@finueva/auth 0.15.0 → 0.16.0

package/README.md

@@ -32,6 +32,22 @@ Do not reuse configuration from another application or environment.
 | Server or SSR handler     | `@finueva/auth/server` | Incoming Auth cookie or bearer | Once per request         |
 | CLI or native application | `@finueva/auth/device` | Device bearer session          | Once per process         |
 
+## Private Identity Resolution Candidate
+
+For private server-to-server identity resolution, the next package candidate exports `createIdentityResolverAuth` from `@finueva/auth/server`. This helper is not in published `0.15.0`.
+
+```ts
+import { createIdentityResolverAuth } from "@finueva/auth/server";
+
+const identities = createIdentityResolverAuth({ authOrigin: "https://auth.example.test" });
+
+async function resolvePrivateIdentity(identifier: string, clientAssertion: string) {
+  return identities.resolveIdentity({ identifier }, clientAssertion);
+}
+```
+
+The approved server signs a fresh assertion with its registered key and explicit `identities:resolve` capability. The method returns only `{ userId }` or null for one exact username or email. Keep the result private. It grants no product authority. See the [server guide](https://github.com/Ifkafin/auth/blob/main/apps/developer/docs/sdk/server.md#resolve-a-private-identity) for the assertion contract and limits.
+
 ## Browser Quick Start
 
 Create the client with the exact Auth and application origins:

package/dist/server.d.ts

@@ -1,4 +1,22 @@
 import { A as PersonalWorkspaceSelection, C as OrganizationPage, D as OrganizationTeamMemberPage, E as OrganizationTeamDisplay, G as SocialIdTokenProvider, K as UpdateOrganizationDisplayInput, O as OrganizationTeamPage, Q as AuthErrorStatus, R as ReceivedOrganizationInvitation, S as OrganizationMemberPage, T as OrganizationTeam, V as ResentOrganizationInvitation, W as SocialIdTokenInput, X as AuthError, Y as WorkspaceSelection, Z as AuthErrorCode, _ as OrganizationDisplay, b as OrganizationMember, c as AuthUser, d as CreatedOrganizationMemberInvitation, f as CreatedOrganizationTeam, g as InvitationAcceptance, k as OrganizationWorkspaceSelection, l as CanceledOrganizationInvitation, m as DriveCredentialInput, o as AuthSession, p as DriveCredential, q as UpdateOrganizationTeamDisplayInput, r as AuthOrganization, t as AcceptInvitationInput, u as CreateOrganizationMemberInvitationInput, v as OrganizationInvitation, w as OrganizationPageInput, x as OrganizationMemberAuthority, y as OrganizationInvitationPage, z as ReceivedOrganizationInvitationPage } from "./types-Dpy17xNC.js";
+//#region src/identity-resolution.d.ts
+interface IdentityResolverAuthOptions {
+  authOrigin: string;
+  fetch?: typeof globalThis.fetch;
+  timeoutMs?: number;
+}
+interface ResolveIdentityInput {
+  identifier: string;
+}
+interface ResolvedIdentity {
+  userId: string;
+}
+interface FinuevaIdentityResolverAuth {
+  resolveIdentity(input: ResolveIdentityInput, clientAssertion: string): Promise<ResolvedIdentity | null>;
+}
+/** Server-only identity resolution. Keep results private; they grant no product authority. */
+declare function createIdentityResolverAuth(options: IdentityResolverAuthOptions): FinuevaIdentityResolverAuth;
+//#endregion
 //#region src/drive-recipients.d.ts
 interface DriveRecipientAuthOptions {
   authOrigin: string;
@@ -80,4 +98,4 @@ interface FinuevaServerAuth {
 }
 declare function createServerAuth(options: ServerAuthOptions): FinuevaServerAuth;
 //#endregion
-export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, FinuevaServerAuth, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createServerAuth };
+export { type AcceptInvitationInput, AuthError, type AuthErrorCode, type AuthErrorStatus, type AuthOrganization, type AuthSession, type AuthUser, type CanceledOrganizationInvitation, type CreateOrganizationMemberInvitationInput, type CreatedOrganizationMemberInvitation, type CreatedOrganizationTeam, type DriveCredential, type DriveCredentialInput, type DriveProvisioningAuthOptions, type DriveProvisioningCredential, type DriveRecipient, type DriveRecipientAuthOptions, type FinuevaDriveProvisioningAuth, type FinuevaDriveRecipientAuth, type FinuevaIdentityResolverAuth, FinuevaServerAuth, type IdentityResolverAuthOptions, type InvitationAcceptance, type OrganizationDisplay, type OrganizationInvitation, type OrganizationInvitationPage, type OrganizationMember, type OrganizationMemberAuthority, type OrganizationMemberPage, type OrganizationPage, type OrganizationPageInput, type OrganizationTeam, type OrganizationTeamDisplay, type OrganizationTeamMemberPage, type OrganizationTeamPage, type OrganizationWorkspaceSelection, type PersonalWorkspaceSelection, type ReceivedOrganizationInvitation, type ReceivedOrganizationInvitationPage, type ResentOrganizationInvitation, type ResolveDriveRecipientInput, type ResolveIdentityInput, type ResolvedIdentity, ServerAuthOptions, ServerInvitationAcceptance, ServerSignOutResult, ServerSocialIdTokenSession, type SocialIdTokenInput, type SocialIdTokenProvider, type UpdateOrganizationDisplayInput, type UpdateOrganizationTeamDisplayInput, type WorkspaceSelection, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth };

package/dist/server.js

@@ -307,7 +307,7 @@ function normalizeIdInput(value) {
 	return value;
 }
 function normalizeOrganization(value) {
-	exact$1(value, [
+	exact$2(value, [
 		"capabilities",
 		"id",
 		"lifecycle",
@@ -317,7 +317,7 @@ function normalizeOrganization(value) {
 		"slug"
 	]);
 	if (!isId(value.id) || !boundedString(value.name, 255) || !boundedString(value.slug, 255) || value.lifecycle !== "ordinary" && value.lifecycle !== "managed" || !role(value.role) || !isObject(value.capabilities)) throw authorityUnavailable();
-	exact$1(value.capabilities, [
+	exact$2(value.capabilities, [
 		"readInvitations",
 		"readMembers",
 		"readTeams"
@@ -378,7 +378,7 @@ function normalizeOrganizationTeamCreationInput(name, idempotencyKey) {
 	};
 }
 function normalizeCreatedOrganizationTeam(value) {
-	exact$1(value, ["id", "name"]);
+	exact$2(value, ["id", "name"]);
 	if (!isId(value.id) || !boundedString(value.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -405,7 +405,7 @@ function normalizeOrganizationMemberInvitationCreationInput(value) {
 	};
 }
 function normalizeCreatedOrganizationMemberInvitation(value) {
-	exact$1(value, ["expiresAt", "id"]);
+	exact$2(value, ["expiresAt", "id"]);
 	if (!isId(value.id)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -422,12 +422,12 @@ function normalizeOrganizationInvitationAdministrationInput(idempotencyKey) {
 	return { idempotencyKey };
 }
 function normalizeCanceledOrganizationInvitation(value) {
-	exact$1(value, ["status"]);
+	exact$2(value, ["status"]);
 	if (value.status !== "canceled") throw authorityUnavailable();
 	return { status: "canceled" };
 }
 function normalizeOrganizations(value) {
-	exact$1(value, ["nextCursor", "organizations"]);
+	exact$2(value, ["nextCursor", "organizations"]);
 	if (!Array.isArray(value.organizations) || value.organizations.length > 100) throw authorityUnavailable();
 	return {
 		organizations: unique(value.organizations.map(normalizeOrganization), (item) => item.id),
@@ -435,11 +435,11 @@ function normalizeOrganizations(value) {
 	};
 }
 function normalizeOrganizationMembers(value) {
-	exact$1(value, ["members", "nextCursor"]);
+	exact$2(value, ["members", "nextCursor"]);
 	if (!Array.isArray(value.members) || value.members.length > 100) throw authorityUnavailable();
 	return {
 		members: unique(value.members.map((member) => {
-			exact$1(member, [
+			exact$2(member, [
 				"email",
 				"id",
 				"image",
@@ -468,11 +468,11 @@ function normalizeOrganizationMembers(value) {
 	};
 }
 function normalizeOrganizationTeams(value) {
-	exact$1(value, ["nextCursor", "teams"]);
+	exact$2(value, ["nextCursor", "teams"]);
 	if (!Array.isArray(value.teams) || value.teams.length > 100) throw authorityUnavailable();
 	return {
 		teams: unique(value.teams.map((team) => {
-			exact$1(team, [
+			exact$2(team, [
 				"category",
 				"createdAt",
 				"id",
@@ -490,7 +490,7 @@ function normalizeOrganizationTeams(value) {
 	};
 }
 function normalizeOrganizationTeamMembers(value) {
-	exact$1(value, ["memberIds", "nextCursor"]);
+	exact$2(value, ["memberIds", "nextCursor"]);
 	if (!Array.isArray(value.memberIds) || value.memberIds.length > 100) throw authorityUnavailable();
 	return {
 		memberIds: unique(value.memberIds.map((item) => normalizeResponseId(item)), (item) => item),
@@ -498,7 +498,7 @@ function normalizeOrganizationTeamMembers(value) {
 	};
 }
 function normalizeOrganizationInvitation(value) {
-	exact$1(value, [
+	exact$2(value, [
 		"createdAt",
 		"email",
 		"expiresAt",
@@ -509,7 +509,7 @@ function normalizeOrganizationInvitation(value) {
 		"teamIds"
 	]);
 	if (!isId(value.id) || typeof value.email !== "string" || value.email.length > 320 || !email.test(value.email) || !role(value.role) || value.status !== "pending" || !Array.isArray(value.teamIds) || value.teamIds.length > 100 || !isObject(value.inviter)) throw authorityUnavailable();
-	exact$1(value.inviter, ["membershipId", "name"]);
+	exact$2(value.inviter, ["membershipId", "name"]);
 	if (!isId(value.inviter.membershipId) || !boundedString(value.inviter.name, 255)) throw authorityUnavailable();
 	return {
 		id: value.id,
@@ -526,7 +526,7 @@ function normalizeOrganizationInvitation(value) {
 	};
 }
 function normalizeOrganizationInvitations(value) {
-	exact$1(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeOrganizationInvitation), (item) => item.id),
@@ -534,7 +534,7 @@ function normalizeOrganizationInvitations(value) {
 	};
 }
 function normalizeReceivedInvitation(value) {
-	exact$1(value, [
+	exact$2(value, [
 		"expiresAt",
 		"id",
 		"inviterName",
@@ -543,7 +543,7 @@ function normalizeReceivedInvitation(value) {
 		"teams"
 	]);
 	if (!isId(value.id) || !boundedString(value.inviterName, 255) || !role(value.role) || !Array.isArray(value.teams) || value.teams.length > 100 || !isObject(value.organization)) throw authorityUnavailable();
-	exact$1(value.organization, [
+	exact$2(value.organization, [
 		"id",
 		"logo",
 		"name",
@@ -560,7 +560,7 @@ function normalizeReceivedInvitation(value) {
 		},
 		role: value.role,
 		teams: unique(value.teams.map((team) => {
-			exact$1(team, ["id", "name"]);
+			exact$2(team, ["id", "name"]);
 			if (!isId(team.id) || !boundedString(team.name, 255)) throw authorityUnavailable();
 			return {
 				id: team.id,
@@ -572,7 +572,7 @@ function normalizeReceivedInvitation(value) {
 	};
 }
 function normalizeReceivedInvitations(value) {
-	exact$1(value, ["invitations", "nextCursor"]);
+	exact$2(value, ["invitations", "nextCursor"]);
 	if (!Array.isArray(value.invitations) || value.invitations.length > 100) throw authorityUnavailable();
 	return {
 		invitations: unique(value.invitations.map(normalizeReceivedInvitation), (item) => item.id),
@@ -648,7 +648,7 @@ function fromOrganizationInvitationAdministrationError(value, status, retryAfter
 	return fromOrganizationMutationAuthorityError(value, status, retryAfter);
 }
 function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
-	exact$1(value, [
+	exact$2(value, [
 		"organizationId",
 		"actor",
 		"target"
@@ -666,7 +666,7 @@ function normalizeOrganizationMemberAuthority(value, organizationId, memberId) {
 	};
 }
 function normalizeOrganizationAuthorityMemberOutcome(value, includesStatus = false) {
-	exact$1(value, [
+	exact$2(value, [
 		"memberId",
 		"manualRole",
 		"role",
@@ -759,7 +759,7 @@ function toDate(value) {
 function isId(value) {
 	return typeof value === "string" && id.test(value);
 }
-function exact$1(value, keys) {
+function exact$2(value, keys) {
 	if (!isObject(value) || Object.keys(value).sort().join(",") !== [...keys].sort().join(",")) throw authorityUnavailable();
 }
 function boundedString(value, maximum) {
@@ -803,6 +803,98 @@ function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
+//#region src/identity-resolution.ts
+const emailPattern$1 = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$(?![\s\S])/;
+function exact$1(value, keys) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+function createIdentityResolverAuth(options) {
+	const url = joinURL(normalizeOrigin(options.authOrigin, "authOrigin"), "api/v1/auth/identities/resolve");
+	const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
+	if (typeof fetchImpl !== "function") throw new TypeError("fetch is required");
+	const timeoutMs = normalizeTimeout(options.timeoutMs);
+	let inFlight = false;
+	return { async resolveIdentity(input, clientAssertion) {
+		if (!exact$1(input, ["identifier"]) || typeof input.identifier !== "string" || input.identifier.length > 324) throw new AuthError("invalid_request", 400);
+		const identifier = input.identifier.trim().toLowerCase();
+		if (!(identifier.length <= 320 && emailPattern$1.test(identifier)) && !/^[a-z0-9_.]{3,30}$(?![\s\S])/.test(identifier)) throw new AuthError("invalid_request", 400);
+		if (typeof clientAssertion !== "string" || clientAssertion.length + 7 > 16 * 1024 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$(?![\s\S])/.test(clientAssertion)) throw new AuthError("invalid_request", 400);
+		if (inFlight) throw new AuthError("state_conflict", 409);
+		inFlight = true;
+		const controller = new AbortController();
+		let reader;
+		let timer;
+		let mappedError;
+		try {
+			const deadline = new Promise((_, reject) => {
+				timer = setTimeout(() => {
+					reject(authorityUnavailable());
+					controller.abort();
+					reader?.cancel().catch(() => {});
+				}, timeoutMs);
+			});
+			const exchange = async () => {
+				const response = await fetchImpl(url, {
+					method: "POST",
+					headers: {
+						authorization: `Bearer ${clientAssertion}`,
+						accept: "application/json",
+						"content-type": "application/json"
+					},
+					body: JSON.stringify({ identifier }),
+					credentials: "omit",
+					cache: "no-store",
+					redirect: "manual",
+					signal: controller.signal
+				});
+				if (controller.signal.aborted) {
+					response.body?.cancel().catch(() => {});
+					throw authorityUnavailable();
+				}
+				if (!response.body) throw authorityUnavailable();
+				reader = response.body.getReader();
+				const length = response.headers.get("content-length");
+				if (response.redirected || response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json" || length !== null && (!/^\d+$/.test(length) || Number(length) > 1024)) throw authorityUnavailable();
+				const bytes = new Uint8Array(1024);
+				let size = 0;
+				while (true) {
+					const chunk = await reader.read();
+					if (controller.signal.aborted) throw authorityUnavailable();
+					if (chunk.done) break;
+					if (size + chunk.value.byteLength > bytes.length) throw authorityUnavailable();
+					bytes.set(chunk.value, size);
+					size += chunk.value.byteLength;
+				}
+				const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size)));
+				if (response.status !== 200) {
+					if (!exact$1(value, ["code", "message"])) throw authorityUnavailable();
+					if (response.status === 401 && value.code === "UNAUTHORIZED" && value.message === "The identity resolution assertion is invalid.") mappedError = new AuthError("authentication_required", 401);
+					if (response.status === 429 && value.code === "TOO_MANY_REQUESTS" && value.message === "Identity resolution requests are temporarily limited.") {
+						const retryAfter = response.headers.get("retry-after");
+						if (retryAfter === null || !/^(?:[1-9]|[1-5][0-9]|60)$/.test(retryAfter)) throw authorityUnavailable();
+						mappedError = new AuthError("auth_request_rate_limited", 429, Number(retryAfter));
+					}
+					throw mappedError ?? authorityUnavailable();
+				}
+				if (!exact$1(value, ["identity"])) throw authorityUnavailable();
+				if (value.identity === null) return null;
+				if (!exact$1(value.identity, ["userId"]) || typeof value.identity.userId !== "string" || !/^[A-Za-z0-9_-]{1,128}$(?![\s\S])/.test(value.identity.userId)) throw authorityUnavailable();
+				return { userId: value.identity.userId };
+			};
+			return await Promise.race([exchange().finally(() => {
+				inFlight = false;
+			}), deadline]);
+		} catch (error) {
+			if (mappedError && mappedError === error) throw mappedError;
+			throw authorityUnavailable();
+		} finally {
+			clearTimeout(timer);
+			controller.abort();
+			reader?.cancel().catch(() => {});
+		}
+	} };
+}
+//#endregion
 //#region src/drive-recipients.ts
 const encoder = new TextEncoder();
 const emailPattern = /^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9-]*\.)+[A-Za-z]{2,}$/;
@@ -1693,4 +1785,4 @@ function authAuthorizationHeader(value) {
 	return value;
 }
 //#endregion
-export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createServerAuth };
+export { AuthError, createDriveProvisioningAuth, createDriveRecipientAuth, createIdentityResolverAuth, createServerAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@finueva/auth",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Public browser and server SDK for Finueva Auth",
   "type": "module",
   "sideEffects": false,