@fireproof/core-protocols-dashboard 0.24.7 → 0.24.8-dev-fp-token

package/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./msg-api.js";
 export * from "./dashboard-api.js";
+export * from "./token.js";

package/index.js

@@ -1,3 +1,4 @@
 export * from "./msg-api.js";
 export * from "./dashboard-api.js";
+export * from "./token.js";
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../jsr/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../jsr/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fireproof/core-protocols-dashboard",
-  "version": "0.24.7",
+  "version": "0.24.8-dev-fp-token",
   "description": "Live ledger for the web.",
   "type": "module",
   "main": "./index.js",
@@ -36,12 +36,14 @@
   "dependencies": {
     "@adviser/cement": "0.5.15",
     "@clerk/shared": "3.41.1",
-    "@fireproof/core-device-id": "0.24.7",
-    "@fireproof/core-runtime": "0.24.7",
-    "@fireproof/core-types-base": "0.24.7",
-    "@fireproof/core-types-protocols-cloud": "0.24.7",
-    "@fireproof/core-types-protocols-dashboard": "0.24.7",
-    "@fireproof/vendor": "0.24.7",
+    "@fireproof/core-device-id": "0.24.8-dev-fp-token",
+    "@fireproof/core-runtime": "0.24.8-dev-fp-token",
+    "@fireproof/core-types-base": "0.24.8-dev-fp-token",
+    "@fireproof/core-types-device-id": "0.24.8-dev-fp-token",
+    "@fireproof/core-types-protocols-cloud": "0.24.8-dev-fp-token",
+    "@fireproof/core-types-protocols-dashboard": "0.24.8-dev-fp-token",
+    "@fireproof/vendor": "0.24.8-dev-fp-token",
+    "jose": "6.1.3",
     "zod": "4.3.5"
   }
 }

package/token.d.ts

@@ -0,0 +1,25 @@
+import { Result } from "@adviser/cement";
+import { DeviceIdCA } from "@fireproof/core-device-id";
+import { SuperThis } from "@fireproof/core-types-base";
+import { FPApiToken, VerifiedClaimsResult } from "@fireproof/core-types-protocols-dashboard";
+import { VerifyWithCertificateOptions } from "@fireproof/core-types-device-id";
+export declare class ClerkApiToken implements FPApiToken {
+    readonly sthis: SuperThis;
+    constructor(sthis: SuperThis);
+    readonly keysAndUrls: () => Result<{
+        keys: string[];
+        urls: string[];
+    }, Error>;
+    verify(token: string): Promise<Result<VerifiedClaimsResult>>;
+}
+export declare class DeviceIdApiToken implements FPApiToken {
+    readonly sthis: SuperThis;
+    readonly opts: VerifyWithCertificateOptions;
+    constructor(sthis: SuperThis, opts: VerifyWithCertificateOptions);
+    verify(token: string): Promise<Result<VerifiedClaimsResult>>;
+}
+export declare const deviceIdCAFromEnv: (sthis: SuperThis) => Promise<Result<DeviceIdCA, Error>>;
+export declare const tokenApi: (sthis: SuperThis, opts: VerifyWithCertificateOptions) => Promise<{
+    "device-id": DeviceIdApiToken;
+    clerk: ClerkApiToken;
+}>;

package/token.js

@@ -0,0 +1,131 @@
+import { Lazy, Result, param, exception2Result } from "@adviser/cement";
+import { DeviceIdCA, DeviceIdVerifyMsg } from "@fireproof/core-device-id";
+import { sts } from "@fireproof/core-runtime";
+import { FPClerkClaimSchema, FPDeviceIDSessionSchema } from "@fireproof/core-types-base";
+import { jwtVerify } from "jose";
+export class ClerkApiToken {
+    sthis;
+    constructor(sthis) {
+        this.sthis = sthis;
+    }
+    keysAndUrls = Lazy(() => {
+        const keys = [];
+        const urls = [];
+        for (let idx = 0; true; idx++) {
+            const suffix = !idx ? "" : `_${idx}`;
+            const key = `CLERK_PUB_JWT_KEY${suffix}`;
+            const url = `CLERK_PUB_JWT_URL${suffix}`;
+            const rEnvVal = this.sthis.env.gets({
+                [key]: param.OPTIONAL,
+                [url]: param.OPTIONAL,
+            });
+            if (rEnvVal.isErr()) {
+                return Result.Err(rEnvVal.Err());
+            }
+            const { [key]: keyVal, [url]: urlVal } = rEnvVal.Ok();
+            if (!keyVal && !urlVal) {
+                break;
+            }
+            if (keyVal) {
+                keys.push(keyVal);
+            }
+            if (urlVal) {
+                urls.push(...urlVal
+                    .split(",")
+                    .map((u) => u.trim())
+                    .filter((u) => u));
+            }
+        }
+        return Result.Ok({ keys, urls });
+    });
+    async verify(token) {
+        const { keys, urls } = this.keysAndUrls().Ok();
+        const rt = await sts.verifyToken(token, keys, urls, {
+            parseSchema: (payload) => {
+                const r = FPClerkClaimSchema.safeParse(payload);
+                if (r.success) {
+                    return Result.Ok(r.data);
+                }
+                else {
+                    console.log("FPClerkClaimSchema parse error", payload, r.error);
+                    return Result.Err(r.error);
+                }
+            },
+            verifyToken: async (token, key) => {
+                const rPublicKey = await sts.importJWK(key, "RS256");
+                if (rPublicKey.isErr()) {
+                    return Result.Err(rPublicKey);
+                }
+                const r = await exception2Result(() => jwtVerify(token, rPublicKey.Ok().key));
+                if (r.isErr()) {
+                    return Result.Err(r);
+                }
+                if (!r.Ok()) {
+                    return Result.Err("ClerkVerifyToken: failed");
+                }
+                return Result.Ok({
+                    payload: r.Ok(),
+                });
+            },
+        });
+        if (rt.isErr()) {
+            return Result.Err(rt.Err());
+        }
+        const t = rt.Ok();
+        return Result.Ok({
+            type: "clerk",
+            token,
+            claims: t.payload,
+        });
+    }
+}
+export class DeviceIdApiToken {
+    sthis;
+    opts;
+    constructor(sthis, opts) {
+        this.sthis = sthis;
+        this.opts = opts;
+    }
+    async verify(token) {
+        const verify = new DeviceIdVerifyMsg(this.sthis.txt.base64, [(await this.opts.deviceIdCA.caCertificate()).Ok()], {
+            maxAge: 3600,
+            ...this.opts,
+        });
+        const res = await verify.verifyWithCertificate(token, FPDeviceIDSessionSchema);
+        if (res.valid) {
+            const creatingUser = res.certificate.certificate.asCert().creatingUser;
+            if (!creatingUser || creatingUser.type !== "clerk") {
+                return Result.Err(`DeviceIdApiToken-verify: unsupported creatingUser type: ${creatingUser}`);
+            }
+            return Result.Ok({
+                type: "device-id",
+                token,
+                claims: creatingUser.claims,
+            });
+        }
+        return Result.Err(res.error);
+    }
+}
+export const deviceIdCAFromEnv = Lazy((sthis) => {
+    const rEnv = sthis.env.gets({
+        DEVICE_ID_CA_PRIV_KEY: param.REQUIRED,
+        DEVICE_ID_CA_CERT: param.REQUIRED,
+    });
+    if (rEnv.isErr()) {
+        throw rEnv.Err();
+    }
+    const envVals = rEnv.Ok();
+    return DeviceIdCA.from(sthis, {
+        privateKey: envVals.DEVICE_ID_CA_PRIV_KEY,
+        signedCert: envVals.DEVICE_ID_CA_CERT,
+    }, {
+        generateSerialNumber: async () => sthis.nextId(32).str,
+    });
+});
+export const tokenApi = Lazy(async (sthis, opts) => {
+    return {
+        "device-id": new DeviceIdApiToken(sthis, opts),
+        clerk: new ClerkApiToken(sthis),
+    };
+});
+//# sourceMappingURL=token.js.map

package/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../jsr/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,yBAAyB,CAAC;AAC9C,OAAO,EAA2B,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGlH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,OAAO,aAAa;IACf,KAAK,CAAY;IAC1B,YAAY,KAAgB,EAAE;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAAA,CACpB;IAEQ,WAAW,GAAG,IAAI,CAAC,GAA+C,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAa,EAAE,CAAC;QAE1B,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,oBAAoB,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,oBAAoB,MAAM,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAClC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ;gBACrB,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ;aACtB,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpB,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBAEvB,MAAM;YACR,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CACP,GAAG,MAAM;qBACN,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACpB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAAA,CAClC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAyC;QACjE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QAE/C,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;YAClD,WAAW,EAAE,CAAC,OAAgB,EAAwB,EAAE,CAAC;gBACvD,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBAEN,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBAChE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YAAA,CACF;YACD,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACrD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAChC,CAAC;gBAID,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAC9B,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAK5C,CAAC;gBAEF,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;oBACd,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;oBACZ,OAAO,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;gBAChD,CAAC;gBACD,OAAO,MAAM,CAAC,EAAE,CAAC;oBACf,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;iBAChB,CAAC,CAAC;YAAA,CACJ;SACF,CAAC,CAAC;QACH,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,EAAE,CAAC;YACf,IAAI,EAAE,OAAO;YACb,KAAK;YACL,MAAM,EAAE,CAAC,CAAC,OAAO;SAClB,CAAC,CAAC;IAAA,CACJ;CACF;AAED,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAY;IACjB,IAAI,CAA+B;IAC5C,YAAY,KAAgB,EAAE,IAAkC,EAAE;QAChE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CAClB;IACD,KAAK,CAAC,MAAM,CAAC,KAAa,EAAyC;QACjE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAC/G,MAAM,EAAE,IAAI;YACZ,GAAG,IAAI,CAAC,IAAI;SACb,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,YAAY,GAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAqD,CAAC,YAAY,CAAC;YAG3H,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnD,OAAO,MAAM,CAAC,GAAG,CAAC,2DAA2D,YAAY,EAAE,CAAC,CAAC;YAC/F,CAAC;YAED,OAAO,MAAM,CAAC,EAAE,CAAC;gBACf,IAAI,EAAE,WAAW;gBACjB,KAAK;gBACL,MAAM,EAAE,YAAY,CAAC,MAAM;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAAA,CAC9B;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,KAAgB,EAAE,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAC1B,qBAAqB,EAAE,KAAK,CAAC,QAAQ;QACrC,iBAAiB,EAAE,KAAK,CAAC,QAAQ;KAClC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IAC1B,OAAO,UAAU,CAAC,IAAI,CACpB,KAAK,EACL;QACE,UAAU,EAAE,OAAO,CAAC,qBAAqB;QACzC,UAAU,EAAE,OAAO,CAAC,iBAAiB;KACtC,EACD;QACE,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG;KACvD,CACF,CAAC;AAAA,CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,KAAgB,EAAE,IAAkC,EAAE,EAAE,CAAC;IAO3F,OAAO;QACL,WAAW,EAAE,IAAI,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC;QAC9C,KAAK,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC;KAChC,CAAC;AAAA,CACH,CAAC,CAAC"}