UNAUTHORIZED = 'UNAUTHORIZED';
+/** Nobody is authenticated and the use case is not public. */
+export class UnauthenticatedError extends DomainError {
+    code = UNAUTHORIZED;
+    constructor() {
+        super('Authentication is required');
+    }
+}
+//# sourceMappingURL=unauthenticated-error.js.map

package/dist/errors/unauthenticated-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unauthenticated-error.js","sourceRoot":"","sources":["../../src/errors/unauthenticated-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,8DAA8D;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,WAAW;IAC1C,IAAI,GAAG,YAAY,CAAC;IAE7B;QACE,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACtC,CAAC;CACF"}

package/dist/errors/undeclared-use-case-error.d.ts

@@ -0,0 +1,9 @@
+import type { MessageInfo } from '@ddd-ts-kit/kernel';
+/**
+ * A command or query reached the bus without `requires` or `publicUseCase`. A programming
+ * error, not a refusal: it must fail a test, never be answered as a 403.
+ */
+export declare class UndeclaredUseCaseError extends Error {
+    constructor(info: MessageInfo);
+}
+//# sourceMappingURL=undeclared-use-case-error.d.ts.map

package/dist/errors/undeclared-use-case-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"undeclared-use-case-error.d.ts","sourceRoot":"","sources":["../../src/errors/undeclared-use-case-error.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,IAAI,EAAE,WAAW,EAM5B;CACF"}

package/dist/errors/undeclared-use-case-error.js

@@ -0,0 +1,11 @@
+/**
+ * A command or query reached the bus without `requires` or `publicUseCase`. A programming
+ * error, not a refusal: it must fail a test, never be answered as a 403.
+ */
+export class UndeclaredUseCaseError extends Error {
+    constructor(info) {
+        super(`The ${info.kind} ${info.name} declares no access. Declare it with requires(${info.name}, permission) or publicUseCase(${info.name}).`);
+        this.name = 'UndeclaredUseCaseError';
+    }
+}
+//# sourceMappingURL=undeclared-use-case-error.js.map

package/dist/errors/undeclared-use-case-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"undeclared-use-case-error.js","sourceRoot":"","sources":["../../src/errors/undeclared-use-case-error.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,IAAiB;QAC3B,KAAK,CACH,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,iDAAiD,IAAI,CAAC,IAAI,kCAAkC,IAAI,CAAC,IAAI,IAAI,CACvI,CAAC;QAEF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,51 @@
+export { AuthorizationSetupError } from './errors/authorization-setup-error.js';
+export { FORBIDDEN, ForbiddenError } from './errors/forbidden-error.js';
+export { InvalidCredentialError } from './errors/invalid-credential-error.js';
+export { ListingNotSupportedError } from './errors/listing-not-supported-error.js';
+export { MissingActorError } from './errors/missing-actor-error.js';
+export { UNAUTHORIZED, UnauthenticatedError } from './errors/unauthenticated-error.js';
+export { UndeclaredUseCaseError } from './errors/undeclared-use-case-error.js';
+export { definePermissions, type PermissionDeclaration, type PermissionSet } from './permissions/define-permissions.js';
+export type { Grant } from './permissions/grant.js';
+export { isPermission } from './permissions/is-permission.js';
+export type { Permission } from './permissions/permission.js';
+export { PermissionRegistry } from './permissions/permission-registry.js';
+export { Access } from './authorization/access.js';
+export type { AccessScope } from './authorization/access-scope.js';
+export type { AuthorizationContext } from './authorization/authorization-context.js';
+export { Authorizer } from './authorization/authorizer.js';
+export type { CheckRequest } from './authorization/check-request.js';
+export { ALLOWED, deny, type Decision } from './authorization/decision.js';
+export type { DecisionRecord } from './authorization/decision-record.js';
+export { DenialReason } from './authorization/denial-reason.js';
+export { isResourceRef } from './authorization/is-resource-ref.js';
+export type { ListRequest } from './authorization/list-request.js';
+export type { OnDecision } from './authorization/on-decision.js';
+export type { ResourceRef } from './authorization/resource-ref.js';
+export { AuthorizationMap } from './use-cases/authorization-map.js';
+export { authorizationMiddleware, type AuthorizationMiddlewareOptions } from './use-cases/authorization-middleware.js';
+export { publicUseCase } from './use-cases/public-use-case.js';
+export { requires, type RequirementOptions } from './use-cases/requires.js';
+export type { ProtectedUseCase, PublicUseCase, UseCaseDeclaration } from './use-cases/use-case-declaration.js';
+export { definePolicy } from './policies/define-policy.js';
+export type { Policy } from './policies/policy.js';
+export { NO_POLICY, PolicyAccess, type PolicyAccessOptions } from './policies/policy-access.js';
+export type { PolicyContext } from './policies/policy-context.js';
+export { RoleBasedAuthorizer, type RoleBasedAuthorizerOptions } from './rbac/role-based-authorizer.js';
+export { tenantOfContext } from './rbac/tenant-of-context.js';
+export { forbid, permit, type AttributePolicy } from './abac/attribute-policy.js';
+export { allOf, anyOf, not, type Condition } from './abac/condition.js';
+export { PolicyBasedAuthorizer, type PolicyBasedAuthorizerOptions } from './abac/policy-based-authorizer.js';
+export type { PolicyInput } from './abac/policy-input.js';
+export type { ResourceAttributeValues } from './abac/resource-attribute-values.js';
+export { ResourceAttributes } from './abac/resource-attributes.js';
+export { actorOf } from './authentication/actor-of.js';
+export { Authenticator } from './authentication/authenticator.js';
+export { bearerCredential } from './authentication/bearer-credential.js';
+export type { HeaderValues } from './authentication/header-values.js';
+export { inActorContext } from './authentication/in-actor-context.js';
+export { principalResolver } from './authentication/principal-resolver.js';
+export { resolveSession } from './authentication/resolve-session.js';
+export { SessionAuthenticator } from './authentication/session-authenticator.js';
+export { sessionOf } from './authentication/session-of.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACxH,YAAY,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACnD,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,YAAY,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAC3E,YAAY,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,KAAK,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,YAAY,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAChG,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,KAAK,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,KAAK,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AAC7G,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,YAAY,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/index.js

@@ -0,0 +1,36 @@
+export { AuthorizationSetupError } from './errors/authorization-setup-error.js';
+export { FORBIDDEN, ForbiddenError } from './errors/forbidden-error.js';
+export { InvalidCredentialError } from './errors/invalid-credential-error.js';
+export { ListingNotSupportedError } from './errors/listing-not-supported-error.js';
+export { MissingActorError } from './errors/missing-actor-error.js';
+export { UNAUTHORIZED, UnauthenticatedError } from './errors/unauthenticated-error.js';
+export { UndeclaredUseCaseError } from './errors/undeclared-use-case-error.js';
+export { definePermissions } from './permissions/define-permissions.js';
+export { isPermission } from './permissions/is-permission.js';
+export { PermissionRegistry } from './permissions/permission-registry.js';
+export { Access } from './authorization/access.js';
+export { Authorizer } from './authorization/authorizer.js';
+export { ALLOWED, deny } from './authorization/decision.js';
+export { DenialReason } from './authorization/denial-reason.js';
+export { isResourceRef } from './authorization/is-resource-ref.js';
+export { AuthorizationMap } from './use-cases/authorization-map.js';
+export { authorizationMiddleware } from './use-cases/authorization-middleware.js';
+export { publicUseCase } from './use-cases/public-use-case.js';
+export { requires } from './use-cases/requires.js';
+export { definePolicy } from './policies/define-policy.js';
+export { NO_POLICY, PolicyAccess } from './policies/policy-access.js';
+export { RoleBasedAuthorizer } from './rbac/role-based-authorizer.js';
+export { tenantOfContext } from './rbac/tenant-of-context.js';
+export { forbid, permit } from './abac/attribute-policy.js';
+export { allOf, anyOf, not } from './abac/condition.js';
+export { PolicyBasedAuthorizer } from './abac/policy-based-authorizer.js';
+export { ResourceAttributes } from './abac/resource-attributes.js';
+export { actorOf } from './authentication/actor-of.js';
+export { Authenticator } from './authentication/authenticator.js';
+export { bearerCredential } from './authentication/bearer-credential.js';
+export { inActorContext } from './authentication/in-actor-context.js';
+export { principalResolver } from './authentication/principal-resolver.js';
+export { resolveSession } from './authentication/resolve-session.js';
+export { SessionAuthenticator } from './authentication/session-authenticator.js';
+export { sessionOf } from './authentication/session-of.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAkD,MAAM,qCAAqC,CAAC;AAExH,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAiB,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAInE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAuC,MAAM,yCAAyC,CAAC;AACvH,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAA2B,MAAM,yBAAyB,CAAC;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAA4B,MAAM,6BAA6B,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAmC,MAAM,iCAAiC,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,EAAwB,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAkB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAqC,MAAM,mCAAmC,CAAC;AAG7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/jwt/claims.d.ts

@@ -0,0 +1,3 @@
+/** The verified payload of a token, as plain data. */
+export type Claims = Readonly<Record<string, unknown>>;
+//# sourceMappingURL=claims.d.ts.map

package/dist/jwt/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../src/jwt/claims.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,MAAM,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/jwt/claims.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=claims.js.map

package/dist/jwt/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../src/jwt/claims.ts"],"names":[],"mappings":""}

package/dist/jwt/is-service-account.d.ts

@@ -0,0 +1,3 @@
+import type { Claims } from './claims.js';
+export declare function isServiceAccount(claims: Claims): boolean;
+//# sourceMappingURL=is-service-account.d.ts.map

package/dist/jwt/is-service-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-service-account.d.ts","sourceRoot":"","sources":["../../src/jwt/is-service-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAK1C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAIxD"}

package/dist/jwt/is-service-account.js

@@ -0,0 +1,7 @@
+/** Keycloak names the user that stands for a client `service-account-<client id>`. */
+const SERVICE_ACCOUNT_PREFIX = 'service-account-';
+export function isServiceAccount(claims) {
+    const username = claims['preferred_username'];
+    return typeof username === 'string' && username.startsWith(SERVICE_ACCOUNT_PREFIX);
+}
+//# sourceMappingURL=is-service-account.js.map

package/dist/jwt/is-service-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-service-account.js","sourceRoot":"","sources":["../../src/jwt/is-service-account.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAElD,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE9C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AACrF,CAAC"}

package/dist/jwt/jwt-authenticator.d.ts

@@ -0,0 +1,45 @@
+import { type Actor, type AuthenticationMethod, type Session, type SessionExtensionValues } from '@ddd-ts-kit/kernel';
+import { type JWTPayload, type KeyInput } from 'jose';
+import type { SessionAuthenticator } from '../authentication/session-authenticator.js';
+interface CommonOptions {
+    readonly issuer: string;
+    readonly audience: string | readonly string[];
+    /** Default: the asymmetric families RS256, PS256, ES256 and EdDSA. A shared secret needs HS256 said. */
+    readonly algorithms?: readonly string[];
+    /** Seconds of clock difference tolerated on `exp` and `nbf`. Default 0. */
+    readonly clockTolerance?: number;
+    /** The claim holding the tenant of the default mapping. Default `tenant_id`. */
+    readonly tenantClaim?: string;
+    /** Replaces the default mapping. Must not keep the token: an actor is plain, loggable data. */
+    readonly toActor?: (claims: JWTPayload) => Actor;
+    /**
+     * The claim naming who acts as the subject: the id itself, or an object holding it under
+     * `sub` or `id`. Default `act`, the actor claim of RFC 8693.
+     */
+    readonly impersonatorClaim?: string;
+    /** Default: `password` when `amr` lists `pwd`, `token` otherwise. */
+    readonly authenticationMethod?: AuthenticationMethod | ((claims: JWTPayload) => AuthenticationMethod);
+    /** The fields of the project under `session.extensions`. Must not keep the token either. */
+    readonly toSessionExtensions?: (claims: JWTPayload) => SessionExtensionValues;
+}
+export type JwtAuthenticatorOptions = CommonOptions & ({
+    readonly jwksUri: string;
+} | {
+    readonly key: KeyInput;
+});
+/**
+ * Verifies a signed JWT (signature, issuer, audience, expiry, algorithm allow-list) and maps
+ * its claims to an actor and to its session. An unsigned token (`alg: none`) is always refused.
+ *
+ * The session reads registered claims: id from `sid`, else `jti`, else the subject and issue
+ * instant; `issuedAt` and `expiresAt` from `iat` and `exp`; the method and strength from `amr`
+ * and `acr`; `impersonatedBy` from `act`; `locale` and `timeZone` from `locale` and `zoneinfo`.
+ */
+export declare class JwtAuthenticator implements SessionAuthenticator {
+    private readonly sessionOfToken;
+    constructor(options: JwtAuthenticatorOptions);
+    authenticate(credential: string | undefined): Promise<Actor>;
+    authenticateSession(credential: string | undefined): Promise<Session>;
+}
+export {};
+//# sourceMappingURL=jwt-authenticator.d.ts.map

package/dist/jwt/jwt-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-authenticator.d.ts","sourceRoot":"","sources":["../../src/jwt/jwt-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,KAAK,EACV,KAAK,oBAAoB,EACzB,KAAK,OAAO,EACZ,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAyC,KAAK,UAAU,EAAwB,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AACnH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAIvF,UAAU,aAAa;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC9C,wGAAwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,KAAK,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,qEAAqE;IACrE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,KAAK,oBAAoB,CAAC,CAAC;IACtG,4FAA4F;IAC5F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,sBAAsB,CAAC;CAC/E;AAED,MAAM,MAAM,uBAAuB,GAAG,aAAa,GACjD,CACI;IAAkE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5F;IAA0C,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAA;CAAE,CACrE,CAAC;AAIJ;;;;;;;GAOG;AACH,qBAAa,gBAAiB,YAAW,oBAAoB;IAK3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAE/C,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAEK,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAEjE;IAEK,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1E;CACF"}

package/dist/jwt/jwt-authenticator.js

@@ -0,0 +1,109 @@
+import { anonymousSession, } from '@ddd-ts-kit/kernel';
+import { createRemoteJWKSet, errors, jwtVerify } from 'jose';
+import { InvalidCredentialError } from '../errors/invalid-credential-error.js';
+import { sessionOfClaims } from './session-of-claims.js';
+/**
+ * Verifies a signed JWT (signature, issuer, audience, expiry, algorithm allow-list) and maps
+ * its claims to an actor and to its session. An unsigned token (`alg: none`) is always refused.
+ *
+ * The session reads registered claims: id from `sid`, else `jti`, else the subject and issue
+ * instant; `issuedAt` and `expiresAt` from `iat` and `exp`; the method and strength from `amr`
+ * and `acr`; `impersonatedBy` from `act`; `locale` and `timeZone` from `locale` and `zoneinfo`.
+ */
+export class JwtAuthenticator {
+    /*
+     * The verification key, which may be a shared secret, is held by this function and by
+     * nothing else: an authenticator that is logged, spread or serialized shows no key.
+     */
+    sessionOfToken;
+    constructor(options) {
+        this.sessionOfToken = sessionReaderOf(options);
+    }
+    async authenticate(credential) {
+        return (await this.authenticateSession(credential)).actor;
+    }
+    async authenticateSession(credential) {
+        return credential === undefined ? anonymousSession() : this.sessionOfToken(credential);
+    }
+}
+const DEFAULT_TENANT_CLAIM = 'tenant_id';
+function sessionReaderOf(options) {
+    const key = 'jwksUri' in options ? createRemoteJWKSet(new URL(options.jwksUri)) : options.key;
+    const tenantClaim = options.tenantClaim ?? DEFAULT_TENANT_CLAIM;
+    const toActor = options.toActor ?? ((claims) => actorOfClaims(claims, tenantClaim));
+    return async (token) => {
+        const claims = await verifiedClaims(token, key, options);
+        return sessionOfClaims(claims, toActor(claims), options);
+    };
+}
+const DEFAULT_ALGORITHMS = ['RS256', 'PS256', 'ES256', 'EdDSA'];
+async function verifiedClaims(token, key, options) {
+    const { issuer, audience, algorithms = DEFAULT_ALGORITHMS, clockTolerance = 0 } = options;
+    try {
+        const { payload } = await jwtVerify(token, key, {
+            issuer,
+            audience: [...[audience].flat()],
+            algorithms: [...algorithms],
+            clockTolerance,
+        });
+        return payload;
+    }
+    catch (error) {
+        throw refusalOf(error);
+    }
+}
+/** Why a token was refused, by error code of the verification library. */
+const REASONS = {
+    ERR_JWT_EXPIRED: 'TOKEN_EXPIRED',
+    ERR_JWT_CLAIM_VALIDATION_FAILED: 'CLAIM_MISMATCH',
+    ERR_JWS_SIGNATURE_VERIFICATION_FAILED: 'BAD_SIGNATURE',
+    ERR_JOSE_ALG_NOT_ALLOWED: 'ALGORITHM_NOT_ALLOWED',
+    ERR_JOSE_NOT_SUPPORTED: 'UNSUPPORTED_TOKEN',
+    ERR_JWKS_NO_MATCHING_KEY: 'UNKNOWN_KEY',
+    ERR_JWS_INVALID: 'MALFORMED_TOKEN',
+    ERR_JWT_INVALID: 'MALFORMED_TOKEN',
+};
+/**
+ * A refused token is an `InvalidCredentialError`; anything else (the key set cannot be fetched)
+ * is an infrastructure fault and stays what it is, to be answered as a 5xx.
+ */
+function refusalOf(error) {
+    if (!(error instanceof errors.JOSEError)) {
+        return error;
+    }
+    const reason = REASONS[error.code];
+    return reason === undefined ? error : new InvalidCredentialError(reason);
+}
+function actorOfClaims(claims, tenantClaim) {
+    if (claims.sub === undefined || claims.sub === '') {
+        throw new InvalidCredentialError('NO_SUBJECT');
+    }
+    const tenantId = claims[tenantClaim];
+    return {
+        id: claims.sub,
+        type: 'user',
+        ...(typeof tenantId === 'string' ? { tenantId } : {}),
+        roles: rolesOf(claims),
+        attributes: {},
+    };
+}
+/**
+ * The first claim present wins, in the order realm roles (`realm_access.roles`), a `roles`
+ * claim, OAuth scopes. They are never merged: a scope a client asked for must not pass for a role.
+ */
+function rolesOf(claims) {
+    const realmAccess = claims['realm_access'];
+    const realmRoles = typeof realmAccess === 'object' && realmAccess !== null && 'roles' in realmAccess ? realmAccess.roles : undefined;
+    const candidates = [stringsOf(realmRoles), stringsOf(claims['roles']), stringsOf(claims['scope'])];
+    return candidates.find((roles) => roles !== undefined) ?? [];
+}
+function stringsOf(claim) {
+    if (typeof claim === 'string') {
+        return claim.split(' ').filter((item) => item !== '');
+    }
+    if (!Array.isArray(claim)) {
+        return undefined;
+    }
+    return claim.filter((item) => typeof item === 'string');
+}
+//# sourceMappingURL=jwt-authenticator.js.map

package/dist/jwt/jwt-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-authenticator.js","sourceRoot":"","sources":["../../src/jwt/jwt-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAKjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAwD,MAAM,MAAM,CAAC;AAEnH,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAgCzD;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IAC3B;;;OAGG;IACc,cAAc,CAAgB;IAE/C,YAAY,OAAgC;QAC1C,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA8B;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,UAA8B;QACtD,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACzF,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC,SAAS,eAAe,CAAC,OAAgC;IACvD,MAAM,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAkB,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAEhG,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAEzD,OAAO,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEhE,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,GAA+B,EAC/B,OAAgC;IAEhC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,cAAc,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;YAC9C,MAAM;YACN,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC;YAC3B,cAAc;SACf,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,GAAqC;IAChD,eAAe,EAAE,eAAe;IAChC,+BAA+B,EAAE,gBAAgB;IACjD,qCAAqC,EAAE,eAAe;IACtD,wBAAwB,EAAE,uBAAuB;IACjD,sBAAsB,EAAE,mBAAmB;IAC3C,wBAAwB,EAAE,aAAa;IACvC,eAAe,EAAE,iBAAiB;IAClC,eAAe,EAAE,iBAAiB;CACnC,CAAC;AAEF;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,CAAC,KAAK,YAAY,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEnC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB,EAAE,WAAmB;IAC5D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAErC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG;QACd,IAAI,EAAE,MAAM;QACZ,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,MAAkB;IACjC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAE3C,MAAM,UAAU,GACd,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpH,MAAM,UAAU,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnG,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC"}

package/dist/jwt/keycloak-actor-of.d.ts

@@ -0,0 +1,6 @@
+import type { Actor } from '@ddd-ts-kit/kernel';
+import type { Claims } from './claims.js';
+import type { KeycloakClaimOptions } from './keycloak-claim-options.js';
+/** The actor of an access token issued by Keycloak. The token itself is never kept. */
+export declare function keycloakActorOf(claims: Claims, options: KeycloakClaimOptions): Actor;
+//# sourceMappingURL=keycloak-actor-of.d.ts.map

package/dist/jwt/keycloak-actor-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-actor-of.d.ts","sourceRoot":"","sources":["../../src/jwt/keycloak-actor-of.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAkB,MAAM,oBAAoB,CAAC;AAEhE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKxE,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,KAAK,CAgBpF"}

package/dist/jwt/keycloak-actor-of.js

@@ -0,0 +1,56 @@
+import { InvalidCredentialError } from '../errors/invalid-credential-error.js';
+import { isServiceAccount } from './is-service-account.js';
+const DEFAULT_TENANT_CLAIM = 'tenant_id';
+const DEFAULT_GROUPS_CLAIM = 'groups';
+/** The actor of an access token issued by Keycloak. The token itself is never kept. */
+export function keycloakActorOf(claims, options) {
+    const id = claims['sub'];
+    if (typeof id !== 'string' || id === '') {
+        throw new InvalidCredentialError('NO_SUBJECT');
+    }
+    const tenantId = tenantOf(claims[options.tenantClaim ?? DEFAULT_TENANT_CLAIM]);
+    return {
+        id,
+        type: isServiceAccount(claims) ? 'service' : 'user',
+        ...(tenantId === undefined ? {} : { tenantId }),
+        roles: rolesOf(claims, options.clientId),
+        attributes: attributesOf(claims, options.groupsClaim ?? DEFAULT_GROUPS_CLAIM),
+    };
+}
+/**
+ * A text claim is the tenant. The `organization` claim lists the organizations of the user, as
+ * a list of aliases or as an object keyed by alias: it names a tenant only when there is
+ * exactly one, since choosing among several is a decision of the project.
+ */
+function tenantOf(claim) {
+    if (typeof claim === 'string') {
+        return claim === '' ? undefined : claim;
+    }
+    if (typeof claim !== 'object' || claim === null) {
+        return undefined;
+    }
+    const candidates = Array.isArray(claim) ? claim : Object.keys(claim);
+    const [only] = candidates;
+    return candidates.length === 1 && typeof only === 'string' ? only : undefined;
+}
+function rolesOf(claims, clientId) {
+    const realmRoles = stringsOf(recordOf(claims['realm_access'])['roles']);
+    const access = clientId === undefined ? {} : recordOf(recordOf(claims['resource_access'])[clientId]);
+    return [...new Set([...realmRoles, ...stringsOf(access['roles'])])];
+}
+function stringsOf(claim) {
+    return Array.isArray(claim) ? claim.filter((item) => typeof item === 'string') : [];
+}
+function recordOf(claim) {
+    return typeof claim === 'object' && claim !== null ? { ...claim } : {};
+}
+function attributesOf(claims, groupsClaim) {
+    const username = claims['preferred_username'];
+    const email = claims['email'];
+    return {
+        ...(typeof username === 'string' ? { username } : {}),
+        ...(typeof email === 'string' ? { email } : {}),
+        ...(groupsClaim in claims ? { groups: stringsOf(claims[groupsClaim]) } : {}),
+    };
+}
+//# sourceMappingURL=keycloak-actor-of.js.map

package/dist/jwt/keycloak-actor-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-actor-of.js","sourceRoot":"","sources":["../../src/jwt/keycloak-actor-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAEtC,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAA6B;IAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC,CAAC;IAE/E,OAAO;QACL,EAAE;QACF,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;QACnD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC;QACxC,UAAU,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAuB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAE1B,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,QAA4B;IAC3D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,WAAmB;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAE9B,OAAO;QACL,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC"}

package/dist/jwt/keycloak-authentication-method.d.ts

@@ -0,0 +1,5 @@
+import type { AuthenticationMethod } from '@ddd-ts-kit/kernel';
+import type { Claims } from './claims.js';
+/** A person signs in through the single sign-on of the realm; a client presents its own secret. */
+export declare function keycloakAuthenticationMethod(claims: Claims): AuthenticationMethod;
+//# sourceMappingURL=keycloak-authentication-method.d.ts.map

package/dist/jwt/keycloak-authentication-method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-authentication-method.d.ts","sourceRoot":"","sources":["../../src/jwt/keycloak-authentication-method.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,mGAAmG;AACnG,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CAEjF"}

package/dist/jwt/keycloak-authentication-method.js

@@ -0,0 +1,6 @@
+import { isServiceAccount } from './is-service-account.js';
+/** A person signs in through the single sign-on of the realm; a client presents its own secret. */
+export function keycloakAuthenticationMethod(claims) {
+    return isServiceAccount(claims) ? 'service' : 'sso';
+}
+//# sourceMappingURL=keycloak-authentication-method.js.map

package/dist/jwt/keycloak-authentication-method.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-authentication-method.js","sourceRoot":"","sources":["../../src/jwt/keycloak-authentication-method.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,mGAAmG;AACnG,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACtD,CAAC"}

package/dist/jwt/keycloak-authenticator.d.ts

@@ -0,0 +1,23 @@
+import type { SessionExtensionValues } from '@ddd-ts-kit/kernel';
+import type { JWTPayload } from 'jose';
+import { JwtAuthenticator } from './jwt-authenticator.js';
+import type { KeycloakClaimOptions } from './keycloak-claim-options.js';
+export interface KeycloakAuthenticatorOptions extends KeycloakClaimOptions {
+    /** Where Keycloak is served, without the realm: `https://id.example.com`. */
+    readonly baseUrl: string;
+    readonly realm: string;
+    /** What the `aud` claim must name: this API, as the audience mapper of the realm writes it. */
+    readonly audience: string | readonly string[];
+    readonly algorithms?: readonly string[];
+    readonly clockTolerance?: number;
+    /** Default `act`. See the README for the session note of an administrator impersonating a user. */
+    readonly impersonatorClaim?: string;
+    readonly toSessionExtensions?: (claims: JWTPayload) => SessionExtensionValues;
+}
+/**
+ * A `JwtAuthenticator` for the access tokens of a Keycloak realm: issuer and key set derived
+ * from the realm, realm roles and the roles of `clientId` as `roles`, `preferred_username`,
+ * `email` and `groups` as attributes, `sid` as session id.
+ */
+export declare function keycloakAuthenticator(options: KeycloakAuthenticatorOptions): JwtAuthenticator;
+//# sourceMappingURL=keycloak-authenticator.d.ts.map

package/dist/jwt/keycloak-authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-authenticator.d.ts","sourceRoot":"","sources":["../../src/jwt/keycloak-authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGxE,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,mGAAmG;IACnG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,sBAAsB,CAAC;CAC/E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,gBAAgB,CAe7F"}

package/dist/jwt/keycloak-authenticator.js

@@ -0,0 +1,25 @@
+import { JwtAuthenticator } from './jwt-authenticator.js';
+import { keycloakActorOf } from './keycloak-actor-of.js';
+import { keycloakAuthenticationMethod } from './keycloak-authentication-method.js';
+import { withoutTrailingSlashes } from './without-trailing-slashes.js';
+/**
+ * A `JwtAuthenticator` for the access tokens of a Keycloak realm: issuer and key set derived
+ * from the realm, realm roles and the roles of `clientId` as `roles`, `preferred_username`,
+ * `email` and `groups` as attributes, `sid` as session id.
+ */
+export function keycloakAuthenticator(options) {
+    const { baseUrl, realm, audience, algorithms, clockTolerance, impersonatorClaim, toSessionExtensions } = options;
+    const issuer = `${withoutTrailingSlashes(baseUrl)}/realms/${encodeURIComponent(realm)}`;
+    return new JwtAuthenticator({
+        issuer,
+        audience,
+        jwksUri: `${issuer}/protocol/openid-connect/certs`,
+        toActor: (claims) => keycloakActorOf(claims, options),
+        authenticationMethod: keycloakAuthenticationMethod,
+        ...(algorithms === undefined ? {} : { algorithms }),
+        ...(clockTolerance === undefined ? {} : { clockTolerance }),
+        ...(impersonatorClaim === undefined ? {} : { impersonatorClaim }),
+        ...(toSessionExtensions === undefined ? {} : { toSessionExtensions }),
+    });
+}
+//# sourceMappingURL=keycloak-authenticator.js.map

package/dist/jwt/keycloak-authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-authenticator.js","sourceRoot":"","sources":["../../src/jwt/keycloak-authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAevE;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAqC;IACzE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC;IACjH,MAAM,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAExF,OAAO,IAAI,gBAAgB,CAAC;QAC1B,MAAM;QACN,QAAQ;QACR,OAAO,EAAE,GAAG,MAAM,gCAAgC;QAClD,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC;QACrD,oBAAoB,EAAE,4BAA4B;QAClD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;QACjE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACtE,CAAC,CAAC;AACL,CAAC"}

package/dist/jwt/keycloak-claim-options.d.ts

@@ -0,0 +1,9 @@
+export interface KeycloakClaimOptions {
+    /** The client whose roles (`resource_access.<clientId>.roles`) join the realm roles. */
+    readonly clientId?: string;
+    /** The claim holding the tenant. Default `tenant_id`; `organization` reads the organization of the user. */
+    readonly tenantClaim?: string;
+    /** The claim written by the group membership mapper. Default `groups`. */
+    readonly groupsClaim?: string;
+}
+//# sourceMappingURL=keycloak-claim-options.d.ts.map

package/dist/jwt/keycloak-claim-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-claim-options.d.ts","sourceRoot":"","sources":["../../src/jwt/keycloak-claim-options.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4GAA4G;IAC5G,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B"}

package/dist/jwt/keycloak-claim-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=keycloak-claim-options.js.map

package/dist/jwt/keycloak-claim-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-claim-options.js","sourceRoot":"","sources":["../../src/jwt/keycloak-claim-options.ts"],"names":[],"mappings":""}

package/dist/jwt/session-of-claims.d.ts

@@ -0,0 +1,13 @@
+import type { Actor, AuthenticationMethod, Session, SessionExtensionValues } from '@ddd-ts-kit/kernel';
+import type { Claims } from './claims.js';
+export interface SessionClaimOptions<C extends Claims> {
+    readonly impersonatorClaim?: string;
+    readonly authenticationMethod?: AuthenticationMethod | ((claims: C) => AuthenticationMethod);
+    readonly toSessionExtensions?: (claims: C) => SessionExtensionValues;
+}
+/**
+ * The session a verified token stands for. Registered claims only (RFC 7519, OpenID Connect
+ * Core, RFC 8176, RFC 8693): the identity provider decides what they say.
+ */
+export declare function sessionOfClaims<C extends Claims>(claims: C, actor: Actor, options: SessionClaimOptions<C>): Session;
+//# sourceMappingURL=session-of-claims.d.ts.map

package/dist/jwt/session-of-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-of-claims.d.ts","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EAEpB,OAAO,EACP,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,oBAAoB,CAAC,CAAC;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,sBAAsB,CAAC;CACtE;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAenH"}