@ddd-ts-kit/auth 0.7.0 → 0.8.0

package/README.md

@@ -375,6 +375,7 @@ logging or serializing the object shows no key.
 | `authenticationStrength` | `mfa` when `amr` lists `mfa` (RFC 8176), `assuranceLevel` from `acr` |
 | `impersonatedBy` | the `sub` of the `act` claim (RFC 8693), or the claim named by `impersonatorClaim`: the id itself, or an object holding it under `sub` or `id` |
 | `locale`, `timeZone` | `locale`, `zoneinfo` |
+| `scopes` | `scope`, the space-separated list of OAuth 2.0, else `scp` as a list; absent when the token grants none. `HasScope` of `@ddd-ts-kit/http` reads them at the edge |
 | `extensions` | what `toSessionExtensions(claims)` answers |
 
 ```ts
@@ -615,52 +616,15 @@ dedicated service, or keep a projection of accessible ids.
   no watch API or changelog.
 - `expand` is the trace of one check for one actor, not the userset tree of Zanzibar's Expand.
 
-**Delegating to a dedicated service.** OpenFGA and SpiceDB implement the full model. They are
-adapters of the same `Authorizer` port, written in the platform, with their SDK as a dependency
-of the project and not of this package:
-
-```ts
-// platform/auth/openfga-authorizer.ts (outline)
-export class OpenFgaAuthorizer implements Authorizer {
-  constructor(
-    private readonly client: OpenFgaClient,
-    private readonly mapping: PermissionMapping,
-  ) {}
-
-  async check({ actor, permission, resource }: CheckRequest): Promise<Decision> {
-    if (isAnonymous(actor)) {
-      return deny(DenialReason.anonymous);
-    }
-    if (resource === undefined) {
-      return deny(DenialReason.resourceRequired);
-    }
-    const relation = this.mapping[resource.type]?.[permission.id];
-    if (relation === undefined) {
-      return deny(DenialReason.unmappedPermission);
-    }
-    const { allowed } = await this.client.check({
-      user: `${actor.type}:${actor.id}`,
-      relation,
-      object: `${resource.type}:${resource.id}`,
-    });
-    return allowed ? ALLOWED : deny(DenialReason.noRelation);
-  }
-
-  async listAccessible({ actor, permission, resourceType }: ListRequest): Promise<AccessScope> {
-    const relation = this.mapping[resourceType]?.[permission.id];
-    if (isAnonymous(actor) || relation === undefined) {
-      return { kind: 'none' };
-    }
-    const { objects } = await this.client.listObjects({ user: `${actor.type}:${actor.id}`, relation, type: resourceType });
-    return { kind: 'ids', ids: objects.map((object) => object.slice(resourceType.length + 1)) };
-  }
-}
-```
-
-With SpiceDB the same two methods call `CheckPermission` and `LookupResources`; the tuple
-writes of the next section become `WriteRelationships`, through the outbox when the service is
-remote, since a remote call cannot share the transaction. Hold the adapter to
-`authorizerContract` in an integration test, and carry the consistency token the service
+**Delegating to a dedicated service.** OpenFGA and SpiceDB implement the full model.
+[`@ddd-ts-kit/openfga`](../openfga/README.md) answers the `RelationTupleStore` and `Authorizer`
+ports on OpenFGA, with the authorization model generated from the same `defineSchema` and both
+adapters held to the contract suites of this package; a project moves from
+`RelationBasedAuthorizer` to `OpenFgaAuthorizer` by binding. SpiceDB maps the same two methods
+to `CheckPermission` and `LookupResources`, and the tuple writes of the next section to
+`WriteRelationships`; no adapter is shipped for it. With either service, a tuple write is a
+remote call that cannot share the transaction: it goes after the commit, retried. Hold an adapter
+to `authorizerContract` in an integration test, and carry the consistency token the service
 returns in the `context` of the request if you need read-your-writes.
 
 ### Keeping relationships in sync

package/dist/jwt/session-of-claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-of-claims.d.ts","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EAEpB,OAAO,EACP,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,oBAAoB,CAAC,CAAC;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,sBAAsB,CAAC;CACtE;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAenH"}
+{"version":3,"file":"session-of-claims.d.ts","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EAEpB,OAAO,EACP,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,MAAM;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,oBAAoB,CAAC,CAAC;IAC7F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,sBAAsB,CAAC;CACtE;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAgBnH"}

package/dist/jwt/session-of-claims.js

@@ -17,6 +17,7 @@ export function sessionOfClaims(claims, actor, options) {
         ...optional('impersonatedBy', impersonatorOf(claims[options.impersonatorClaim ?? ACTOR_CLAIM])),
         ...optional('locale', textOf(claims['locale'])),
         ...optional('timeZone', textOf(claims['zoneinfo'])),
+        ...optional('scopes', scopesOf(claims)),
         extensions: options.toSessionExtensions?.(claims) ?? {},
     };
 }
@@ -68,4 +69,11 @@ function impersonatorOf(claim) {
     const named = { ...claim };
     return textOf(named['sub']) ?? textOf(named['id']);
 }
+/** `scope`, the space-separated list of RFC 8693 and OAuth 2.0, or `scp`, the list some providers write instead. */
+function scopesOf(claims) {
+    const written = claims['scope'] ?? claims['scp'];
+    const scopes = typeof written === 'string' ? written.split(' ') : Array.isArray(written) ? written : [];
+    const kept = scopes.filter((scope) => typeof scope === 'string' && scope !== '');
+    return kept.length === 0 ? undefined : kept;
+}
 //# sourceMappingURL=session-of-claims.js.map

package/dist/jwt/session-of-claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-of-claims.js","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAeA,kFAAkF;AAClF,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAmB,MAAS,EAAE,KAAY,EAAE,OAA+B;IACxG,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE;QACvG,KAAK;QACL,QAAQ,EAAE,QAAQ,IAAI,YAAY;QAClC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACpE,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,GAAG,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,GAAG,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,WAAW,CAAC,CAAC,CAAC;QAC/F,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,UAAU,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CACf,MAAS,EACT,UAA0D;IAE1D,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAA4B,GAAQ,EAAE,KAAwB;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAErB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7C,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"session-of-claims.js","sourceRoot":"","sources":["../../src/jwt/session-of-claims.ts"],"names":[],"mappings":"AAeA,kFAAkF;AAClF,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAmB,MAAS,EAAE,KAAY,EAAE,OAA+B;IACxG,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE;QACvG,KAAK;QACL,QAAQ,EAAE,QAAQ,IAAI,YAAY;QAClC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACpE,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,GAAG,QAAQ,CAAC,wBAAwB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,GAAG,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,IAAI,WAAW,CAAC,CAAC,CAAC;QAC/F,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,GAAG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QACnD,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,UAAU,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE;KACxD,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,QAAQ,CACf,MAAS,EACT,UAA0D;IAE1D,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,UAAU,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,QAAQ,CAA4B,GAAQ,EAAE,KAAwB;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAgC,EAAE,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAErB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yFAAyF;AACzF,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7C,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAW,EAAE,GAAG,KAAK,EAAE,CAAC;IAEnC,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,oHAAoH;AACpH,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,OAAO,GAAY,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;IAElG,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ddd-ts-kit/auth",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Authentication and authorization behind ports: actors, permissions declared per use case, role, attribute and relationship (Zanzibar-style) based authorizers, deny by default.",
   "license": "MIT",
   "repository": {
@@ -42,11 +42,11 @@
     "dist"
   ],
   "dependencies": {
-    "@ddd-ts-kit/kernel": "0.7.0"
+    "@ddd-ts-kit/kernel": "0.8.0"
   },
   "peerDependencies": {
-    "@ddd-ts-kit/di": "0.7.0",
-    "@ddd-ts-kit/testing": "0.7.0",
+    "@ddd-ts-kit/di": "0.8.0",
+    "@ddd-ts-kit/testing": "0.8.0",
     "jose": "^6.0.0"
   },
   "peerDependenciesMeta": {
@@ -61,9 +61,9 @@
     }
   },
   "devDependencies": {
-    "@ddd-ts-kit/di": "0.7.0",
-    "@ddd-ts-kit/http": "0.7.0",
-    "@ddd-ts-kit/testing": "0.7.0",
+    "@ddd-ts-kit/di": "0.8.0",
+    "@ddd-ts-kit/http": "0.8.0",
+    "@ddd-ts-kit/testing": "0.8.0",
     "jose": "^6.0.0"
   }
 }