@feasibleone/blong-gogo 1.13.2 → 1.13.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.13.3](https://github.com/feasibleone/blong/compare/blong-gogo-v1.13.2...blong-gogo-v1.13.3) (2026-03-17)
+
+
+### Bug Fixes
+
+* reduce dependencies ([e1798f5](https://github.com/feasibleone/blong/commit/e1798f590a2e2c6d9de99477cfe09c282433dcbc))
+
 ## [1.13.2](https://github.com/feasibleone/blong/compare/blong-gogo-v1.13.1...blong-gogo-v1.13.2) (2026-03-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feasibleone/blong-gogo",
-  "version": "1.13.2",
+  "version": "1.13.3",
   "repository": {
     "url": "git+https://github.com/feasibleone/blong.git"
   },
@@ -56,7 +56,6 @@
     "typebox": "^1.1.5",
     "ulidx": "^2.4.1",
     "ut-bitsyntax": "^6.2.7",
-    "ut-bus": "^7.65.2",
     "ut-dns-discovery": "^6.2.3",
     "ut-function.interpolate": "1.1.3",
     "ut-function.merge": "^1.5.6",

package/src/Gateway.ts

@@ -144,7 +144,7 @@ export default class Gateway extends Internal implements IGateway {
         errorFields: [],
         jwt: {
             cache: {},
-            audience: 'ut-bus',
+            audience: 'blong',
         },
     };
 
@@ -353,7 +353,7 @@ export default class Gateway extends Internal implements IGateway {
                         value.auth === false
                             ? {}
                             : {
-                                  'ut-login': ['api'],
+                                  'blong-login': ['api'],
                               },
                     ],
                     tags: [method.split('.')[0] + ' ' + pkg.name + '@' + pkg.version],

package/src/GatewayCodec.ts

@@ -1,9 +1,9 @@
 import type {IMeta} from '@feasibleone/blong/types';
 import got, {type HTTPAlias, type Headers} from 'got';
 import type {JWTPayload} from 'jose';
-import busGateway from 'ut-bus/gateway.js';
-import jose from 'ut-bus/jose.js';
-import oidc from 'ut-bus/oidc.js';
+import busGateway from './busGateway.ts';
+import jose from './jose.ts';
+import oidc from './oidc.ts';
 
 import type {IResolution} from './Resolution.ts';
 import tls from './tls.ts';
@@ -45,7 +45,7 @@ export interface IConfig {
     port?: string;
     service?: string;
     openId?: unknown;
-    utLogin?: unknown;
+    blongLogin?: unknown;
 }
 
 type Sender = (a: unknown, b: unknown) => Promise<unknown>;
@@ -153,7 +153,7 @@ export default class GatewayCodecImpl implements IGatewayCodec {
             session,
             tls: this.#tlsClient,
             issuers: config.openId || {
-                ...(config.utLogin !== false && {'ut-login': {audience: 'ut-bus'}}),
+                ...(config.blongLogin !== false && {'blong-login': {audience: 'blong'}}),
             },
         });
 

package/src/busGateway.ts

@@ -0,0 +1,179 @@
+// const request = (process.type === 'renderer') ? require('ut-browser-request') : require('request');
+// const [httpPost] = [request.post].map(require('util').promisify);
+import ky from 'ky';
+
+const decode = (result, method, unpack) => (unpack ? result : [result, {method, mtid: 'response'}]);
+
+export default ({serverInfo, mleClient, errors, get}) => {
+    const localCache = {};
+    const localKeys = mleClient.keys.sign &&
+        mleClient.keys.encrypt && {mlsk: mleClient.keys.sign, mlek: mleClient.keys.encrypt};
+
+    function tokenInfo(auth) {
+        const now = Date.now() - 5000; // latency tolerance of 5 seconds
+        return {
+            tokenExpire: now + auth.expires_in * 1000,
+            refreshTokenExpire: now + auth.refresh_token_expires_in * 1000,
+        };
+    }
+
+    async function login(cache, url, username, password, channel) {
+        const {sign, encrypt} = (localKeys && (cache.auth || cache.remoteKeys)) || {};
+        if (sign && encrypt) {
+            const {result, error} = await ky
+                .post<{result: unknown; error: unknown}>(`${url}/rpc/login/identity/exchange`, {
+                    json: {
+                        jsonrpc: '2.0',
+                        method: 'login.identity.exchange',
+                        id: 1,
+                        params: await mleClient.signEncrypt(
+                            {username, password, channel},
+                            encrypt,
+                            localKeys,
+                        ),
+                    },
+                })
+                .json();
+            if (error) throw Object.assign(new Error(), await mleClient.decryptVerify(error, sign));
+            else if (result) cache.auth = await mleClient.decryptVerify(result, sign);
+            else throw errors['bus.jsonRpcEmpty']();
+        } else {
+            const {result, error} = await ky
+                .post<{result: unknown; error: unknown}>(`${url}/rpc/login/identity/check`, {
+                    json: {
+                        jsonrpc: '2.0',
+                        method: 'login.identity.check',
+                        id: 1,
+                        params: {username, password, channel},
+                    },
+                })
+                .json();
+            if (error) throw Object.assign(new Error(), error);
+            else if (result) cache.auth = result;
+            else throw errors['bus.jsonRpcEmpty']();
+        }
+        cache.tokenInfo = tokenInfo(cache.auth);
+    }
+
+    return async function gateway({
+        username,
+        password,
+        channel = 'web',
+        protocol = serverInfo('protocol'),
+        host: hostname = 'localhost',
+        port = serverInfo('port'),
+        url,
+        tls,
+        auth,
+        encrypt = true,
+        method,
+    }) {
+        // don't put a default value for uri in arguments as it can be empty string or null
+        if (url) {
+            const parsed = new URL(url);
+            hostname = parsed.hostname;
+            port = parsed.port;
+            protocol = parsed.protocol.split(':')[0];
+            if (parsed.username) username = parsed.username;
+            if (parsed.password) password = parsed.password;
+        } else {
+            protocol = protocol && protocol.split(':')[0];
+            url = `${protocol}://${hostname}:${port}`;
+        }
+
+        const codec = {
+            requestParams: {
+                protocol,
+                hostname,
+                port,
+                path: `/rpc/${method.replace(/\./g, '/')}`,
+            },
+        };
+
+        const cache = (localCache[url] = localCache[url] || {});
+
+        if (localKeys && !cache.remoteKeys) {
+            const body = await get(
+                `${url}/rpc/login/.well-known/mle`,
+                errors['bus.jsonRpcHttp'],
+                errors['bus.jsonRpcEmpty'],
+            );
+            if (body.sign && body.encrypt) cache.remoteKeys = body;
+        }
+
+        if (auth) {
+            cache.auth = auth;
+            cache.tokenInfo = tokenInfo(auth);
+        }
+
+        if (!cache.auth && !(username && password)) {
+            if (cache.remoteKeys) {
+                codec.encode = async params => ({
+                    params: await mleClient.signEncrypt(
+                        params,
+                        cache.remoteKeys.encrypt,
+                        localKeys,
+                    ),
+                    method,
+                });
+                codec.decode = async (result, unpack) =>
+                    decode(
+                        await mleClient.decryptVerify(result, cache.remoteKeys.sign),
+                        method,
+                        unpack,
+                    );
+            } else {
+                codec.encode = params => ({params, method});
+                codec.decode = (result, unpack) => decode(result, method, unpack);
+            }
+            return codec;
+        }
+
+        if (!cache.auth) await login(cache, url, username, password, channel);
+
+        const exp = Date.now();
+
+        if (exp > cache.tokenInfo.tokenExpire) {
+            if (exp > cache.tokenInfo.refreshTokenExpire) {
+                await login(cache, url, username, password, channel);
+            } else {
+                const {body} = await ky
+                    .post<{body: {access_token: string; refresh_token: string}}>(
+                        `${url}/rpc/login/token`,
+                        {
+                            json: {
+                                grant_type: 'refresh_token',
+                                refresh_token: cache.auth.refresh_token,
+                            },
+                        },
+                    )
+                    .json();
+                Object.assign(cache.auth, body);
+                cache.tokenInfo = tokenInfo(body);
+            }
+        }
+
+        if (cache.auth.sign && cache.auth.encrypt) {
+            codec.encode = async params => ({
+                params: await mleClient.signEncrypt(params, cache.auth.encrypt),
+                headers: {
+                    authorization: 'Bearer ' + cache.auth.access_token,
+                },
+                method,
+            });
+            codec.decode = async (result, unpack) =>
+                decode(await mleClient.decryptVerify(result, cache.auth.sign), method, unpack);
+        } else {
+            codec.encode = params => ({
+                params,
+                headers: {
+                    authorization: 'Bearer ' + cache.auth.access_token,
+                },
+                method,
+            });
+            codec.decode = (result, unpack) => decode(result, method, unpack);
+        }
+
+        return codec;
+    };
+};

package/src/codec/adapter/mle/ready.ts

@@ -1,7 +1,7 @@
 import {handler} from '@feasibleone/blong/types';
 import {type Response} from 'got';
 import {exportJWK, generateKeyPair} from 'jose';
-import joseFactory from 'ut-bus/jose.js';
+import joseFactory from '../../../jose.ts';
 
 const isBrowser: boolean = typeof window !== 'undefined' && typeof window.document !== 'undefined';
 

package/src/lib.ts

@@ -1,13 +1,15 @@
+import ky from 'ky';
+
 export function methodId<T>(what: T): T {
     return (
         what &&
         ((typeof what === 'string'
             ? what.replace(/\./g, '').toLowerCase()
             : typeof what === 'object'
-            ? Object.fromEntries(
-                  Object.entries(what).map(([name, value]) => [methodId(name), value])
-              )
-            : what) as T)
+              ? Object.fromEntries(
+                    Object.entries(what).map(([name, value]) => [methodId(name), value]),
+                )
+              : what) as T)
     );
 }
 
@@ -27,3 +29,125 @@ export function identifier(string: string): string {
     string = snakeToCamel(string);
     return /[^\w$]/.test(string) ? `'${string}'` : string;
 }
+
+let loginCache: unknown;
+export async function loginService(discovery) {
+    if (!loginCache) loginCache = discovery('login');
+    try {
+        return await loginCache;
+    } catch (error) {
+        loginCache = false;
+        throw error;
+    }
+}
+
+export async function requestGet(
+    url: string,
+    errorHttp: (params: Record<string, unknown>) => unknown,
+    errorEmpty: () => unknown,
+    headers: Record<string, string | undefined> | undefined,
+    protocol: string,
+    tls: Record<string, unknown> | undefined,
+): Promise<unknown> {
+    const response = await ky.get(url, {
+        ...tls,
+        ...(headers && {
+            headers: {
+                'x-forwarded-proto': headers['x-forwarded-proto'] || protocol,
+                'x-forwarded-host': headers['x-forwarded-host'] || headers.host,
+            },
+        }),
+        throwHttpErrors: false,
+    });
+
+    const responseText = await response.text();
+    let body: unknown;
+    try {
+        body = responseText ? JSON.parse(responseText) : undefined;
+    } catch {
+        body = undefined;
+    }
+
+    if (response.status < 200 || response.status >= 300) {
+        throw errorHttp({
+            statusCode: response.status,
+            statusText: response.statusText,
+            statusMessage: response.statusText,
+            validation: (body as any)?.validation,
+            debug: (body as any)?.debug,
+            params: {
+                code: response.status,
+            },
+            req: {
+                url: response.url,
+                method: 'GET',
+            },
+        });
+    }
+
+    if (body) return body;
+    throw errorEmpty();
+}
+
+export async function requestPostForm(
+    url: string,
+    errorHttp: (params: Record<string, unknown>) => unknown,
+    errorEmpty: () => unknown,
+    headers: Record<string, string | undefined> | undefined,
+    protocol: string,
+    tls: Record<string, unknown> | undefined,
+    form: Record<string, string | number | boolean | null | undefined> | URLSearchParams,
+): Promise<string> {
+    const forwardedHeaders = headers && {
+        'x-forwarded-proto': headers['x-forwarded-proto'] || protocol,
+        'x-forwarded-host': headers['x-forwarded-host'] || headers.host,
+    };
+
+    const body =
+        form instanceof URLSearchParams
+            ? form
+            : new URLSearchParams(
+                  Object.entries(form).map(([key, value]) => [
+                      key,
+                      value == null ? '' : String(value),
+                  ]),
+              );
+
+    const response = await ky.post(url, {
+        ...tls,
+        headers: {
+            ...(forwardedHeaders || {}),
+            'content-type': 'application/x-www-form-urlencoded',
+        },
+        body,
+        throwHttpErrors: false,
+    });
+
+    const responseText = await response.text();
+    let responseJson: any;
+    try {
+        responseJson = responseText ? JSON.parse(responseText) : undefined;
+    } catch {
+        responseJson = undefined;
+    }
+
+    if (response.status < 200 || response.status >= 300) {
+        throw errorHttp({
+            statusCode: response.status,
+            statusText: response.statusText,
+            statusMessage: response.statusText,
+            validation: responseJson?.validation,
+            debug: responseJson?.debug,
+            params: {
+                code: response.status,
+            },
+            req: {
+                url: response.url,
+                method: 'POST',
+            },
+        });
+    }
+
+    if (responseText) return responseText;
+    throw errorEmpty();
+}

package/src/oidc.ts

@@ -0,0 +1,208 @@
+import {createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify} from 'jose';
+import {requestGet as get, loginService} from './lib.ts';
+
+export default ({
+    issuers,
+    tls = {},
+    discoverService = false,
+    session = false,
+    errorPrefix,
+    errors: {
+        [`${errorPrefix}oidcEmpty`]: errorOidcEmpty,
+        [`${errorPrefix}oidcHttp`]: errorOidcHttp,
+        [`${errorPrefix}actionEmpty`]: errorActionEmpty,
+        [`${errorPrefix}actionHttp`]: errorActionHttp,
+        [`${errorPrefix}unauthorized`]: errorUnauthorized,
+        [`${errorPrefix}oidcNoIssuer`]: errorNoIssuer,
+        [`${errorPrefix}oidcNoKid`]: errorNoKid,
+        [`${errorPrefix}oidcBadIssuer`]: errorBadIssuer,
+        [`${errorPrefix}jwtInvalid`]: errorInvalid,
+    },
+}) => {
+    async function openIdConfig(issuer, headers, protocol) {
+        if (issuer === 'blong-login') {
+            const {protocol: loginProtocol, hostname, port} = await loginService(discoverService);
+            issuer = `${loginProtocol}://${hostname}:${port}/rpc/login/.well-known/openid-configuration`;
+        } else {
+            headers = false;
+        }
+        return await get(issuer, errorOidcHttp, errorOidcEmpty, headers, protocol, tls);
+    }
+
+    let actionsCache;
+    async function actions(method) {
+        if (actionsCache) return actionsCache[method];
+        const {protocol, hostname, port} = await loginService(discoverService);
+        const actionsMap = await get(
+            `${protocol}://${hostname}:${port}/rpc/login/action`,
+            errorActionHttp,
+            errorActionEmpty,
+            {},
+            undefined,
+            tls,
+        );
+        const fuzzyMap = Object.entries(actionsMap).reduce((all, [action, bit]) => {
+            for (let i = 1, segments = action.split('.'), n = segments.length; i < n; i += 1) {
+                const key = segments.slice(0, i).concat('%').join('.');
+                if (!all[key]) all[key] = [];
+                all[key].push(bit);
+            }
+            return all;
+        }, {});
+
+        actionsCache = {...fuzzyMap, ...actionsMap};
+
+        return actionsCache[method];
+    }
+
+    function checkPermission(bit, map) {
+        bit -= 1;
+        const index = Math.floor(bit / 8);
+        return Number.isInteger(index) && index < map.length && map[index] & (1 << (bit % 8));
+    }
+
+    async function checkAuthSingle(method, map) {
+        if (Array.isArray(method)) {
+            for (const m of method) {
+                if (!(await checkAuthSingle(m, map))) return false;
+            }
+            return true;
+        }
+        const bit = await actions(method);
+        return Array.isArray(bit)
+            ? bit.some(b => checkPermission(b, map))
+            : checkPermission(bit, map);
+    }
+
+    async function checkAuth(method, map, dontThrow) {
+        if (!(await checkAuthSingle(method, map)) && !(await checkAuthSingle('%', map))) {
+            if (dontThrow) return false;
+            throw errorUnauthorized({params: {method}});
+        }
+        return true;
+    }
+
+    const issuerUrl = (base, url) =>
+        base === 'blong-login' ? 'blong-login' : new URL(url, base.replace(/\/?$/, '/')).href;
+
+    const loadIssuers = () =>
+        Promise.all(
+            Object.entries(issuers)
+                .filter(([, config]) => config)
+                .map(
+                    ([
+                        issuerId,
+                        {
+                            configuration,
+                            url = '.well-known/openid-configuration',
+                            audience = 'blong',
+                            ...rest
+                        },
+                    ]) =>
+                        (async () => [
+                            issuerId,
+                            {
+                                ...(await openIdConfig(configuration || issuerUrl(issuerId, url))),
+                                audience,
+                                issuerId,
+                                ...rest,
+                            },
+                        ])(),
+                ),
+        );
+
+    async function cache() {
+        return (await loadIssuers()).reduce(
+            (prev, [issuer, config]) => ({...prev, [config.issuer]: config, [issuer]: config}),
+            {},
+        );
+    }
+
+    const getIssuers = (headers, protocol) =>
+        Promise.all(
+            Object.entries(issuers)
+                .filter(([, config]) => config)
+                .map(([issuer, {configuration, url = '.well-known/openid-configuration'}]) =>
+                    openIdConfig(configuration || issuerUrl(issuer, url), headers, protocol),
+                ),
+        );
+
+    let issuersCache;
+
+    async function issuerConfig(issuerId) {
+        if (issuerId === 'blong-login') return openIdConfig('blong-login');
+        issuersCache = issuersCache || cache();
+        const result = (await issuersCache)[issuerId];
+        if (!result) {
+            throw errorBadIssuer({params: {issuerId}});
+        }
+        return result;
+    }
+
+    async function jwks(issuerId) {
+        return get(
+            (await issuerConfig(issuerId)).jwks_uri,
+            errorOidcHttp,
+            errorOidcEmpty,
+            {},
+            undefined,
+            tls,
+        );
+    }
+
+    const keys = {};
+
+    async function getKey(decoded, protectedHeader) {
+        const issuerId = decoded?.iss;
+        if (!issuerId) throw errorNoIssuer();
+        const kid = protectedHeader?.kid;
+        if (!kid) throw errorNoKid();
+        if (!keys[issuerId]) keys[issuerId] = createLocalJWKSet(await jwks(issuerId));
+        const result = await keys[issuerId](protectedHeader, decoded);
+        if (!result) throw errorInvalid({params: {message: 'Invalid OIDC key id'}});
+        return result;
+    }
+
+    async function verify(token, {nonce, audience = 'blong'}, isId) {
+        let decoded;
+        let protectedHeader;
+        try {
+            decoded = decodeJwt(token);
+            protectedHeader = decodeProtectedHeader(token);
+        } catch (error) {
+            throw errorInvalid({params: {message: error.message}, cause: error});
+        }
+        const config = (decoded.iss &&
+            decoded.iss !== 'blong-login' &&
+            (await issuerConfig(decoded.iss))) || {audience};
+        try {
+            if (isId) {
+                await jwtVerify(token, await getKey(decoded, protectedHeader), {
+                    audience: config.audience,
+                    issuer: decoded.iss,
+                    nonce,
+                });
+            } else {
+                await jwtVerify(token, await getKey(decoded, protectedHeader), {
+                    audience: config.audience,
+                });
+            }
+        } catch (error) {
+            throw errorInvalid({params: {message: error.message}, cause: error});
+        }
+        if (session && audience === 'blong' && !decoded.ses) await session(decoded);
+        return {
+            ...decoded,
+            config,
+        };
+    }
+
+    return {
+        get: (url, errorHttp, errorEmpty, headers, protocol) =>
+            get(url, errorHttp, errorEmpty, headers, protocol, tls),
+        verify,
+        getIssuers,
+        checkAuth,
+        issuerConfig,
+    };
+};

package/src/swagger.ts

@@ -5,7 +5,7 @@ import fp from 'fastify-plugin';
 
 export default fp<{version: string}>(async function swaggerPlugin(
     fastify: FastifyInstance,
-    {version}: FastifyPluginOptions
+    {version}: FastifyPluginOptions,
 ) {
     await fastify.register(swagger, {
         openapi: {
@@ -15,7 +15,7 @@ export default fp<{version: string}>(async function swaggerPlugin(
             },
             components: {
                 securitySchemes: {
-                    'ut-login': {
+                    'blong-login': {
                         flows: {
                             authorizationCode: {
                                 authorizationUrl: '/rpc/login/form',